European Data Broker Opt-Out List & Removal Guide
(GDPR, 2026)

Your Legal Rights Under GDPR

Unlike the opt-out model common in the United States, the European framework treats personal data processing as prohibited by default unless a lawful basis is established under Article 6. For data brokers relying on “legitimate interests,” that basis faces increasing scrutiny from national DPAs as individual rights requests accelerate.

If a broker fails to respond within 30 days or refuses a valid request, escalate to your national DPA: the AP (Netherlands), CNIL (France), BfDI (Germany), ICO (UK). DPA complaints are free to file and carry real enforcement consequences — GDPR fines in 2024 exceeded €1.5 billion across Europe.

Before You Start

Deletion versus suppression

Deletion removes your record from the broker’s active database. Suppression retains the data internally but flags it so it cannot be used, sold, or displayed. For ongoing protection, suppression is often more effective: a suppressed identifier prevents re-scraped data from resurfacing in future. Where a broker offers both options, request deletion and suppression.

Use a dedicated email address

Create a separate email address for opt-out requests. Using your primary address hands the broker a confirmed, live contact point — the opposite of what you want. A masked alias (via SimpleLogin, Apple Hide My Email, or a disposable service) is preferable.

Track your submissions

Keep a spreadsheet: broker name, date submitted, confirmation code, and the 30-day deadline. If you receive no response by the deadline, escalate directly to the relevant DPA rather than chasing the broker a second time.

For US-based people-search aggregators (Spokeo, BeenVerified, Whitepages, and similar), see the US Data Broker Opt-Out List — 104 brokers across eight tiers — or follow the step-by-step US Data Broker Opt-Out Guide.

GDPR Data Removal Request: Email Template

Brokers respond faster to a request that names the legal basis and the statutory deadline than to an informal one. Copy the Article 17 erasure request below, replace the bracketed fields, and send it to each broker’s privacy or Data Protection Officer address from the directory. Keep a copy of every email — it becomes your evidence if you later escalate to a DPA.

Subject: Request for Erasure of Personal Data — Article 17 GDPR

To the Data Protection Officer,

I am a resident of [COUNTRY] and a data subject under the General Data
Protection Regulation. Under Article 17 GDPR, I request the erasure of
all personal data your organisation holds about me, including any data
acquired or inferred from third-party sources.

Identifying details (for matching purposes only):
  Full name:         [FULL NAME]
  Email address:     [EMAIL]
  Other identifiers: [ADDRESS / PHONE / DATE OF BIRTH, if applicable]

Under Article 19 GDPR, I also request that you notify any recipients to
whom my data has been disclosed of this erasure. Where deletion is not
technically possible, I request suppression so the data cannot be
processed, sold, or displayed.

Please confirm completion within one month, as required by Article
12(3) GDPR. If I receive no response by that deadline, I will lodge a
complaint with [NATIONAL DPA — e.g. AP, CNIL, BfDI, ICO].

Yours faithfully,
[FULL NAME]
[DATE]

Send from a dedicated alias rather than your primary address, so the request does not confirm a live, primary contact point. If you would rather have the full record built from your own exposure and the requests submitted for you, see the Presence Reduction Brief or The Eraser.

Manual vs Automated Removal: Why US-Built Services Have Limited EU Reach

Subscription removal services like DeleteMe, Incogni, Privacy Bee, and Kanary are automated by design — their value proposition is volume. They submit opt-out requests across a fixed catalogue of roughly 600 mostly-US people-search aggregators (Spokeo, BeenVerified, Whitepages, Intelius, and similar). The automation works because the US market shares three structural features: standardised consumer opt-out portals shaped by CCPA, a consistent target list of consumer-facing aggregators, and high-volume same-shape requests that scale.

The EU market shares none of those features. Consumer-facing people-search platforms are scarce — the cultural appetite that drives US aggregators is weaker outside the United States. The broker landscape is heterogeneous: AdTech vendors operating under the IAB TCF, B2B intelligence firms (Bureau van Dijk, Dun & Bradstreet Europe), DGA-registered data intermediaries, and credit and identity bureaux. Each requires a different request shape. AdTech withdrawal goes through the consent management platform that originally collected consent. B2B intelligence often requires an Article 15 access request first to surface the record. Some brokers respond only to letters posted to a specific DPO address. Automated submission cannot map across these without breaking.

Manual GDPR opt-out is the EU equivalent of what those services do in the US — and it carries a stronger legal lever. Article 17 imposes a 30-day response deadline. Non-response can be escalated to a national DPA (AP, CNIL, BfDI, ICO, and others), which carries real enforcement consequences. The directory below covers 75 EU brokers most likely to hold your data, grouped by sector — submit Article 17 requests directly, escalate non-response to your national DPA, and track each submission against the 30-day deadline.

Obstruction Tactics to Know About

Known non-functional portals (May 2026)

• Mozilla Data Removal: Mozilla has exited the data removal industry. All previous removal links are inactive — do not use.
• Findem: The privacy policy page remains indexed by search engines but the opt-out form submit button is non-responsive. Contact their DPO by email directly instead.