// Skip tracing
State privacy laws and skip tracing (CCPA and beyond)
About twenty states now have consumer-privacy laws that touch skip tracing. California's CCPA/CPRA is strictest. Here's what deletion and opt-out obligations you inherit.
The short answer
On top of the federal rules, about twenty states now have comprehensive consumer-privacy laws that touch skip tracing. California's CCPA/CPRA is the strictest, giving residents rights to know, delete, and opt out of the sale of their personal information, and it regulates data brokers directly. If you buy or use skip-traced data on residents of these states, you inherit obligations around deletion requests and opt-outs.
The state privacy wave
Since California's CCPA took effect in 2020, roughly twenty states have passed their own comprehensive privacy laws, including Virginia, Colorado, Connecticut, Texas, and Utah. They aren't identical, but they share a core: residents can find out what personal data a business holds, ask to delete it, and opt out of its sale or sharing. Skip-traced contact data is personal information under these laws.
Data broker registration
Several states, California and Vermont among the first, require data brokers to register and honor consumer requests. If your business collects and sells personal information about people you don't have a direct relationship with, you may meet the definition of a data broker and pick up registration and deletion duties. Buyers of skip-trace data usually aren't brokers themselves, but the tools they use are.
What this means in practice
For most real-estate investors, the practical touchpoint is deletion and opt-out requests. If a property owner in California asks you to delete their data or stop contacting them, you honor it, and you keep that suppression permanent. It's also why a good skip-trace and outreach stack has a way to suppress a contact across your whole list the moment they opt out.
How Trackyr handles this
Trackyr stores provenance on every contact and suppresses opt-outs across the whole graph, with deletion requests handled through a public data-subject request endpoint. That's the machinery these laws expect: a way to honor delete me and stop contacting me quickly and permanently, without hunting through spreadsheets.
// Common questions
Answered.
Does the CCPA apply to skip tracing?+
Yes, for California residents. Skip-traced contact data is personal information under the CCPA/CPRA, so California residents can ask to know what you hold, delete it, and opt out of its sale. You have to honor those requests.
Do state privacy laws ban skip tracing?+
No. They regulate it by giving residents rights to access, delete, and opt out of their personal data. The obligation on you is a reliable suppression and deletion process, not stopping skip tracing.
What is a data broker under state law?+
Generally, a business that collects and sells personal information about people it has no direct relationship with. Several states require data brokers to register and honor deletion requests. Skip-trace data vendors often qualify; their customers usually don't.
// Keep reading
More on skip tracing.
Skip tracing laws in California: licensing, privacy, and DNC rules
Is skip tracing legal in California? Do you need a license? Here's California's PI-licensing status, privacy law, and telemarketing rules, plus the federal rules that always apply.
Read →Skip tracing laws in Texas: licensing, privacy, and DNC rules
Is skip tracing legal in Texas? Do you need a license? Here's Texas's PI-licensing status, privacy law, and telemarketing rules, plus the federal rules that always apply.
Read →Skip tracing laws in Florida: licensing, privacy, and DNC rules
Is skip tracing legal in Florida? Do you need a license? Here's Florida's PI-licensing status, privacy law, and telemarketing rules, plus the federal rules that always apply.
Read →Put this into practice.
Verified creator + B2B contacts, one shared pool, paid only for what you use.
Start hunting →