How do I stop companies from selling my data?

short answer

In states with comprehensive privacy laws you can require companies to stop selling or sharing your personal data, usually through a Do Not Sell or Share link in their footer. You can also enable Global Privacy Control in your browser, which sends an automatic opt-out signal that California and several other states legally require businesses to honor. For data already held by brokers, each broker must be contacted separately — California's DELETE Act is building a single mechanism, but it is not fully operational everywhere yet.

The fastest thing you can do

Enable Global Privacy Control. It is a browser-level signal that automatically tells every site you visit that you opt out of sale and sharing.

Built into Firefox, Brave, and DuckDuckGo’s browser
Available as an extension for Chrome and Edge
Legally binding in California, and recognized by several other state laws

One setting, applied to every site, without filling in a form on each one. It is the highest-leverage privacy action available to most people and takes about a minute.

Site by site

Look for “Do Not Sell or Share My Personal Information” in the footer — required wording in California and mirrored elsewhere. It should lead to a form that does not require you to create an account.

If a business makes this hard — demanding an account, excessive verification, or routing you through support — that is itself often a compliance failure, and your state attorney general takes complaints about it.

Data brokers are the harder problem

Opting out at a website you used does nothing about brokers who already hold your data from elsewhere. There are hundreds, and each must be handled separately.

California maintains a public data broker registry, and the DELETE Act is building a single deletion mechanism covering registered brokers. It is being phased in.
Other states increasingly require broker registration but not one-stop deletion.
Removal services exist commercially. They are doing the same work you could do by hand, at scale — evaluate them on which brokers they cover and whether they re-check, since removals frequently do not stick.

What opting out does not do

It does not delete data already held. Opt-out and deletion are separate requests — make both if you want both.
It does not reach data already sold. You generally have to ask each recipient separately.
It does not stop first-party use. A company can usually still use your data for its own purposes.
It is not permanent. Give a company your details again later and, depending on the state and the mechanism, you may be starting over.

The part nobody likes

None of this is as effective as not handing the data over in the first place.

Opt-outs, deletions and removal services are all remediation — they run after the disclosure has happened, they are incomplete, and they need repeating. The decision that actually controls your exposure is what you type into a form before you press submit.

That is not a reason to skip the opt-outs. It is a reason not to mistake them for a solution.

General information, not legal advice. State opt-out mechanisms change; check current requirements where you live.