Privacy Action Plan Generator
Choose your state and the kinds of protection you want. The tool builds an ordered, printable checklist of steps (all free except one optional mail service), each with the official page where you take it and our guide for the details.
Nothing you choose here is stored or sent anywhere. The plan is built in your browser, there are no text fields, and every step happens on an official site, never on ours.
We checked every step on September 28, 2026, against its official source wherever one exists.
Your choices stay on this page. Reloading clears them.
Why the steps come in this order
The plan puts the fastest protection first. A credit freeze blocks the most damaging kind of misuse, new accounts opened in your name, and it takes a few minutes per bureau. If your identity has already been stolen, reporting it comes before everything else, because the report unlocks the seven-year fraud alert.
Removal comes next. California residents start with DROP, which reaches every registered broker with one request. Everyone then turns on Global Privacy Control, which works in the background from then on, and handles the remaining brokers and people-search sites one by one, starting with the requests that cover several sites at once.
Marketing opt-outs come last because they reduce annoyance more than risk. The free federal ones (prescreened offers and Do Not Call) are listed before the paid, industry-run mail service.
State privacy laws at a glance
Your state decides how much legal force a data broker opt-out carries. This table shows what we verified on September 28, 2026, from each state’s statute text or official agency page where a law exists, and from national trackers where we found none. "Not assessed" means we have not verified it yet, not that the state has no rule.
| State | Consumer privacy law | Must honor GPC | Broker registry |
|---|---|---|---|
| Alabama | Not assessed | Not assessed | None identified |
| Alaska | None identified | Not assessed | None identified |
| Arizona | None identified | Not assessed | None identified |
| Arkansas | None identified | Not assessed | None identified |
| California | In effect | Yes | Yes |
| Colorado | In effect | Yes | None identified |
| Connecticut | In effect | Yes | Not assessed |
| Delaware | In effect | Yes | None identified |
| District of Columbia | None identified | Not assessed | None identified |
| Florida | In effect (very large companies only) | Not assessed | None identified |
| Georgia | None identified | Not assessed | None identified |
| Hawaii | None identified | Not assessed | None identified |
| Idaho | None identified | Not assessed | None identified |
| Illinois | None identified | Not assessed | None identified |
| Indiana | In effect since January 1, 2026 | Not assessed | None identified |
| Iowa | In effect since January 1, 2025 (sale opt-out only) | Not assessed | None identified |
| Kansas | None identified | Not assessed | None identified |
| Kentucky | In effect since January 1, 2026 | Not assessed | None identified |
| Louisiana | Takes effect January 1, 2027 | From January 1, 2027, with exceptions | None identified |
| Maine | None identified | Not assessed | None identified |
| Maryland | In effect since October 1, 2025 | Not assessed | None identified |
| Massachusetts | None identified | Not assessed | None identified |
| Michigan | None identified | Not assessed | None identified |
| Minnesota | In effect since July 31, 2025 | Yes | None identified |
| Mississippi | None identified | Not assessed | None identified |
| Missouri | None identified | Not assessed | None identified |
| Montana | In effect | Yes | None identified |
| Nebraska | In effect since January 1, 2025 | Yes, with exceptions | None identified |
| Nevada | None identified | Not assessed | None identified |
| New Hampshire | In effect since January 1, 2025 | Yes | None identified |
| New Jersey | In effect | Yes | Not assessed |
| New Mexico | None identified | Not assessed | None identified |
| New York | None identified | Not assessed | None identified |
| North Carolina | None identified | Not assessed | None identified |
| North Dakota | None identified | Not assessed | None identified |
| Ohio | None identified | Not assessed | None identified |
| Oklahoma | Takes effect January 1, 2027 | Not assessed | None identified |
| Oregon | In effect since July 1, 2024 | Yes | Yes |
| Pennsylvania | None identified | Not assessed | None identified |
| Rhode Island | In effect since January 1, 2026 | Not assessed | None identified |
| South Carolina | None identified | Not assessed | None identified |
| South Dakota | None identified | Not assessed | None identified |
| Tennessee | In effect since July 1, 2025 | Not assessed | None identified |
| Texas | In effect since July 1, 2024 | Yes, with exceptions | Yes |
| Utah | In effect since December 31, 2023 | Not assessed | None identified |
| Vermont | Takes effect January 1, 2028 | From January 1, 2028 | Yes |
| Virginia | In effect | Not assessed | None identified |
| Washington | None identified | Not assessed | None identified |
| West Virginia | None identified | Not assessed | None identified |
| Wisconsin | None identified | Not assessed | None identified |
| Wyoming | None identified | Not assessed | None identified |
What this plan cannot do
- It cannot delete anything for you. Each step is a request you make on an official or company site, and each company decides how to respond within the law that applies to it.
- It does not guarantee that you will not become a victim of identity theft. A freeze and opt-outs lower the risk; they do not remove it.
- People-search listings can return when sites load new public records. Repeat the name searches every few months.
- Paid removal services exist. Every step in this plan except the optional DMAchoice mail service is free, and you can do all of it yourself.
This tool gives general information about privacy options, not legal advice. Laws, deadlines and official sites change; always follow the instructions on the official site linked in each step.
Frequently Asked Questions
Does this tool collect my personal information?
No. You only pick a state and tick boxes, and the plan is built in your browser. Nothing is saved, sent or added to the page address. The official sites you visit for each step will ask for information, and their own privacy policies apply there.
Is a credit freeze really free?
Yes. Federal law (15 U.S.C. § 1681c-1(i)) requires Equifax, Experian and TransUnion to place and lift a freeze free of charge, and it does not affect your credit score. You need to place it at each bureau separately.
Can I use DROP if I do not live in California?
No. CalPrivacy accepts DROP requests only from California residents. Outside California, use Global Privacy Control, the public broker registries and the per-broker requests in your plan.
What is the difference between a fraud alert and a freeze?
A fraud alert asks lenders to verify your identity before opening credit, and one call to any bureau covers all three. A freeze blocks access to your credit report until you lift it, and you place it at each bureau. Both are free.
Do I need to pay a removal service?
No. Every step in this plan except the optional DMAchoice mail service is free to do yourself, and none of them requires a paid removal service.
Will the Do Not Call Registry stop scam calls?
No. The FTC says the registry tells registered telemarketers which numbers not to call; it does not block calls, and scammers ignore it. Sales calls can take up to 31 days to stop after you register.
Know someone who could use this? Share this free tool: