You search your name in Google. Third result is a Dutch people-search site with your home address, employer, and approximate age. You didn’t sign up for it. You don’t know how to get off it. In the US, you’d have to navigate a voluntary opt-out form that may or may not work. In the EU, you have something better: a legal right to demand deletion within 30 days, backed by enforceable penalties if they refuse.
That right exists right now. Most EU residents don’t use it.
How do you remove your data from EU data brokers? Use your GDPR Article 17 right to erasure. Find the broker’s Data Protection Officer contact in its privacy policy. Send a formal erasure request naming the data you want deleted, and note the date. The company must confirm deletion within 30 days or cite a specific legal ground for refusing. If it refuses without a valid basis, file a free complaint with your national supervisory authority. This is a legal right, not a voluntary opt-out like the US model.
The data broker industry in Europe
The European data broker market is smaller than the US industry, but it’s real. It includes some of the same companies operating on both continents.
Acxiom EU (headquartered in Luxembourg) maintains consumer data profiles across Europe, primarily for direct marketing. Experian operates credit and marketing data services across nearly every EU member state. Epsilon (France) runs marketing data and targeting services. Nielsen Marketing Cloud aggregates consumer behavior data for advertisers throughout the EU.
Scandinavia has Bisnode, a major business and consumer data aggregator now part of Dun & Bradstreet. Germany has Creditreform, which holds both business and individual credit data. These aren’t fringe operations — they serve major brands and financial institutions.
Beyond the marketing data tier, there’s the people-search layer. Europages aggregates business contact data. 118.nl in the Netherlands lists residential phone numbers and addresses. Das Telefonbuch and Gelbe Seiten in Germany publish address and contact data for millions of residents. These sites pull from public records, telecom directories, and — sometimes — data they’ve purchased.
Your GDPR lever: the erasure request
This is where EU law diverges sharply from the US. California’s CCPA gives you opt-out rights. India’s DPDPA gives you erasure rights but enforcement infrastructure is still building. GDPR gives you enforceable deletion rights with teeth.
If you’re covering US sites too, the walkthrough is in how to remove yourself from US data brokers. Under Article 17 of the GDPR, the right to erasure, any company processing your personal data must delete it in three cases. When you withdraw consent. When the data is no longer necessary for its original purpose. Or when there’s no legitimate legal basis for continued processing. Data brokers holding your consumer profile for marketing don’t have a legal basis that overrides your erasure request. They must delete.
The company must respond within 30 days, not “when they get around to it.” They must either confirm deletion or explain in writing why they’re refusing. Any refusal has to cite a specific legal basis. The burden is on them, not you. For the full breakdown of all your GDPR rights — access, portability, restriction, objection — see our GDPR rights practical guide.
How to send an erasure request to a data broker
Under GDPR Article 37, some companies must designate a Data Protection Officer (DPO). That covers firms carrying out large-scale systematic monitoring of individuals, processing large-scale sensitive data, or acting as a public authority. Data brokers qualify. Their DPO contact must be published — usually in their privacy policy.
Start there. Find the DPO email. Then write a formal erasure request.
Your request needs four things. Give your full name, the data you want deleted (be specific: name, address, phone, any profile data), and your country of residence. Then state clearly that you are invoking your Article 17 right to erasure. This template works:
Subject: GDPR Article 17 — Request for Erasure of Personal Data
To the Data Protection Officer,
I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR). I am an EU resident. Please delete all personal data you hold relating to me, including but not limited to: [name, address, phone number, any profile or consumer data]. I withdraw any consent previously given for processing of my data.
Please confirm deletion within 30 days, or provide written grounds for any retention under Article 17(3).
[Your full name] [Your email address] [Date]
Send it. Note the date. If they acknowledge but delay past 30 days, that’s a compliance failure you can report.
Country-specific people-search sites
EU people-search sites are often national — they pull from local directories and public records — so you may need to address each country’s sites separately.
192.com covers the UK (post-Brexit but still relevant if you’ve lived there). It has a “remove my listing” form under its privacy policy page. Das Telefonbuch and Gelbe Seiten in Germany both have opt-out forms. A formal GDPR erasure request works as a backup if the form produces no result.
PagesJaunes in France lists residential and business contacts. Their privacy policy links to a removal form, but the form is inconsistent. A written erasure request to their DPO (findable in their privacy policy) is more reliable. Paginas Amarillas in Spain operates similarly.
The pattern is the same across all of these. Try the removal form first, because it’s faster and lower-friction. Then send a formal GDPR erasure request if the form fails or produces no confirmation within two weeks. A written request creates a paper trail that a form submission often doesn’t.
What happens when they refuse
Companies can legally refuse an erasure request under GDPR Article 17(3) — but the grounds are narrow. Valid reasons are narrow. They include legal obligations requiring retention (tax records, court orders) and vital interests (medical data needed for emergency care). They also include public-interest tasks (certain journalistic, scientific, or archival uses), and legitimate interests that override yours in specific contexts.
“We find your data commercially valuable” is not a valid ground. “You’re a customer” is not a valid ground if you haven’t been their customer in any direct sense. A data broker holding your marketing profile — where you never had a customer relationship — has very few valid refusal grounds.
If a company refuses without a valid legal basis, escalate. File a complaint with your national supervisory authority (SA):
- Ireland (DPC): dpc.ie/complaints
- France (CNIL): cnil.fr/plainte
- Germany (BfDI): bfdi.bund.de — or your state-level DPA (Datenschutzbeauftragter)
- Netherlands (AP): autoriteitpersoonsgegevens.nl
- Spain (AEPD): aepd.es/es/derechos-y-deberes/conoce-tus-derechos/reclamacion-ante-la-aepd
Every EU member state has a supervisory authority with the power to investigate, fine, and order deletion. Complaint processes are free and straightforward. The GDPR maximum penalty is €20 million or 4% of global annual turnover — whichever is higher. Companies know this. A complaint submission often produces faster results than you’d expect.
Ad tech and marketing data brokers: the harder layer
Beyond people-search sites, there’s a deeper layer of data brokers you’ve probably never heard of — and that’s by design.
LiveRamp operates a massive identity resolution network across the EU, connecting your offline identity to your digital behavior. Oracle Data Cloud held consumer data for advertising targeting across European markets before Oracle wound down its advertising-data business in 2024. The Trade Desk operates a demand-side advertising platform that processes behavioral data on EU consumers. These companies don’t publish your phone number on a searchable website. They sell your behavioral profile to advertisers without you knowing.
They still accept GDPR erasure requests. The process is less visible, because their DPO contacts are buried in privacy policies rather than prominently displayed. But they’re there. LiveRamp’s privacy policy includes a “Do Not Sell or Share” link. That is a US CCPA opt-out mechanism, not a GDPR right, so EU residents should submit an Article 17 erasure request instead. Oracle published DPO contact forms before it wound down its advertising business.
This tier requires more persistence. Response timelines are slower, the confirmation process is less obvious, and re-listing can happen if you interact with any site in their network. But the legal right is the same — Article 17 applies regardless of whether the broker operates a consumer-facing site or runs entirely in the background.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.