The data broker wants a copy of your driver's license to remove your address. You are handing the company that sells your data more of your data, to stop it selling your data. The request is not obviously illegitimate, and that is what makes it dangerous. Some verification is real. Some of it is a second harvest, dressed up as a security check.
Most people-search opt-outs work the same way: find your listing, copy its URL, submit it with a removal email, and click the confirmation link. The verification is light, an email link, a phone call with a code, a CAPTCHA, because the broker already has your name and address, and the email confirms you are the person asking. The Data Guys guide puts the rule plainly: do not give more than they already have. Some sites ask for extra information, like an ID upload, and the guide warns to be suspicious, because California penalized one broker for doing exactly that, demanding sensitive data like a partial Social Security number just to opt out.
A broker is entitled to verify that the person asking for removal is the person in the record. That is a real need, because a removal request from a stranger is a way to delete someone else's data, or to test whether a record exists. The legitimate methods are narrow: an email confirmation to an address you control, a phone call with a code to a number you control, or a request that you provide the exact profile URL and the name as it appears in the record. Those methods confirm identity without collecting new data.
An ID upload is a different thing. A driver's license contains your full name, date of birth, address, license number, and a photograph, which is more data than the broker already holds, and more data than it needs to verify you. The Consumoteca guide makes the same point: never send a Social Security number for a normal people-search opt-out, and treat any demand for sensitive data as a reason to stop and check the broker's legal basis, not as a routine step to complete.
First, check whether the demand is real or a dark pattern. Some brokers put the ID upload behind a button labeled verify your identity, and the actual requirement is an email confirmation that the page does not mention. Read the broker's privacy page, not just the form, and look for the opt-out method the law requires. In California, the Delete Request and Opt-out Platform, DROP, lets residents send one request to more than 600 registered brokers, and the platform hashes your information, turning it into a scrambled string, so raw data is not stored or shared. A broker that demands your license when a hashed request would do is demanding more than the law allows.
Second, refuse and escalate. Submit the opt-out with the minimum information the broker already holds, and state in writing that you are declining to provide additional sensitive data. If the broker refuses the opt-out, file a complaint with the state privacy regulator, in California the Privacy Protection Agency, or with the Federal Trade Commission. A broker that penalizes you for refusing to hand over your ID is the broker the regulator wants to hear about.
Third, use a removal email. Create a new email address just for opt-outs, because you will get confirmation emails, and you do not want them mixed with your real inbox, or to hand brokers your main address. The removal email is the one piece of new data you should give them, and it is a piece you control and can abandon.
Before you upload an ID, a Social Security number, or any sensitive document to a data broker, ask three questions. Does the broker already have this information. Is there a less invasive way to verify me. And what happens to this document after the opt-out is processed. If the answer to the first is no, the second is yes, or the third is unclear, do not upload it. The opt-out is supposed to reduce your exposure, not increase it, and a broker that asks for your license to remove your address is asking you to trust it with more than it already took.
Keep reading: when the opt-out did not take, broker data vs public records, and the people-search opt-out verification loops cover the nearby cases in this series.
It can ask, but it should not need to. Legitimate verification is an email confirmation, a phone call with a code, or the exact profile URL. An ID upload collects more data than the broker already holds, and California penalized one broker for demanding sensitive data just to opt out.
Refuse and escalate. Submit the opt-out with the minimum information the broker already holds, state in writing that you are declining to provide additional sensitive data, and file a complaint with the state privacy regulator if the broker refuses the opt-out.
In California, yes. The Delete Request and Opt-out Platform, DROP, lets residents send one request to more than 600 registered brokers, and it hashes your information so raw data is not stored or shared. Outside California, use a dedicated removal email address and give only what the broker already has.
Never for a normal people-search opt-out. If a site demands a partial Social Security number just to opt out, be suspicious. That demand is the reason to stop and check the broker's legal basis, not a routine step to complete.