If you live in California, you have the right to demand that any data broker delete your personal information within 45 days. If you live in Virginia, Colorado, Connecticut, or any of 16 other states, you have similar rights under your state's privacy law.
If you live in North Dakota, you have nothing.
North Dakota has not enacted a comprehensive consumer privacy law. There is no state statute requiring data brokers to delete your personal information upon request. There is no state agency tasked with enforcing consumer privacy rights. There is no registration requirement for data brokers operating in the state. And there is no penalty for a company that collects and sells your personal information without your consent.
This means that the 2,415+ data brokers collecting and selling personal information about North Dakota residents are under no state-level obligation to stop. They can collect your name, address, phone number, email, employer, salary estimate, property records, vehicle data, shopping habits, and GPS location from your phone — and sell it to anyone — indefinitely.
Vigilant Privacy sends CCPA deletion demands to data brokers on behalf of subscribers in all 50 states, including North Dakota. Here's what actually happens when a North Dakota resident tries to exercise privacy rights that their state does not guarantee.
Most major data brokers process the request anyway. They honor CCPA deletion demands regardless of the consumer's state because it is cheaper to delete the data than to verify residency. For these brokers, the practical reality is that CCPA creates a de facto national standard.
But some brokers explicitly reject requests from residents of states like North Dakota that have no comprehensive privacy law, citing the consumer's state of residence as the reason they won't process the request.
Brokers that send this kind of rejection are not breaking any law. North Dakota gives its residents no legal right to demand deletion. The brokers are simply choosing not to extend a courtesy that they have no obligation to provide.
The result: A North Dakota resident's personal information remains for sale on these broker sites indefinitely. Their name, address, phone number, and relatives are available to stalkers, scammers, identity thieves, and anyone else willing to search for them. And there is nothing the state of North Dakota has done to prevent it.
North Dakota is not alone. As of August 2026, 30 states have no comprehensive consumer privacy law. Residents of these states have no state-level right to demand that data brokers delete their personal information.
The unprotected states include Alaska, Alabama, Arizona, Arkansas, Georgia, Hawaii, Idaho, Illinois (has biometric protections only), Kansas, Louisiana, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York (limited protections only), North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, Vermont (broker registration only), Washington (limited), West Virginia, Wisconsin, and Wyoming.
Some of these states have partial protections — Illinois has the Biometric Information Privacy Act, Vermont requires data broker registration, and Washington has the My Health My Data Act. But none have comprehensive privacy laws comparable to California's CCPA or the laws enacted by the 20 states that do provide deletion rights.
The privacy gap disproportionately affects residents of rural states like North Dakota. In a state with 780,000 people, data broker profiles are more identifying than in a state with 40 million. A listing showing "John McMahon, Williston, ND" narrows the search to a handful of people. The same name in Los Angeles could match hundreds.
Rural communities are also more vulnerable to the consequences of data exposure. In small towns, a data broker listing that reveals an address, phone number, or family members is more actionable for someone with harmful intent. The person listed can be found more easily, approached more directly, and targeted more effectively.
Despite this heightened vulnerability, rural states are the least likely to have enacted privacy protections. The data broker industry has less lobbying opposition in states with smaller populations and less tech industry presence, which means there is less political pressure to pass protective legislation.
North Dakota could enact a comprehensive consumer privacy law modeled on the strongest provisions from the 20 states that have already acted. Such a law would give residents the right to know what personal information data brokers collect about them, the right to demand deletion within a reasonable timeframe, the right to opt out of the sale of their personal information, and would impose penalties on brokers that fail to comply.
A federal privacy law would protect residents of all 50 states equally, eliminating the current patchwork where privacy rights depend on which state you happen to live in. North Dakota's congressional delegation, like every other state's, has a direct stake in whether that patchwork ever gets closed.
The Fourth Amendment Is Not For Sale Act, which passed the House of Representatives, would prohibit law enforcement from purchasing commercially available data that would otherwise require a warrant. This bill addresses the most extreme form of data broker abuse — government surveillance without judicial oversight — but has stalled in the Senate.
If you live in North Dakota or any state without a comprehensive privacy law, you are not completely powerless. The CCPA remains effective for most major data brokers even from out of state, because the law regulates the broker's behavior regardless of where the consumer lives. Most brokers comply rather than verify residency.
Freeze your credit at all four bureaus. Register at OptOutPrescreen.com and DoNotCall.gov. Submit CCPA deletion demands to data brokers citing California Civil Code Section 1798.105. And contact your state legislators to ask why North Dakota residents have fewer privacy rights than Californians.
The data broker industry profits from the absence of laws in states like North Dakota. Every day without legislation is another day that 2,415 companies can freely collect and sell your personal information with no legal consequence.
Your state may not protect your privacy. We do. Vigilant Privacy sends CCPA deletion demands on behalf of subscribers in all 50 states, including the 30 states that provide no privacy protections of their own. When your state will not fight for your data, we will.
No matter where you live, we send legal CCPA deletion demands to 2,415 data brokers, request CRA disclosures from 37 agencies, and target government surveillance brokers. Your state may not have a privacy law. We use California's. $9.95/month.
Start Your Free 7-Day TrialNo credit card required. Cancel anytime. We never sell your data.