[Do not call and data removal letters]

We mail your do not call list request letter, with photo proof it was sent

Upload your letter, or pick a template and let AI copy your details into it. We print it, envelope and label it, pay the postage and mail it, from $2.00 First-Class to Certified with a return receipt.

mailbox.botPRINT + SEALCERTIFIED MAILYOUR LETTERSEALED, LABELED, POSTAGE PAIDUSPSSIGNEDFORPHOTOS, TRACKING AND WEBHOOKS COME BACK TO YOU
Letter deskFree to write. Mail from $2.00.
1. What do you want stopped?

You pick the letter; AI copies your details into its blanks, so it can't invent a law. An AI provider that keeps no copy reads what you type, and we don't save it.

mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk. Full disclaimer

[How it works]

You or your agent send the letter. We put it in the mail.

No printer, no green card to fill out and no line at the post office counter. Five steps, and you only do the first one.

  1. 1
    You
    You write or upload it

    Fill in a free template above or upload your own PDF. Your agent can send it too.

  2. 2
    We
    We print it

    Every page, in the order you sent it, in black and white or color.

  3. 3
    We
    We envelope and label it

    We buy the postage and print the label: Certified Mail with an electronic return receipt, or the service you pick.

  4. 4
    We
    We hand it to USPS

    Prepared for dispatch the next business day by our staff in Manhattan Beach, CA.

  5. 5
    We
    You get the proof

    The certified number, the delivery record, and photos of the pages and the sealed envelope.

One page: Certified Mail $20.00, with a return receipt $24.00, First-Class $2.00. Each extra page adds $0.40 plus any postage increase. Templates are free. You see the exact price before you pay.

[Quick answer]

What is a do not call list request letter?

It's a written request telling a company to stop calling your number and add it to the company's own do-not-call list. Under FCC rule 47 C.F.R. § 64.1200(d)(3), a telemarketer must record the request and honor it within a reasonable time, no more than 10 business days after receiving it, and keep honoring it for five years. If you get more than one call in 12 months in violation of the do-not-call rules, 47 U.S.C. § 227(c)(5) lets you sue for up to $500 per violation, and a court can triple that if it was willful or knowing. That is civil liability a court decides, not a criminal charge. The same idea reaches your data: state privacy laws give a business or data broker a deadline, usually 45 days, to delete it or stop selling it.

[The right name for each letter]

There is no single takedown letter. Each list has its own.

US law has no one "remove me" letter, so use the law's own word. That's what gets a letter to the right desk. "Cease and desist" and "demand letter" are only labels. Neither one is a court order, but a letter can trigger a duty, start a clock or meet a step you must take before suing.

The letterGoes toThe lawThe clock
Do-not-call demand letterThe seller, and the telemarketer if you know it47 C.F.R. § 64.1200(d)(3), (d)(5), (d)(6); 16 C.F.R. § 310.4(b)(1)(iii)(A); 47 U.S.C. § 227(c)(5)The FCC gives them at most 10 business days, and the request lasts 5 years.
Revocation of consentAnyone robocalling or robotexting you on consent you once gave47 C.F.R. § 64.1200(a)(10)-(11), (d)(3); 47 U.S.C. § 227(b)(3)10 business days, unless the caller named an exclusive way.
TCPA demand letterA seller that called a number on the registry47 U.S.C. § 227(c)(5); 47 C.F.R. § 64.1200(c)(2)You set the deadline: this letter gives 30 days.
Cease-communication letterA debt collector15 U.S.C. § 1692c(c); 12 C.F.R. § 1006.6(c); 15 U.S.C. § 1692kIt takes effect when they receive it.
Request to delete and opt outA data broker or any business holding your dataYour state's privacy law, filled in from your state: for California, Cal. Civ. Code §§ 1798.105 and 1798.120Most state laws give them 45 days.
People-search removal demandA people-search or background-check siteYour state's privacy law, filled in from your state; 15 U.S.C. § 1681i if the site sells consumer reportsMost state laws give them 45 days.
FCRA dispute letterA credit bureau or specialty reporting agency15 U.S.C. § 1681i(a)They have 30 days to reinvestigate, sometimes 45.
Mailing-list removalA catalog, flyer or offer mailerYour state's privacy law, where it has oneNo federal deadline for ordinary junk mail.
Daniel's Law noticeAnyone publishing a covered person's home addressN.J.S.A. 56:8-166.1(a), (c)They have 10 business days from receipt.
[Free templates]

Nine letters, ready to fill in or download

Each one names the statute and your civil remedy and nothing else. Open a letter to read every word, fill it in at the top of this page, or download the blank PDF and do it your way.

Do-not-call demand letter

Stop calling me

Puts your number on the company's own do-not-call list and on notice for anyone calling for it.

The FCC gives them at most 10 business days, and the request lasts 5 years.

Read the letter

Re: Do-not-call demand for [Your phone number]

You, or someone calling on your behalf, have called me at [Your phone number].

Do not call or text this number again. This is a do-not-call request under 47 C.F.R. § 64.1200(d)(3) and 16 C.F.R. § 310.4(b)(1)(iii)(A). The FCC's rule requires you to record it and honor it within a reasonable time, not to exceed 10 business days from the date you receive it, and to keep honoring it for five years.

This request covers you, your affiliates and every brand you call for. You have my permission to share it with any telemarketer, lead generator or other vendor that calls for you, so that they can honor it too.

I do not consent to these calls. If you believe I consented at some point, this letter withdraws that consent.

47 U.S.C. § 227(c)(5) lets a person who receives more than one call within 12 months in violation of the do-not-call rules sue for up to $500 per violation, and a court may increase that up to three times for a willful or knowing violation. I am keeping a record of every call, and I reserve all of my civil remedies.

Please confirm in writing, at the address above, that this number has been removed, send me a copy of your written do-not-call policy, and give me the name of any vendor that called for you.

TCPA demand letter

You called a number on the registry

Asks the company to stop, keep its records, and resolve your civil claim before you file one.

You set the deadline: this letter gives 30 days.

Read the letter

Re: Telemarketing calls to [Your phone number]: demand under 47 U.S.C. § 227(c)

You, or someone calling on your behalf, made telemarketing calls to my number, [Your phone number], on [Dates of the calls or texts]. This is my personal number, it has been on the National Do Not Call Registry since [On the Do Not Call Registry since], and I did not invite these calls or give you permission to make them.

I believe these calls violated 47 U.S.C. § 227(c) and 47 C.F.R. § 64.1200(c)(2). Section 227(c)(5) lets a person who receives more than one such call within 12 months sue for up to $500 per violation, and a court may increase that up to three times for a willful or knowing violation.

Within 30 days of receiving this letter, please:

  1. Stop calling this number, and put it on your internal do-not-call list.
  2. Keep your records of these calls, any consent you rely on, where you got my number, and the names of any vendors that called for you.
  3. Write to me about resolving this claim.

If we can't resolve this, I may pursue my civil remedies, including a claim in small claims court. Until then, I reserve all of my civil remedies.

Cease-communication letter

Stop contacting me about this debt

Ends a debt collector's contact with you. It doesn't erase the debt, and they can still sue.

It takes effect when they receive it.

Read the letter

Re: Cease communication about the debt you are collecting

You have contacted me about a debt.

Under 15 U.S.C. § 1692c(c) and 12 C.F.R. § 1006.6(c), I direct you to stop communicating with me about this debt. Once you receive this letter, you may contact me only to say that your collection efforts are ending, or that you or the creditor may invoke, or intend to invoke, a specific remedy.

This letter is not an admission that I owe this debt, and I do not give up any right or defense.

A debt collector that violates the Act is liable under 15 U.S.C. § 1692k for actual damages, additional damages of up to $1,000 in an individual action, and costs and reasonable attorney's fees. I am keeping the delivery record of this letter.

Request to delete and opt out

Delete my data and stop selling it

Uses your state's privacy law, where it has one, to ask a business or data broker to delete your data and stop selling it.

Most state laws give them 45 days.

Read the letter

Re: Request to delete my personal information and opt out of its sale

I make this request under the privacy law of my state, any other law that applies to you, and your own privacy policy.

Please do the following:

  1. Delete the personal information you hold about me.
  2. Stop selling or sharing my personal information, and stop using it for targeted advertising.
  3. Tell your service providers, contractors and anyone you sold it to about this request, where the law requires it.
  4. Tell me in writing what you did, and which exception you rely on for anything you keep.

To find my records, use my name and address above. Use this information only to process this request. If you need anything more to verify me, tell me exactly what and why.

FCRA dispute letter

This report is wrong

Disputes wrong or unverifiable information with a credit bureau or specialty reporting agency. Send it to the bureau, not only to the lender.

They have 30 days to reinvestigate, sometimes 45.

Read the letter

Re: Dispute of information in my consumer file

I dispute the following information in my consumer file: [What is wrong on the report].

Under 15 U.S.C. § 1681i(a), please reinvestigate this free of charge and finish within 30 days of receiving this letter. Delete or correct whatever is inaccurate, incomplete or can't be verified, and send me the written results.

I have left my Social Security number out of this letter. If you need more to find my file, tell me what you need.

Mailing-list removal

Take me off your mailing list

Asks a mailer to stop mailing you and stop renting your address to others.

No federal deadline for ordinary junk mail.

Read the letter

Re: Remove me from your mailing lists

Remove my name and the address above from every mailing list you keep or use. Stop mailing me, and stop renting, selling or sharing my name and address.

Please confirm in writing, at the address above, when this is done.

Daniel's Law notice

Stop publishing my home address

For New Jersey judicial officers, law enforcement officers, prosecutors, child protective investigators and their household family: written notice to stop disclosing a home address or unpublished home phone. The law is under a First Amendment challenge.

They have 10 business days from receipt.

Read the letter

Re: Written notice under N.J.S.A. 56:8-166.1 (Daniel's Law)

I am a covered person under New Jersey's Daniel's Law: [Your covered role].

This is my written notice under N.J.S.A. 56:8-166.1 that you must not disclose or re-disclose, on the internet or otherwise make available, the following protected information: [What must come down].

The statute bars disclosure starting 10 business days after you receive this notice. It provides a civil action in which a court awards actual damages of not less than $1,000 for each violation.

Please confirm in writing, at the address above, when this is done.

mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk. Full disclaimer

[If they ignore it]

What they face: civil liability and regulators, not criminal charges

These are claims a court or an agency decides, and they're not automatic payments. Here is what each law actually puts on the table, and who collects it.

The lawWhat it allowsWho collectsTime limit or catch
Robocalls to a cell47 U.S.C. § 227(b)(3)A suit for an injunction and actual loss or $500 per violation, whichever is greater. A court may raise that up to three times if willful or knowing.YouFour years, as applied by the Second Circuit under 28 U.S.C. § 1658(a). State claims differ.
Do-not-call rules47 U.S.C. § 227(c)(5)A suit for an injunction and actual loss or up to $500 per violation, once you've had more than one call within 12 months from the same entity. Up to three times if willful or knowing.YouA company has a defense if it kept reasonable procedures with due care. Courts split on § 64.1200(d) claims and on texts.
Telemarketing Sales Rule16 C.F.R. § 1.98(d); 15 U.S.C. § 6104Civil penalties up to $53,088 per violation, unchanged in 2026 because that year's adjustment was cancelled.The FTC, not you, unless a pattern of violations cost you over $50,000A private suit needs written notice to the FTC and must be filed within three years of discovery.
FCC penalties47 U.S.C. § 227(b)(4), (e)Agency forfeitures for robocalls, up to $10,000 more for intentional violations, and up to $10,000 per violation for spoofing caller ID with intent to defraud.The United StatesNo private suit for spoofing.
Debt collectors15 U.S.C. § 1692kActual damages, additional damages up to $1,000 per action, not per violation, plus costs and reasonable attorney's fees.YouOne year from the violation, not from when you found out (Rotkiske v. Klemm, 2019).
Credit reports15 U.S.C. §§ 1681n, 1681o, 1681pWillful: actual damages or $100 to $1,000, plus punitive damages and fees. Negligent: actual damages and fees.YouThe earlier of two years from discovery or five from the violation. You need concrete harm (TransUnion, 2021).
California privacyCal. Civ. Code §§ 1798.155, 1798.199.90, 1798.150Fines and civil penalties up to $2,663 per violation, $7,988 if intentional or involving a minor under 16. Breach suits of $107 to $799 per consumer per incident.The state. You only for a data breachAn ignored delete request doesn't support a private suit. Amounts adjust in January 2027.
California Delete ActCal. Civ. Code §§ 1798.99.82, 1798.99.89$200 per day for failing to register, and $200 per deletion request per day for failing to delete, plus costs.CalPrivacyAdministrative actions must start within five years.
Other state privacy lawsSee the state tableCivil penalties, most often up to $7,500 per violation, $20,000 in Colorado, and up to $50,000 for the very large companies Florida's law reaches.The stateNo private suit, and a cure period in some states.
Daniel's LawN.J.S.A. 56:8-166.1(c)Actual damages of not less than $1,000 per violation, and punitive damages for willful or reckless disregard. New Jersey's Supreme Court held on August 12, 2026 that actual-damages liability needs no mental state.The covered person or their assigneeIts constitutionality is pending in the Third Circuit, No. 25-1555, as of our last check.

Don't threaten criminal charges

In California, getting property through a threat to accuse someone of a crime or expose a secret can be extortion, and so can sending a letter with that threat. The California Supreme Court held one lawyer's demand letter was extortion as a matter of law, and a threat to report can be legal alone and illegal when joined to a demand for money. So keep a request for money and a mention of any complaint apart, and leave out police, prosecutors and publicity. Our templates do. No court calls that a safe harbor, but it stays clear of the line.

Cal. Penal Code §§ 518, 519, 523; Flatley v. Mauro, 39 Cal.4th 299 (2006)

Why a violation doesn't always mean a lawsuit

Federal courts need concrete harm, not just a broken rule. In TransUnion, 6,332 class members whose wrong credit files never went to anyone had no standing, and Spokeo v. Robins, a people-search case, set up that test. Narrow criminal provisions do exist, such as obtaining a credit report under false pretenses, spoofing caller ID to defraud, and New Jersey's reckless posting after notice. We found none that makes an ignored removal letter generally a crime.

TransUnion v. Ramirez (U.S. 2021); Spokeo v. Robins (U.S. 2016); 15 U.S.C. § 1681q; 47 U.S.C. § 227(e); N.J.S.A. 2C:20-31.1
[Call lists]

Getting your number off a call list

The National Do Not Call Registry is the free first step. It leaves gaps, and the company's own do-not-call list is where a letter fills them.

Start with the free registry

Register at DoNotCall.gov or 1-888-382-1222 from the phone itself. Personal numbers only, no business lines. Entries don't expire, and sales calls can continue for up to 31 days while callers refresh their lists.

47 C.F.R. § 64.1200(c)(2); 16 C.F.R. § 310.4(b)(3)(iv)

What the registry doesn't stop

Political, charity, debt collection, informational and survey calls with no sales pitch. Companies you recently did business with (a purchase within 18 months, an inquiry within 3) or gave written permission, until you tell them to stop. That sentence is what your letter is for.

47 C.F.R. § 64.1200(f)(5), (f)(15); 16 C.F.R. § 310.4(b)(1)(iii)(B)

The company's own list

Anyone telemarketing must have a written do-not-call policy available on demand, train staff on it, record your request when made and honor it within 10 business days of receiving it, for 5 years. A seller's request ends an established business relationship. The FTC's rule makes it abusive to call after you've said no, but sets no day count of its own.

47 C.F.R. § 64.1200(d)(1)-(3), (d)(6), (f)(5)(i); 16 C.F.R. § 310.4(b)(1)(iii)(A)

Write to the seller and the caller

A request covers the entity making the call or the one it is made for. If a vendor keeps the list, the company the calls are for is still liable for failing to honor it. Name your affiliates and brands in the letter: a request reaches affiliates only if you'd reasonably expect them included, unless you ask for more.

47 C.F.R. § 64.1200(d)(3), (d)(5); In re Dish Network, FCC 13-54 (2013); Campbell-Ewald v. Gomez (2016)

New on November 25, 2026: how you revoke consent to robocalls and robotexts

The FCC rewrote this rule in October 2026, and most guides don't reflect it yet. If you once agreed to messages, this is the rule that decides whether your letter counts.

Today, until November 24, 2026You can revoke consent to robocalls and robotexts by any reasonable method, a caller can't name an exclusive one, and it must honor your request within 10 business days.47 C.F.R. § 64.1200(a)(10), current text
From November 25, 2026, if the caller names a methodA caller may make an automated opt-out, a reply text with standard words, or its own website or phone number the exclusive way to revoke, if it discloses that clearly on the call or text. It need not process anything else. So reply STOP as well as mailing a letter, and watch for the disclosure.FCC 26-67, App. A; 91 Fed. Reg. 67214 (Oct. 26, 2026); new § 64.1200(a)(10)
From November 25, 2026, if it names noneAny reasonable means still works, within 10 business days. Once you produce evidence of your request, revocation is presumed unless the caller rebuts it. A dated, delivered letter is that evidence.New 47 C.F.R. § 64.1200(a)(11)
Either wayThe new order doesn't amend the company do-not-call rule at § 64.1200(d). That's why our revocation letter is also a company do-not-call request. The order never mentions mail, and how the two rules fit together is untested. The FCC is also asking about a shorter deadline and a revoke-all method.FCC 26-67, App. A and ¶¶ 30, 37-38

How your number got there

Call lists and data lists are the same list at different stages. A number typed into a web form goes to a lead seller and on to a telemarketer the same day. The same number, bought from an app or copied from a public record, sits with a data broker, which sells it on to people-search sites and marketing lists. That's why this page covers both. Removing one copy leaves the others, and a caller's answer to "where did you get my number?" is worth asking for in writing.

What the courts have done lately

Texts and the do-not-call suit

The Seventh Circuit held in July 2026 that § 227(c)(5) doesn't let people sue over unwanted texts. It binds federal courts in Illinois, Indiana and Wisconsin, it leaves agency enforcement alone, and it did not decide state claims. Elsewhere, district courts are divided: E.D. Pa. says a text is a call, N.D. Ga. says it isn't.

Steidinger v. Blackstone Medical Services, No. 25-2398 (7th Cir. 2026); Pero v. Brown-Daub Chevrolet (E.D. Pa. 2026); Radvansky v. Kendo Holdings (N.D. Ga. 2026)

Texts and robocalls

The Ninth Circuit held in January 2026 that a text is a call under § 227(b), a different subsection, though that plaintiff lost because they had to press play on the prerecorded video.

Howard v. Republican National Committee, 164 F.4th 1119 (9th Cir. 2026)

What counts as an autodialer

A device must use a random or sequential number generator to store or produce numbers. Many targeted calls and texts fall outside § 227(b) for that reason, though a prerecorded or artificial voice is still covered.

Facebook, Inc. v. Duguid (U.S. 2021)

The FCC is not the last word

Courts in private suits decide what the TCPA means for themselves and aren't bound by the FCC's reading, so any FCC rule quoted here can be rejected by a court. The Fifth Circuit has done so on oral consent.

McLaughlin Chiropractic v. McKesson (U.S. 2025); Bradford v. Sovereign Pest Control (5th Cir. 2026)

Lead sellers

The Eleventh Circuit vacated the FCC's one-to-one consent rule, so a single web form can still name many sellers. Send your letter to the seller and, if you can find it, to the lead source.

Insurance Marketing Coalition v. FCC (11th Cir. 2025)

Who can sue, and where

Federal and state courts both hear private TCPA suits. The four-year federal catch-all limit has been applied to the TCPA. A separate private suit under the FTC's rule needs a pattern of violations and more than $50,000 in actual damages per person.

Mims v. Arrow Financial (U.S. 2012); 28 U.S.C. § 1658(a); Giovanniello v. ALM Media (2d Cir. 2013); 15 U.S.C. § 6104

State telemarketing laws

Many states add their own rule or their own claim. Some cover texts where federal courts won't, and two make a reply of STOP the step that counts. Read your state's statute before relying on it.

StateThe ruleWhat it allows
FloridaFla. Stat. § 501.059No sales calls or texts after an opt-out or to its no-sales list. Before suing over sales texts, reply STOP to the number that texted; the sender has 15 days. A mailed letter doesn't meet that step.Actual damages or $500, whichever is greater; up to three times if willful or knowing.
GeorgiaO.C.G.A. § 46-5-27More than one violating voice solicitation in 12 months. You can name the caller, the party it called for, or both. Two-year limit.Fees, plus actual loss or up to $1,000 per violation.
MarylandMd. Code, Com. Law §§ 14-4502, 14-4503No solicitations from 8 p.m. to 8 a.m., no more than three in 24 hours on one subject, and no automated ones without prior express written consent.Up to $500 or actual damages; up to three times.
Oklahoma15 O.S. §§ 775C.4, 775C.6No commercial solicitation calls before 8 a.m. or after 8 p.m., and no more than three in 24 hours on one subject. Broad exemptions apply.Actual damages or $500; up to three times if willful or knowing.
TexasTex. Bus. & Com. Code chs. 302, 304, 305Since Sept 1, 2025, a telephone solicitation includes texts and images, and a Chapter 304 violation is actionable as a deceptive trade practice.$500 or actual damages, up to $1,500 or treble if knowing or intentional (§ 305.053). Chapter 302 sets civil penalties up to $5,000 per violation.
VirginiaVa. Code §§ 59.1-514, 59.1-515Honor a no-solicitation request for at least 10 years. Since Jan 1, 2026, a text opt-out is made by replying UNSUBSCRIBE or STOP.$500 for a first violation, $1,000 for a second, $5,000 for each later one; up to $5,000 for a willful first or second.
WashingtonRCW 80.36.390; RCW 19.190.060Stop for at least one year on request; no calls before 8 a.m. or after 8 p.m. Commercial texts need clear prior consent.At least $1,000 per violation for repeated solicitation calls, plus fees. For text suits filed since June 11, 2026, $100 or actual damages.
CaliforniaCal. Bus. & Prof. Code §§ 17592, 17593Uses the national registry. A recipient can seek a small claims injunction first.Up to $1,000 for violations within 30 days after serving the injunction.
ConnecticutConn. Gen. Stat. § 42-288aCovers calls and texts: 9 a.m. to 8 p.m., identify within 10 seconds, prior express written consent.Unfair trade practice; state fines up to $20,000 each. Private suits run through CUTPA.
New YorkN.Y. Gen. Bus. Law § 399-zCovers calls and texts: 8 a.m. to 9 p.m., and telemarketers must offer and honor addition to the seller's do-not-call list.State fines up to $20,000 per violation. This section creates no damages suit.
ArizonaA.R.S. § 44-1282No outbound solicitation calls or texts to registered numbers, with exceptions.Consumer Fraud Act violation; Attorney General penalties capped at $1,000 per violation.
IndianaInd. Code ch. 24-4.7; ch. 24-5-14Its own do-not-call law, with autodialers regulated separately.Attorney General enforcement.
[Debt collectors]

The one federal stop-calling right built around a letter

Debt collection calls are exempt from the Do Not Call Registry. What stops them is a written notice, and by mail it takes effect the day it arrives, which is what a delivery record shows.

The stop notice

If you tell a debt collector in writing to stop, or that you refuse to pay, it must generally stop. It can still tell you it's ending its efforts, or that it or the creditor may or will use a specific remedy. It doesn't erase the debt, and a suit can still follow.

15 U.S.C. § 1692c(c); 12 C.F.R. § 1006.6(c)

It counts when it arrives

A mailed notice is complete on receipt. The CFPB's own example: mailed August 3, received August 6, and an email sent on August 4 breaks no rule. Regulation F also accepts an electronic notice sent through a channel the collector takes messages on.

12 C.F.R. pt. 1006, Supp. I, cmt. 6(c)(1)-1

Who counts

A business whose main purpose is collecting debts, or that regularly collects debts owed to someone else. A creditor's own employees collecting in its own name don't. A company collecting debts it bought may not fit the second test, though it can still be a collector if collecting is its main business.

15 U.S.C. § 1692a(6); Henson v. Santander (U.S. 2017)

Just one channel

You can stop calls without ending all contact: tell the collector to stop using a phone number or another medium. Every collector email or text must explain a simple way to opt out, and it can't charge you to do it.

12 C.F.R. §§ 1006.14(h), 1006.6(e)

How many calls is too many

A collector is presumed to violate the harassment ban if it calls more than seven times in seven days about a debt, or within seven days after a phone conversation about it. That's a presumption and not a cap.

12 C.F.R. § 1006.14(b)(2)

Disputing the debt itself

Dispute in writing within 30 days of the validation notice, and the collector must stop collecting that debt until it sends verification. That's a different letter from a stop notice, and you can send both. California's Rosenthal Act adds its own remedies, up to $1,000 for willful and knowing violations.

15 U.S.C. § 1692g(b); 12 C.F.R. § 1006.38(d); Cal. Civ. Code § 1788.30
[Data brokers]

Getting your data off a broker's list

A data broker sells information about people it has no direct relationship with. Federal law mostly leaves them alone, so this is a state fight, and California is the furthest along.

No federal right to delete

No single federal law governs company data privacy, and we found no federal data broker deletion law enacted as of today. The CFPB withdrew its proposal to treat data brokers as consumer reporting agencies in May 2025. Two bills are pending. The rights that exist come from states, and from the FCRA where a company sells consumer reports.

CRS R48667; 90 Fed. Reg. 20568 (May 15, 2025); H.R. 8413, H.R. 2612

California's DROP comes first

California residents can send one free deletion request to every registered broker at privacy.ca.gov/drop. Since August 1, 2026, brokers must check it at least every 45 days, delete within 45 days of receipt, and delete again every 45 days. A broker that doesn't owes $200 per request per day. CalPrivacy reported over 550,000 sign-ups and over 650 registered brokers in October 2026. You can submit for a child or an elderly relative too.

Cal. Civ. Code §§ 1798.99.82, 1798.99.86; CalPrivacy DROP FAQ, Oct. 6, 2026

What DROP and a letter can't reach

DROP reaches registered brokers, not the companies you deal with directly, and activity covered by the FCRA or GLBA, and public records, can stay. Under the CCPA, the right to delete reaches data collected from you, which often leaves out what a broker bought from someone else. The right to stop its sale is the one that bites there.

Cal. Civ. Code §§ 1798.99.80, 1798.105(a), 1798.140(v)(2), 1798.145(d)-(f); 11 C.C.R. § 7001

If you mail a California request

A letter doesn't force processing. Under the 2026 regulations, a delete, correct or know request sent by a method the business didn't designate must be either treated as properly submitted or answered with how to submit it. It can't just vanish, and your delivery record shows when the clock could have started. Use the designated method first.

11 C.C.R. § 7020(b), (f), effective Jan. 1, 2026

California's deadlines and fines

Confirm a delete request in 10 business days, respond in 45 calendar days, extendable to 90 with notice. Honor an opt-out as soon as feasible and within 15 business days, with no identity check and no driver's license demand. Fines run up to $2,663 per violation, or $7,988 if intentional, and only the state collects them: the one private suit is for data breaches.

11 C.C.R. §§ 7021, 7026(d), (f)(1), 7060(b); Cal. Civ. Code §§ 1798.150, 1798.155, 1798.199.90

Regulators are collecting

CalPrivacy announced 2026 penalties for failing to register: Datamasters $45,000, S&P Global $62,600, LocateSmarter $116,490, Cybba $52,400 and SalesIntel $36,400. LocateSmarter also demanded partial Social Security numbers for opt-outs. We found none yet for missed DROP deletions.

CalPrivacy releases, Jan. 8, Aug. 11, Aug. 13 and Sept. 1, 2026

Where to find a broker's address

Four states keep public registries, each with contact or opt-out details. A registration is a phone book and gives you no deletion right of its own. New Jersey's registry is due about March 27, 2027, and Connecticut's law requires registration from January 1, 2027, with a state deletion mechanism by July 1, 2028.

People-search sites

  • Try the site's free opt-out first. It's usually faster, and the letter is for when that form fails or the listing comes back.
  • A registered broker in California should be reached by DROP. A site that isn't registered is worth reporting to CalPrivacy.
  • Public records are mostly outside state privacy laws, which is the reason sites give for refusing. The sale of your profile can still be opted out of, and the FCRA is the other lever.
  • A site that sells reports for jobs, housing, credit or insurance can be a consumer reporting agency whatever its disclaimer says. The FTC settled on that theory with Spokeo in 2012 ($800,000), Instant Checkmate in 2014 ($525,000) and TruthFinder and Instant Checkmate in 2023 ($5.8 million). Those are settlements, not rulings, and they don't make every such site one.
  • Don't send an ID to get an ID off the internet. Give what they need to find you, and ask them to use it only for this request.

Your state's privacy law

20 states have a comprehensive privacy law in force today, counting Florida's narrow one, and 4 more are enacted and waiting: Alabama, Louisiana, Oklahoma, Vermont. In all of them the attorney general or a state agency enforces it, so an ignored request becomes a complaint and not a lawsuit. Where a cure period survives, the company gets time to fix a violation first. The letter fills in your state's law from the state you enter, and a state with no law gets an honest request with no law claimed.

State and lawTook effectDeadlineEnforced byMost per violationCure periodOpt-out signal
CaliforniaCal. Civ. Code § 1798.100 et seq.; 11 C.C.R. § 7000 et seq.Jan 1, 202045 days, plus 45AG and CalPrivacy$2,663; $7,988 if intentionalNo mandatory cureRequired
ColoradoC.R.S. § 6-1-1301 et seq.Jul 1, 202345 daysAG and district attorneysUp to $20,000Repealed Jan 1, 2025Required since Jul 1, 2024
ConnecticutConn. Gen. Stat. §§ 42-515 to 42-526Jul 1, 202345 daysAGUp to $5,000 per wilful violationDiscretionary since Jan 1, 2025Required since Jan 1, 2025
Delaware6 Del. C. ch. 12DJan 1, 202545 daysDepartment of JusticeUp to $10,000 per wilful violationDiscretionary since Jan 1, 2026Required since Jan 1, 2026
FloridaFla. Stat. § 501.72Jul 1, 202445 daysDepartment of Legal AffairsUp to $50,000, tripled in some cases such as ignored deletion requestsDiscretionary 45 daysReaches very large companies only
IndianaInd. Code art. 24-15Jan 1, 202645 daysAGUp to $7,50030 days, still appliesNot required
IowaIowa Code ch. 715DJan 1, 202590 daysAGUp to $7,50090 days, still appliesNot required
KentuckyKy. Rev. Stat. §§ 367.3611 to 367.3629Jan 1, 202645 daysAGUp to $7,500 for continued violations30 days, still appliesNot required
MarylandMd. Code, Com. Law §§ 14-4701 to 14-4714Oct 1, 2025; reaches processing from Apr 1, 202645 daysAG's consumer divisionUp to $10,000Discretionary 60 days, through Apr 1, 2027A link or a signal
MinnesotaMinn. Stat. §§ 325M.10 to 325M.21Jul 31, 202545 daysAGUp to $7,500Ended Jan 31, 2026Required
MontanaMont. Code Ann. § 30-14-2801 et seq.Oct 1, 202445 daysAGUp to $7,500Removed Oct 1, 2025Required since Jan 1, 2025
NebraskaNeb. Rev. Stat. §§ 87-1101 to 87-1130Jan 1, 202545 daysAGUp to $7,50030 days, still appliesOpt-outs by agent technology
New HampshireN.H. RSA ch. 507-HJan 1, 202545 daysAGUp to $10,000Discretionary since Jan 1, 2026Required since Jan 1, 2025
New JerseyN.J.S.A. 56:8-166.4 et seq.Jan 15, 202545 daysAGConsumer Fraud Act penaltiesEnded about Jul 1, 2026Required from about Jul 15, 2025
OregonORS 646A.570 to 646A.589Jul 1, 202445 daysAGUp to $7,500Ended Jan 1, 2026Required since Jan 1, 2026
Rhode IslandR.I. Gen. Laws ch. 6-48.1Jan 1, 202645 days, as reportedAG$100 to $500 per intentional wrongful disclosure; up to $10,000 under its deceptive practices actNoneNot required, as reported
TennesseeTenn. Code Ann. § 47-18-3301 et seq.Jul 1, 202545 daysAGUp to $7,500, trebled if willful60 days, as reportedNot required, as reported
TexasTex. Bus. & Com. Code ch. 541Jul 1, 202445 daysAGUp to $7,50030 days, still appliesOpt-outs by agent technology since Jan 1, 2025
UtahUtah Code ch. 13-61Dec 31, 202345 days, plus 45AGUp to $7,500, plus actual damages30 days, still appliesNot required
VirginiaVa. Code §§ 59.1-575 to 59.1-584Jan 1, 202345 daysAGUp to $7,50030 days, still appliesNot required
AlabamaAla. HB 351 (2026)Starts May 1, 202745 daysAGUp to $15,000, only after a failure to cure45 daysUnsettled
LouisianaLa. Act 502 (2026)Starts Jan 1, 202745 daysAGUnfair trade practices penalties30 days, through Jul 31, 2027Opt-outs by agent technology
OklahomaOkla. SB 546 (2026)Starts Jan 1, 202745 daysAGUp to $7,50030 daysNot required
VermontVt. Act 145 (2026)Starts Jan 1, 202845 daysAGUp to $10,000 per act60 days, through Jun 30, 2029Required

None of these laws gives you a private suit for an ignored request, apart from California's breach claim. Some entries rest on secondary trackers, and Delaware, Connecticut and others changed this year, so read the statute. Checked 31 October 2026.

[Credit reports]

Credit bureaus and specialty reports: the FCRA

If a company sells reports used for credit, insurance, jobs or housing, the Fair Credit Reporting Act applies, and here the deadlines are federal.

Dispute with the bureau

A consumer reporting agency must finish a free reinvestigation within 30 days of receiving your dispute, extendable up to 15 days if you send more in that time. After the bureau passes it on, the furnisher must investigate and fix or block what it can't verify. Send it to the bureau as well as the lender: a dispute sent only to the lender doesn't support a private suit.

15 U.S.C. §§ 1681i(a)(1), 1681s-2(a)(8), (b), (c)

Age limits

Reports generally can't include collections and other adverse items older than seven years, or bankruptcies older than ten. Exceptions cover credit or life insurance of $150,000 or more and jobs paying $75,000 or more. Convictions aren't limited.

15 U.S.C. § 1681c(a)-(b)

Freezes and fraud alerts

Security freezes are free: within 1 business day of a phone or online request, 3 of a mailed one. A fraud alert lasts at least a year, seven years for identity theft victims with a report. Information from identity theft is blocked within 4 business days of the right papers. A freeze limits access; it deletes nothing.

15 U.S.C. §§ 1681c-1, 1681c-2(a)

Pre-approved offers

Opt out of prescreened credit and insurance lists at optoutprescreen.com or 1-888-5-OPT-OUT for five years. For the permanent opt-out, start there and return the signed election form they issue: a letter you wrote yourself isn't the named method.

15 U.S.C. § 1681b(e)
[Every other list]

Email, junk mail, DMV records, health data and the rest

Each of these has its own rule, and some are narrower than people think. The last column says what a letter can do.

The listYour rightWhere a letter fits
Marketing email15 U.S.C. §§ 7704(a)(3)-(4), 7706Every commercial email needs a working opt-out for at least 30 days. The sender must stop within 10 business days and can't sell your address. The FTC, states and internet providers enforce it, and the law doesn't list individual recipients among those who may sue.Rarely needed. The unsubscribe link is the named route.
Junk postal mailDMAchoice FAQ (private program)No general federal right. DMAchoice, an industry program, costs $8 online or $9 by mail for 10 years and takes up to 90 days. It leaves out current customers, political mail and prescreened offers.A mailing-list removal letter asks a sender directly. It's a request, and the template says so.
Sexually oriented ads39 U.S.C. §§ 3008, 3010; DMM 508.9-10A USPS Prohibitory Order, on PS Form 1500 at any Post Office with the ad and its envelope. It takes effect on the 30th day after the sender receives it. It isn't a general junk mail remedy, though some sites say so.Not this. File with USPS, which is also adding an electronic form.
Pre-approved credit offers15 U.S.C. § 1681b(e)Five years at optoutprescreen.com or 1-888-5-OPT-OUT. Permanent with the signed form they issue, which lasts until you cancel it.Use their form. Your own letter isn't the named method.
DMV records18 U.S.C. §§ 2721, 2724State DMVs can't release your record except for listed uses, and bulk marketing needs your consent. A knowing misuse allows a suit with liquidated damages of at least $2,500. It's not a deletion right.Evidence for a claim, not a way to remove anything.
Children's data15 U.S.C. § 6502; 16 C.F.R. § 312.6A parent can refuse further use and direct deletion of data from a child under 13, on child-directed sites or where the operator knows. The amended rule's compliance date was April 22, 2026.A parent's written request works, and the operator must verify you're the parent.
Banks and insurers15 U.S.C. § 6802You can opt out of sharing with non-affiliates. It doesn't let you delete bank records, and many kinds of sharing are outside it.Use the opt-out in their privacy notice.
Health records45 C.F.R. §§ 164.522, 164.526HIPAA gives amendment, not deletion: a response in 60 days, plus one 30-day extension. You can ask for limits, though the provider usually needn't agree unless you paid in full.A written amendment request to the provider or plan.
Health data in apps (Washington)RCW 19.373.040, .090My Health My Data lets you delete consumer health data within 45 days, plus a 45-day extension, with a route to suit through the Consumer Protection Act.A written deletion request, with a date to point to.
Biometrics (Illinois)740 ILCS 14/20; P.A. 103-769A private suit with $1,000 per negligent or $5,000 per reckless or intentional violation. Repeated collection by one method now counts once (Clay v. Union Pacific, 7th Cir. 2026).Evidence and a request, ahead of a claim.
Sale of your data (Nevada)NRS 603A.345, 603A.360Website operators must offer a designated address for requests not to sell, and respond within 60 days, plus 30. Only the attorney general enforces it, up to $5,000 per violation.Send it to the designated address they name.
Intimate imagesTAKE IT DOWN Act, Pub. L. 119-12, § 3Covered platforms must remove nonconsensual intimate images within 48 hours of a valid request, signed physically or electronically. The FTC has enforced this since May 19, 2026, at up to $53,088 per violation, and takes complaints at TakeItDown.ftc.gov.Use the platform's own request channel: it's the fastest valid route.
Federal judgesDaniel Anderl Act, Pub. L. 117-263, § 5934A person or business that gets a written request must remove a covered judge's information from the internet within 72 hours, and data brokers can't sell it. News and voluntarily published information are excepted.A written request is the trigger, so a delivery record marks the start.
California public officialsCal. Gov. Code §§ 7928.205, 7928.215A business that gets an official's written demand must take down a home address or phone within 48 hours. An elected official's demand lasts four years. Confirm the current text before relying on it.A written demand is the trigger.
Foreign adversaries15 U.S.C. § 9901Data brokers can't sell Americans' sensitive data to foreign adversary countries or entities they control. The FTC enforces it, and it gives you no removal right.None. It's a complaint for the FTC.
[When to use paper]

Certified Mail isn't always the first step. Here is when it earns its price.

We'd rather you use the free route when it works. A letter is for when it doesn't, and for the times the law asks for writing.

The routeUse it whenThe catch
National Do Not Call RegistryDo this first, for free. It stops most sales calls within about 31 days and never expires.Exempts debt collectors, charities, politics and recent customers.
Reply STOPDo this for any text. Florida requires it before you can sue over sales texts, and Virginia names it as the text opt-out.From November 25, 2026, it may be the caller's only accepted method.
The company's privacy formThe designated method under most privacy laws, so it starts the clock cleanly. Screenshot it.You have only a screenshot, and forms break, loop and ask for your ID.
California DROPOne free request to every registered broker, if you live in California.Registered brokers only, and status updates can take up to 90 days.
Certified letterWhen the free route failed or doesn't exist, when the law says written, when you want a dated record before a complaint or a claim, or when a collector needs written notice.Costs money, takes days, and doesn't force a business to process it where it named another method.

Where the law itself asks for writing

In these, the letter isn't just evidence. It's the step that starts something, and in California's case the statute names certified or registered mail.

Debt collectors

A written stop notice. By mail, it's complete on receipt, so the delivery date is the date that counts. A collector's message sent while your letter is in the mail doesn't break the rule.

15 U.S.C. § 1692c(c); 12 C.F.R. pt. 1006, Supp. I, cmt. 6(c)(1)-1

California consumer claims (CLRA)

30 days' written notice before suing for damages, by certified or registered mail, return receipt requested, to the place of the transaction or the California principal place of business.

Cal. Civ. Code § 1782(a)

Massachusetts (Chapter 93A)

A written demand mailed or delivered at least 30 days before filing. A reasonable written offer in those 30 days can cap what you recover.

Mass. G.L. c. 93A, § 9(3)

Texas (DTPA)

Written notice at least 60 days before a damages suit, describing the complaint and what you seek.

Tex. Bus. & Com. Code § 17.505

Georgia (FBPA)

A written demand delivered at least 30 days before suit, with the same tender rule.

O.C.G.A. § 10-1-399(b)

Maine (UTPA)

A written demand mailed or delivered to the last known address at least 30 days before a damages action.

5 M.R.S. § 213(1-A)

New Jersey (Daniel's Law)

Written notice from an authorized person starts the 10 business days. Covered persons only, and the law is under a First Amendment challenge.

N.J.S.A. 56:8-166.1(a)

California small claims

The form says to ask for payment before you sue, in person, by phone or in writing. A letter gives you the record.

Judicial Council form SC-100, item 4
[The clock]

The deadline runs from the day they receive it

Every clock here starts on receipt, not on the day you sent it. That's the reason to want a delivery record, and the reason to wire it to a webhook.

On receiptA debt collector's stop notice15 U.S.C. § 1692c(c)
10 business daysCompany do-not-call request; revocation of consent; Daniel's Law notice; a CAN-SPAM opt-out47 C.F.R. § 64.1200(a), (d)(3); N.J.S.A. 56:8-166.1; 15 U.S.C. § 7704(a)(4)
15 business daysCalifornia opt-out of sale or sharing, at the outside11 C.C.R. § 7026(f)(1)
30 daysCredit report reinvestigation, sometimes 45; a debt validation dispute must be sent within 30 days of the notice15 U.S.C. §§ 1681i(a)(1), 1692g(b)
45 daysDeletion under most state privacy laws, and each DROP cycleSee the state table; Cal. Civ. Code § 1798.99.86
60 daysA health record amendment under HIPAA; Nevada's sale opt-out45 C.F.R. § 164.526; NRS 603A.345
90 daysCalifornia and Utah when extended; Iowa's own deadline11 C.C.R. § 7021(b); Iowa Code ch. 715D
[Tracking and photos]

A green card proves an envelope arrived. It doesn't prove what was in it.

USPS records cover the outside of the envelope. Staff at our facility in Manhattan Beach, CA photograph the inside: the pages, and the envelope they went into.

The recordWhat it showsIts limit
USPS mailing receiptA piece with this number was mailed on this date.Not that it arrived, or what was in it.
USPS delivery recordDelivery or attempted delivery, with the recipient's signature on file. Direct evidence of who received it and when.USPS lists Certified records as kept for two years, so download yours early.
Electronic return receiptWho received it, when, and the actual delivery address.Also kept two years. Retrieval takes longer after 60 days.
Our photos of the pages and the sealed envelopeWhat was printed, and the envelope and label it went into. No USPS record covers this.We keep only blurred previews, so save the photos when they arrive.
The mailbox ruleA properly addressed letter is presumed to have arrived. In the Third Circuit, certified mail supports a stronger presumption than regular mail, and a sworn denial alone can defeat the regular-mail one.A presumption, not a record, and courts differ. Hagner v. United States (1932); Lupyan v. Corinthian Colleges (3d Cir. 2014).

What you get, step by step

01Before it printsA dry run gives the exact price and a preview. With approval on, nothing prints until you say so.
02Printed and sealedStaff photograph the printed pages and the sealed envelope with its label. mail.ready fires, and GET /v1/mail/:id returns the photos.
03MatchedA photo of each prepared letter must match the order's own first page and postage label before it can be marked ready, so your letter can't leave under another order's label.
04Handed overThe mailing date, the certified number and a photo of the receipt. mail.mailed fires.
05DeliveredThe USPS delivery scan, and the return receipt's record of who signed. mail.delivered fires, and your clock starts.
06Kept privateYour file is encrypted at rest and deleted once the piece is mailed, so keep your own copy.
[What goes in one]

The seven parts of a clear letter

  1. 1Your name and return address. Use a mailing address you're happy for them to hold. A mailbox.bot address ($15/mo) keeps your home address off the envelope, and replies reach your agent as scanned mail.
  2. 2The date. It should match the day it goes out. Your delivery record does the real work.
  3. 3How it was sent. "Via USPS Certified Mail, Return Receipt Requested" tells a mailroom this one is being tracked.
  4. 4The right desk. The privacy or compliance contact in their privacy policy, then the contact in a state broker registry. A registered agent, listed by the Secretary of State, accepts court papers and is a fallback, not a privacy channel.
  5. 5A subject line that names the law. It helps get the letter routed. "Do-not-call request under 47 C.F.R. § 64.1200(d)(3)" means something to a compliance desk. "Stop calling me" doesn't.
  6. 6The facts, the request and the date. Which number, which calls, what you want done and by when. Identifiers only as needed. Ask for written confirmation, and ask for the do-not-call policy, which they must provide on demand.
  7. 7Your signature. A typed name prints as is. To sign by hand, sign and scan the page, then upload the PDF. It goes out in your name, and you can read every word first.

What to leave out

  • Any threat of police, prosecution, jail, exposure or publicity. Stick to the statute and your civil remedies.
  • A demand for money next to a mention of reporting them to an agency. Keep complaints and money apart.
  • Your Social Security number, a photo of your ID, or anything else the request doesn't need.
  • Claims you can't back up, such as a date you never registered or calls you didn't log.
[When the deadline passes]

The day after the clock runs out

Your record makes the next step easy to show. Send a second letter if there's a reason to think the first was misrouted, then file. A complaint is free, and regulators read patterns, even when they can't act on yours alone.

FCC Consumer Complaint Center ↗

Unwanted calls and texts. The FCC doesn't resolve individual complaints: it uses them for policy and enforcement.

FTC: DoNotCall.gov and ReportFraud ↗

Report sales calls to registered numbers at DoNotCall.gov, and scams or money lost at ReportFraud.ftc.gov.

CFPB ↗

Debt collection, credit reports and other financial products. It sends your complaint to the company, which generally responds in 15 days.

CalPrivacy ↗

CCPA and Delete Act complaints from Californians. It doesn't represent you individually.

Your state attorney general ↗

The one who enforces your state's privacy law in nearly every state. The NAAG directory lists them all.

Small claims or a lawyer

A court decides what a violation is worth. These laws don't require a lawyer to send a notice, but a lawyer can advise on your facts and on suing.

[For agents]

Let your agent watch the list and keep the clock

Every step in this page has a machine shape. Connect Claude, ChatGPT, your IDE or your agent harness over MCP or REST: it finds the listing or reads the call log, fills in a template, prices the letter and waits for your approval, then tracks the deadline by webhook.

Start in one minute, with no key

Paste the prompt into Claude, ChatGPT, your IDE or your agent harness, or call the templates yourself. The catalog is JSON, the PDFs come from the same fixed wording as this page, and no AI runs on that route: your agent supplies the values, and a missing blank answers 422 with the list.

PROMPTpaste into your agent
Help me get off call lists and data broker lists.
Read this first:
https://mailbox.bot/use-cases-do-not-call-list-request-letter.md

1. Ask who keeps calling or where my data is listed.
   Log the dates.
2. Use the free route first: the registry, STOP, the
   company's form, California's DROP.
3. If that fails, GET the catalog at
   https://mailbox.bot/api/v1/letter-templates
   Let me pick the letter, then POST my details to
   render it. Keep the wording exactly as written.
4. Show me the letter and the price. Mail nothing
   until I approve it.
5. If I have no mailbox.bot key, POST the PDF to
   /api/v1/mail-drop and give me the signup link.
6. With a key, send it Certified with a return
   receipt and requires_approval=true.
7. On mail.delivered, set the deadline from the
   template, check again after it, and tell me.
   File nothing on your own.
GET/api/v1/letter-templatesno key
# Every letter, its blanks, its law, its deadline. No key.
curl https://mailbox.bot/api/v1/letter-templates

# A finished PDF from the fixed wording. Nothing is kept.
curl -X POST \
  https://mailbox.bot/api/v1/letter-templates/do-not-call \
  -H "Accept: application/pdf" \
  -H "Content-Type: application/json" \
  -o do-not-call-sunrise-solar.pdf \
  -d '{"values":{
    "phone_number":"310-555-0142",
    "contact_dates":"October 1, 8 and 14, 2026",
    "sender_name":"Dana Reyes",
    "sender_line1":"88 Elm St",
    "sender_city":"Torrance",
    "sender_state":"CA",
    "sender_zip":"90501",
    "recipient_name":"Sunrise Solar LLC",
    "recipient_line1":"100 Congress Ave",
    "recipient_city":"Austin",
    "recipient_state":"TX",
    "recipient_zip":"78701"}}'

# In the catalog, each letter carries its clock:
# "deadline": {"days":10,"unit":"business_days",
#   "from":"receipt","cite":"47 C.F.R. § 64.1200(d)(3)"}

No account yet? Send it to the mail drop

An agent with no key can POST a document to /api/v1/mail-drop. It reads the file in memory, keeps nothing and mails nothing, and always answers 401, so nothing written against it can mistake the answer for mailed. The reply gives your agent the page count, the SHA-256, a price estimate and the sentence to tell you, with the signup link. You sign up and create a key, and it sends the same file with requires_approval=true, so it lands in your Outbound list waiting for you. Credits are only needed to approve it.

POST/api/v1/mail-dropno key
# No key, no account. Nothing is mailed and nothing is kept.
curl -i -X POST https://mailbox.bot/api/v1/mail-drop \
  -F "document=@do-not-call-sunrise-solar.pdf"
  1. 01Your agent renders a letter, or brings its own PDF, and posts it with no key to the mail drop.
  2. 02It gets the 401, with human_signup_required, and tells you what the reply says to tell you.
  3. 03You open the link. The signup page says your agent sent something and that nothing has been mailed.
  4. 04You verify your email and phone, add a return address and credits, and create an agent key under API Keys.
  5. 05Your agent sends the same file to POST /api/v1/mail. The hash in the first reply lets it prove it's the same one.
401human_signup_required
HTTP/1.1 401 Unauthorized

{
  "error": "A person needs to sign up before
            this can be mailed.",
  "reason": "human_signup_required",
  "mailed": false,
  "stored": false,
  "document": {
    "filename": "do-not-call-sunrise-solar.pdf",
    "format": "pdf",
    "pages": 1,
    "sha256": "3fa9c1…"
  },
  "signup_url": "https://mailbox.bot/signup?
                 intent=outbound&from=agent-drop",
  "relay_message": "I tried to mail … Sign up here …"
}

With a key: price it, send it, get told when it lands

A letter your agent sends with requires_approval=true lands in the same Needs Approval list as one you wrote on this page: one queue for people and agents, encrypted at rest, and no credits spent until you approve it. Over MCP: get_mailbox_md, then send_outbound_mail with dry_run=true, then the same call with requires_approval=true, and get_outbound_mail for status and photos. An agent can't buy credits.

POST/api/v1/mailmultipart
# Price it first: nothing is created or charged
curl -X POST https://mailbox.bot/api/v1/mail \
  -H "Authorization: Bearer $MAILBOX_AGENT_KEY" \
  -H "X-Mailbox-MD-Version: $MAILBOX_MD_VERSION" \
  -F "document=@do-not-call-sunrise-solar.pdf" \
  -F "recipient_company=Sunrise Solar LLC" \
  -F "recipient_line1=$STREET" \
  -F "recipient_city=$CITY" \
  -F "recipient_state=$STATE" \
  -F "recipient_zip=$ZIP" \
  -F "mail_class=certified_return_receipt" \
  -F 'metadata={"case":"dnc-0142","kind":"dnc",
     "law":"47 CFR 64.1200(d)(3)"}' \
  -F "dry_run=true"

# Then send it with requires_approval=true.
# It waits in Needs Approval. mail.pending_approval fires.
POST/api/v1/webhooks/endpoints
curl -X POST https://mailbox.bot/api/v1/webhooks/endpoints \
  -H "Authorization: Bearer $MAILBOX_AGENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"removal-clock",
       "url":"https://you.example/hooks/mail",
       "agent_id":"'$MAILBOX_AGENT_ID'",
       "environment":"live",
       "event_types":["mail.mailed","mail.delivered",
                      "mail.failed"],
       "rules":[]}'

The signing secret is shown once. Each event carries mail.id, status, carrier, tracking_number, mailed_at, delivered_at, error_message and your metadata, with api_url for the rest.

Start the clock from the delivery event

TSyour webhook receivernode
import { createHmac, timingSafeEqual } from "node:crypto";

// Calendar days from delivery, from the table on this page.
const CLOCK = { dnc: 14, delete: 45, dispute: 30 };

export async function POST(req: Request) {
  const raw = await req.text();
  const id = req.headers.get("webhook-id")!;
  const ts = req.headers.get("webhook-timestamp")!;
  const sigs = req.headers.get("webhook-signature")!;

  // Standard Webhooks v1: HMAC-SHA256 over id.timestamp.body
  const key = Buffer.from(process.env.MAILBOX_WHSEC!.slice(6), "base64");
  const want = createHmac("sha256", key).update(`${id}.${ts}.${raw}`).digest();
  const good = sigs.split(" ").some((s) => {
    const got = Buffer.from(s.split(",")[1] ?? "", "base64");
    return got.length === want.length && timingSafeEqual(got, want);
  });
  const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
  if (!good || !fresh) return new Response("bad signature", { status: 401 });

  const event = JSON.parse(raw);
  if (event.event_type === "mail.delivered") {
    const { id: mailId, delivered_at, tracking_number, metadata } = event.mail;
    const due = new Date(delivered_at);
    due.setDate(due.getDate() + CLOCK[metadata.kind]);
    // Keyed by webhook-id, because deliveries can repeat.
    await cases.upsert(id, { case: metadata.case, mailId, tracking_number, delivered_at, due });
  }
  return new Response(null, { status: 204 });
}
MDMAILBOX.md · the agent's duties
## Removal letters
- Free route first: registry, STOP, the
  company's form, DROP. Log the date.
- Use the template as written. Fill the
  blanks. Never change the legal wording.
- Never add police, prosecutors, publicity
  or a threat of any kind.
- certified_return_receipt, addressed to the
  privacy or compliance contact.
- requires_approval=true on every letter,
  with case, kind and law in metadata.
- On mail.delivered, set the date: 10
  business days for do-not-call, 45 days
  for deletion, 30 for a credit dispute.
- After that date, check again and tell me.
  File nothing on your own.

Rehearse the whole loop for free

Prove your deadline code before you mail anything. Create a Sandbox webhook (environment: test), then walk a test letter to delivered with a sandbox key (sk_agent_test_). Your receiver gets the same events a real letter sends. Over MCP, it's create_test_outbound_mail and advance_test_outbound_mail.

POST/api/v1/test/mailsandbox
# A sandbox key mails nothing and costs nothing.
curl -X POST https://mailbox.bot/api/v1/test/mail \
  -H "Authorization: Bearer $MAILBOX_SANDBOX_KEY" \
  -H "Content-Type: application/json" \
  -d '{"recipient_company":"Sunrise Solar LLC",
       "mail_class":"certified_return_receipt",
       "metadata":{"case":"dnc-0142","kind":"dnc"}}'

# Walk it forward: submitted, ready, mailed, delivered.
# Each call fires your webhook, ending in mail.delivered.
curl -X POST \
  https://mailbox.bot/api/v1/test/mail/$MAIL_ID/advance \
  -H "Authorization: Bearer $MAILBOX_SANDBOX_KEY"

Four jobs an agent can run, with a person signing off

Spam call to suppression record

A call log or voicemail transcript names the caller. The agent fills in the do-not-call template, prices it and asks you. On delivery it sets a date 10 business days out and logs any later call against it, with the date and the number.

call log → send_outbound_mail (dry_run) → approve → mail.delivered → due + 10 business days

People-search watch

The agent checks a list of URLs for your name each week. A new listing gets the free form first, then a letter if it's still there. On day 46 it checks again, and either closes the case or tells you.

fetch listing → opt-out form → POST /v1/mail → mail.delivered → due + 45 days → fetch listing

The reply comes back

With a mailbox.bot return address, the broker's answer arrives as scanned mail. A keyword rule on "privacy" or "verification" pings your webhook, and the agent reads the page text and updates the case.

inbound.keywords_matched → get_inbound_pages → update case

A privacy team's queue

One Certified letter per client and broker, each tagged with the client and the law. A person approves each one, and the mailing dates and delivery records file themselves. Batch mail is First-Class from 10 pieces, so Certified letters go one at a time.

POST /v1/mail (requires_approval=true) → mail.mailed → mail.delivered → case file

Your agent isn't your authorized agent

Under the CCPA regulations, an authorized agent is a person or business you authorized, with signed permission a company can ask to see, and those rules don't mention software. No authority we found addresses this directly, but on the text, someone who signs and sends their own request using software appears to remain the requester. So the letter goes out in your name and over your signature, your agent only prepares it, and we only print and mail it. Acting for someone else is a different job with its own rules (Cal. Code Regs. tit. 11, §§ 7001(d), 7063).

[Who it's for]

For anyone with a list they want off of

Anyone a seller won't stop calling

You're on the registry and the calls keep coming, or a company you bought from once won't let go. Fill in the letter and we'll mail it, with a dated record behind you.

People who found themselves online

Your name, address and phone on a people-search site, your relatives listed beside you, and a removal form that loops. Take the free route first, and then put it in writing.

Judges, officers and their families

New Jersey's Daniel's Law turns on a written notice, and federal judges have the Daniel Anderl Act. A delivery record marks the day the 10 business days began.

Privacy teams and lawyers

Client requests sent by Certified with per-client metadata, proof that files itself, and a person approving each piece. You choose the law and the letter, and we handle the mail.

Families helping someone

A parent for a child, an adult child for an elderly parent. DROP lets you submit for another California resident, and a letter can go out in their name, over their signature.

Developers with an agent

Connect Claude, ChatGPT, your IDE or your agent harness over MCP or REST. It watches the call log or the listing, drafts from a template, and tracks each clock by webhook.

[Before you send]

A checklist for your letter

  • Free route first: the registry, STOP, the company's form, DROP. Note the date you did each.
  • A call log: date, time, the number that called, who they said they were.
  • The address from their privacy policy or a state broker registry, checked against the Secretary of State's listing.
  • The seller, the telemarketer and any brand or affiliate you want covered, named in the letter.
  • Only the identifiers they need. No Social Security number and no ID copy.
  • Your own copy of the PDF, because we delete the file after it's mailed.
  • A named person on the envelope if you want Restricted Delivery: USPS requires one, so it won't fit a letter addressed only to a company.
  • Send it early enough. Every deadline here runs from when they receive it.
[Not a fit]

What we don't do

  • Legal advice. We're a printing and mailing fulfillment service, so we don't tell you which letter or law fits your facts. You choose the letter.
  • Writing in our own name, signing for you, or acting as your authorized agent.
  • Filing complaints or lawsuits, or removing you from any list ourselves. We print and mail what you send.
  • Guarantee any outcome. A letter can start a clock and create a record. It isn't a court order, and a company may still ignore it or refuse.
  • Mail outside the United States.
[Questions]

Do not call and data removal letters, answered

What is a do not call list request letter?

A written request telling a company to stop calling your number and add it to its own do-not-call list. FCC rule 47 C.F.R. § 64.1200(d)(3) gives a telemarketer at most 10 business days from receipt, and the request lasts five years.

Do I need one if I'm on the National Do Not Call Registry?

Register first: it's free at DoNotCall.gov and never expires. A letter fills the gaps. Companies you recently did business with can call a registered number until you tell them to stop, and a company-specific request ends that relationship. A letter also gives you a dated record if the calls keep coming.

How long does a company have to stop calling?

At most 10 business days from receiving your request under the FCC's rule, and calls to a newly registered number can continue for up to 31 days. Debt collectors are different: a written stop notice takes effect when they receive it.

Will a letter stop robocalls and texts I once agreed to?

Reply STOP as well. Today you can revoke consent by any reasonable method, honored within 10 business days. From November 25, 2026, a caller can name an automated opt-out, a reply text, or its website or phone number as the exclusive way, and need not process anything else. If it names none, any reasonable means still works, and a dated letter is your evidence. Our letter is also a company do-not-call request, which that order doesn't amend.

Can I sue over unwanted texts?

It depends on where you are. The Seventh Circuit held in 2026 that the do-not-call suit in § 227(c)(5) doesn't reach texts, and other federal courts are divided. The robocall section, § 227(b), has been read to cover texts, and some state laws such as Florida's, Texas's and Connecticut's cover them expressly. In Florida you must reply STOP and wait 15 days first.

Will they face charges if they ignore my letter?

Generally not criminal ones. These are civil claims a court decides, and regulatory penalties an agency collects: up to $500 per violation under the do-not-call section, $1,000 per action under the FDCPA, and state fines under privacy laws. A few narrow criminal provisions exist, but we found none that makes an ignored removal letter generally a crime.

Can my letter threaten to report them to the police?

Don't. In California, a letter threatening to accuse someone of a crime to get money can be extortion, whoever sends it, and Flatley v. Mauro held one lawyer's letter was exactly that. Name the statute and your civil remedies, and keep any request for money apart from any mention of a complaint. Our templates do.

Is mailbox.bot a law firm? Do you guarantee the result?

No to both. We're a printing and mailing fulfillment service: we print, envelope, label and mail what you send, and we don't review it for legal sufficiency. The templates aren't legal advice, no outcome is guaranteed, and you use them at your own risk. You choose the letter, and it goes out in your name.

Do I need a lawyer to send one?

These laws don't require a lawyer to send this notice. A lawyer can advise on your facts and on suing, and our templates aren't a substitute for that advice.

Does a data broker have to delete my data if I mail a letter?

Not automatically. In California, a request sent outside the methods a business designated must either be treated as submitted or answered with how to submit it. The right to delete reaches data collected from you, so a broker that bought your data may rely on the right to stop its sale instead. Use the company's form and DROP first. Other states' laws are enforced by attorneys general, and only some reach brokers fully.

What is California's DROP?

The Delete Request and Opt-out Platform, free at privacy.ca.gov/drop for California residents. One request reaches every registered data broker. Since August 1, 2026, brokers must check it at least every 45 days and delete within 45 days of receipt, or owe $200 per request per day.

Who do I address the letter to?

The privacy or compliance contact in the company's privacy policy first, then the contact in a state data broker registry. A registered agent, listed by the Secretary of State, accepts court papers and is a fallback. For calls, write to the seller and to the telemarketer if you know it.

Is Certified Mail required?

Rarely. California's CLRA names certified or registered mail, return receipt requested, for its 30-day notice. Other laws say written, or any reasonable means. Certified is what gives you a mailing receipt and a delivery record, and on these laws the clock usually runs from receipt.

Does Certified Mail prove what was in the envelope?

No. USPS records show the piece was mailed and who received it. So keep your copy, and save the photos we take of the printed pages and the sealed envelope. We keep only blurred previews after that.

What's the difference between Certified and Restricted Delivery?

Restricted Delivery directs delivery only to the addressee or their authorized agent, and USPS requires the addressee to be a named person. It doesn't fit a letter addressed only to a company. It adds $10.00 here when you name a person.

What does the AI do with what I type?

It copies your details into the blanks of the letter you chose, and that's all. You pick the letter, and its wording is fixed and sourced, so the AI can't invent a law or word a threat. Your text goes through our AI provider to a model that keeps no copy and doesn't train on it, and we don't save it. You can skip AI and fill in the blanks yourself.

Where does my file go when I upload it?

Before you have an account, it stays in your browser, so nothing reaches our servers. You can remove it at signup, which is worth doing on a shared computer, and a draft older than 24 hours is wiped the next time you visit. Once you sign up, your letter lands in your Outbound list as Needs Approval, whether you wrote it here or uploaded it. If you skipped the address or the service, it waits in the send form until you add them. From there it's encrypted at rest with its own key and deleted after the piece is mailed.

What happens after I sign up?

Your letter is in your Outbound list as Needs Approval, with the address and service you picked. Nothing is charged until you approve it, and you can add credits at that point or cancel it. It stays there until you approve or cancel, and we send a reminder. If you skipped the address or the service, it's attached in the send form instead, and the same happens if you sign in to an account you already had.

Why do I have to sign up to send it?

The mail goes out from an account in your name: a verified email and phone, a return address and accepted terms, which takes about five minutes. There's no card to join, and you add credits before live mail.

Can my AI agent send the letter?

Yes, once you have a key. Without one, it can POST the file to /api/v1/mail-drop, and the reply says a person needs to sign up and gives it the link to pass on. With a key, it prices each letter with a dry run and sends it with requires_approval=true, so it waits in the same Needs Approval list as a letter you wrote here. You approve it, and the certified number and delivery date come back by webhook. The letter is still yours: it goes out in your name.

Is there an API for the templates?

Yes, and it needs no key. GET /api/v1/letter-templates lists each letter, its blanks, its law, a machine-readable deadline and the state privacy laws. POST /api/v1/letter-templates/{id} with your details returns a finished PDF from the fixed wording, and it keeps nothing. No AI runs on that route: your agent supplies the values.

Can I test this without mailing anything?

Yes. A sandbox key (sk_agent_test_) with POST /api/v1/test/mail and its advance route walks a letter from submitted to delivered and fires each webhook, for free, with nothing mailed. So you can prove your deadline code before you send a real letter.

Can I send the same letter to many brokers?

Yes: one letter per broker. On this page, write each one and up to 10 wait in your browser, and each lands as its own order when you sign up. Certified letters go one at a time through the send form or POST /v1/mail, so each has its own number and clock. Batch mail runs First-Class from 10 pieces, with no USPS delivery record.

How much does it cost?

The templates are free. For one black-and-white page: Certified Mail $20.00, Certified with an electronic return receipt $24.00, First-Class $2.00. Each extra page adds $0.40 plus any postage increase. A mailbox.bot return address is $15/mo. You see the exact price before you pay.

[Sources]

Last checked against these sources on 31 October 2026. Where an official site blocks automated reads, we used a named mirror or a law firm's summary, so read the statute itself before relying on it.

Disclaimer. mailbox.bot is a printing and mailing fulfillment service. We print, envelope, label and mail the documents you send us, and we don't review them for legal sufficiency. We are not a law firm, and nobody at mailbox.bot acts as your lawyer. This page, the templates, the letter desk and its AI step are general information and self-help tools, provided as is. They are not legal advice and not a substitute for the advice of an attorney, and using them doesn't create an attorney-client relationship. You choose the letter, and you are responsible for what it says, who it goes to, whether it's accurate and whether it's right for your situation. We don't guarantee any outcome: not that a company will comply, stop calling, delete your data or pay you, not that a letter meets a legal requirement or a deadline, and not that a delivery record or a photo will be accepted as evidence. You use all of this at your own risk. Laws change and courts disagree, so check the current rule, and talk to a lawyer about your facts, before you rely on anything here. mailbox.bot isn't affiliated with or endorsed by the FCC, FTC, CFPB, USPS, CalPrivacy or any state agency. Mail you send through us is covered by our Terms of Service, including Section 9B.

Put it in writing. We'll put it in the mail.

Fill in a free template or upload your own. Staff in Manhattan Beach, CA print it, mail it Certified and photograph every step.

mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk.