We mail your do not call list request letter, with photo proof it was sent
Upload your letter, or pick a template and let AI copy your details into it. We print it, envelope and label it, pay the postage and mail it, from $2.00 First-Class to Certified with a return receipt.
- Staffed facility in Manhattan Beach, CA
- Photos of every piece
- Encrypted, deleted after mailing
- API and webhooks for your agent
You pick the letter; AI copies your details into its blanks, so it can't invent a law. An AI provider that keeps no copy reads what you type, and we don't save it.
mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk. Full disclaimer
You or your agent send the letter. We put it in the mail.
No printer, no green card to fill out and no line at the post office counter. Five steps, and you only do the first one.
- 1YouYou write or upload it
Fill in a free template above or upload your own PDF. Your agent can send it too.
- 2WeWe print it
Every page, in the order you sent it, in black and white or color.
- 3WeWe envelope and label it
We buy the postage and print the label: Certified Mail with an electronic return receipt, or the service you pick.
- 4WeWe hand it to USPS
Prepared for dispatch the next business day by our staff in Manhattan Beach, CA.
- 5WeYou get the proof
The certified number, the delivery record, and photos of the pages and the sealed envelope.
One page: Certified Mail $20.00, with a return receipt $24.00, First-Class $2.00. Each extra page adds $0.40 plus any postage increase. Templates are free. You see the exact price before you pay.
What is a do not call list request letter?
It's a written request telling a company to stop calling your number and add it to the company's own do-not-call list. Under FCC rule 47 C.F.R. § 64.1200(d)(3), a telemarketer must record the request and honor it within a reasonable time, no more than 10 business days after receiving it, and keep honoring it for five years. If you get more than one call in 12 months in violation of the do-not-call rules, 47 U.S.C. § 227(c)(5) lets you sue for up to $500 per violation, and a court can triple that if it was willful or knowing. That is civil liability a court decides, not a criminal charge. The same idea reaches your data: state privacy laws give a business or data broker a deadline, usually 45 days, to delete it or stop selling it.
There is no single takedown letter. Each list has its own.
US law has no one "remove me" letter, so use the law's own word. That's what gets a letter to the right desk. "Cease and desist" and "demand letter" are only labels. Neither one is a court order, but a letter can trigger a duty, start a clock or meet a step you must take before suing.
| The letter | Goes to | The law | The clock |
|---|---|---|---|
| Do-not-call demand letter | The seller, and the telemarketer if you know it | 47 C.F.R. § 64.1200(d)(3), (d)(5), (d)(6); 16 C.F.R. § 310.4(b)(1)(iii)(A); 47 U.S.C. § 227(c)(5) | The FCC gives them at most 10 business days, and the request lasts 5 years. |
| Revocation of consent | Anyone robocalling or robotexting you on consent you once gave | 47 C.F.R. § 64.1200(a)(10)-(11), (d)(3); 47 U.S.C. § 227(b)(3) | 10 business days, unless the caller named an exclusive way. |
| TCPA demand letter | A seller that called a number on the registry | 47 U.S.C. § 227(c)(5); 47 C.F.R. § 64.1200(c)(2) | You set the deadline: this letter gives 30 days. |
| Cease-communication letter | A debt collector | 15 U.S.C. § 1692c(c); 12 C.F.R. § 1006.6(c); 15 U.S.C. § 1692k | It takes effect when they receive it. |
| Request to delete and opt out | A data broker or any business holding your data | Your state's privacy law, filled in from your state: for California, Cal. Civ. Code §§ 1798.105 and 1798.120 | Most state laws give them 45 days. |
| People-search removal demand | A people-search or background-check site | Your state's privacy law, filled in from your state; 15 U.S.C. § 1681i if the site sells consumer reports | Most state laws give them 45 days. |
| FCRA dispute letter | A credit bureau or specialty reporting agency | 15 U.S.C. § 1681i(a) | They have 30 days to reinvestigate, sometimes 45. |
| Mailing-list removal | A catalog, flyer or offer mailer | Your state's privacy law, where it has one | No federal deadline for ordinary junk mail. |
| Daniel's Law notice | Anyone publishing a covered person's home address | N.J.S.A. 56:8-166.1(a), (c) | They have 10 business days from receipt. |
Nine letters, ready to fill in or download
Each one names the statute and your civil remedy and nothing else. Open a letter to read every word, fill it in at the top of this page, or download the blank PDF and do it your way.
Stop calling me
Puts your number on the company's own do-not-call list and on notice for anyone calling for it.
The FCC gives them at most 10 business days, and the request lasts 5 years.
Read the letter
Re: Do-not-call demand for [Your phone number]
You, or someone calling on your behalf, have called me at [Your phone number].
Do not call or text this number again. This is a do-not-call request under 47 C.F.R. § 64.1200(d)(3) and 16 C.F.R. § 310.4(b)(1)(iii)(A). The FCC's rule requires you to record it and honor it within a reasonable time, not to exceed 10 business days from the date you receive it, and to keep honoring it for five years.
This request covers you, your affiliates and every brand you call for. You have my permission to share it with any telemarketer, lead generator or other vendor that calls for you, so that they can honor it too.
I do not consent to these calls. If you believe I consented at some point, this letter withdraws that consent.
47 U.S.C. § 227(c)(5) lets a person who receives more than one call within 12 months in violation of the do-not-call rules sue for up to $500 per violation, and a court may increase that up to three times for a willful or knowing violation. I am keeping a record of every call, and I reserve all of my civil remedies.
Please confirm in writing, at the address above, that this number has been removed, send me a copy of your written do-not-call policy, and give me the name of any vendor that called for you.
I take back my consent
For robocalls and robotexts you once agreed to. Reply STOP as well: from November 25, 2026, a caller can name one exclusive way to revoke.
10 business days, unless the caller named an exclusive way.
Read the letter
Re: Revocation of consent to call or text [Your phone number]
I revoke any consent I have given you, or anyone acting for you, to call or text [Your phone number], including calls and texts made with an automatic telephone dialing system or an artificial or prerecorded voice.
Under 47 C.F.R. § 64.1200(a), a caller must honor a revocation made by reasonable means within 10 business days. If you say you have designated an exclusive way to revoke consent, tell me what it is and where you disclosed it to me.
This letter is also a company-specific do-not-call request under 47 C.F.R. § 64.1200(d)(3), which you must honor within 10 business days of receiving it.
47 U.S.C. § 227(b)(3) lets a person recover actual loss or $500 for each violation, whichever is greater, and a court may increase that up to three times for a willful or knowing violation. I am keeping a record of what I receive after this letter is delivered, and I reserve all of my civil remedies.
Please confirm in writing, at the address above, when this is done.
You called a number on the registry
Asks the company to stop, keep its records, and resolve your civil claim before you file one.
You set the deadline: this letter gives 30 days.
Read the letter
Re: Telemarketing calls to [Your phone number]: demand under 47 U.S.C. § 227(c)
You, or someone calling on your behalf, made telemarketing calls to my number, [Your phone number], on [Dates of the calls or texts]. This is my personal number, it has been on the National Do Not Call Registry since [On the Do Not Call Registry since], and I did not invite these calls or give you permission to make them.
I believe these calls violated 47 U.S.C. § 227(c) and 47 C.F.R. § 64.1200(c)(2). Section 227(c)(5) lets a person who receives more than one such call within 12 months sue for up to $500 per violation, and a court may increase that up to three times for a willful or knowing violation.
Within 30 days of receiving this letter, please:
- Stop calling this number, and put it on your internal do-not-call list.
- Keep your records of these calls, any consent you rely on, where you got my number, and the names of any vendors that called for you.
- Write to me about resolving this claim.
If we can't resolve this, I may pursue my civil remedies, including a claim in small claims court. Until then, I reserve all of my civil remedies.
Stop contacting me about this debt
Ends a debt collector's contact with you. It doesn't erase the debt, and they can still sue.
It takes effect when they receive it.
Read the letter
Re: Cease communication about the debt you are collecting
You have contacted me about a debt.
Under 15 U.S.C. § 1692c(c) and 12 C.F.R. § 1006.6(c), I direct you to stop communicating with me about this debt. Once you receive this letter, you may contact me only to say that your collection efforts are ending, or that you or the creditor may invoke, or intend to invoke, a specific remedy.
This letter is not an admission that I owe this debt, and I do not give up any right or defense.
A debt collector that violates the Act is liable under 15 U.S.C. § 1692k for actual damages, additional damages of up to $1,000 in an individual action, and costs and reasonable attorney's fees. I am keeping the delivery record of this letter.
Delete my data and stop selling it
Uses your state's privacy law, where it has one, to ask a business or data broker to delete your data and stop selling it.
Most state laws give them 45 days.
Read the letter
Re: Request to delete my personal information and opt out of its sale
I make this request under the privacy law of my state, any other law that applies to you, and your own privacy policy.
Please do the following:
- Delete the personal information you hold about me.
- Stop selling or sharing my personal information, and stop using it for targeted advertising.
- Tell your service providers, contractors and anyone you sold it to about this request, where the law requires it.
- Tell me in writing what you did, and which exception you rely on for anything you keep.
To find my records, use my name and address above. Use this information only to process this request. If you need anything more to verify me, tell me exactly what and why.
Take down my listing
Asks a people-search site to remove your listings and keep them from coming back. Try its free opt-out form first.
Most state laws give them 45 days.
Read the letter
Re: Demand to remove my listings and stop selling my personal information
Your website publishes information about me at: [Web addresses of the listings].
Remove these listings and any other listing about me, and suppress my information so that it doesn't return when your data sources refresh.
I make this request under the privacy law of my state, any other law that applies to you, and your own privacy policy.
If you furnish reports used to decide on credit, insurance, employment or housing, you may be a consumer reporting agency under the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f). If you are, treat this letter as my dispute of the accuracy and completeness of this information under 15 U.S.C. § 1681i.
To find my records, use my name and address above. Use this information only to process this request.
Please confirm in writing, at the address above, when this is done.
This report is wrong
Disputes wrong or unverifiable information with a credit bureau or specialty reporting agency. Send it to the bureau, not only to the lender.
They have 30 days to reinvestigate, sometimes 45.
Read the letter
Re: Dispute of information in my consumer file
I dispute the following information in my consumer file: [What is wrong on the report].
Under 15 U.S.C. § 1681i(a), please reinvestigate this free of charge and finish within 30 days of receiving this letter. Delete or correct whatever is inaccurate, incomplete or can't be verified, and send me the written results.
I have left my Social Security number out of this letter. If you need more to find my file, tell me what you need.
Take me off your mailing list
Asks a mailer to stop mailing you and stop renting your address to others.
No federal deadline for ordinary junk mail.
Read the letter
Re: Remove me from your mailing lists
Remove my name and the address above from every mailing list you keep or use. Stop mailing me, and stop renting, selling or sharing my name and address.
Please confirm in writing, at the address above, when this is done.
Stop publishing my home address
For New Jersey judicial officers, law enforcement officers, prosecutors, child protective investigators and their household family: written notice to stop disclosing a home address or unpublished home phone. The law is under a First Amendment challenge.
They have 10 business days from receipt.
Read the letter
Re: Written notice under N.J.S.A. 56:8-166.1 (Daniel's Law)
I am a covered person under New Jersey's Daniel's Law: [Your covered role].
This is my written notice under N.J.S.A. 56:8-166.1 that you must not disclose or re-disclose, on the internet or otherwise make available, the following protected information: [What must come down].
The statute bars disclosure starting 10 business days after you receive this notice. It provides a civil action in which a court awards actual damages of not less than $1,000 for each violation.
Please confirm in writing, at the address above, when this is done.
mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk. Full disclaimer
What they face: civil liability and regulators, not criminal charges
These are claims a court or an agency decides, and they're not automatic payments. Here is what each law actually puts on the table, and who collects it.
| The law | What it allows | Who collects | Time limit or catch |
|---|---|---|---|
| Robocalls to a cell47 U.S.C. § 227(b)(3) | A suit for an injunction and actual loss or $500 per violation, whichever is greater. A court may raise that up to three times if willful or knowing. | You | Four years, as applied by the Second Circuit under 28 U.S.C. § 1658(a). State claims differ. |
| Do-not-call rules47 U.S.C. § 227(c)(5) | A suit for an injunction and actual loss or up to $500 per violation, once you've had more than one call within 12 months from the same entity. Up to three times if willful or knowing. | You | A company has a defense if it kept reasonable procedures with due care. Courts split on § 64.1200(d) claims and on texts. |
| Telemarketing Sales Rule16 C.F.R. § 1.98(d); 15 U.S.C. § 6104 | Civil penalties up to $53,088 per violation, unchanged in 2026 because that year's adjustment was cancelled. | The FTC, not you, unless a pattern of violations cost you over $50,000 | A private suit needs written notice to the FTC and must be filed within three years of discovery. |
| FCC penalties47 U.S.C. § 227(b)(4), (e) | Agency forfeitures for robocalls, up to $10,000 more for intentional violations, and up to $10,000 per violation for spoofing caller ID with intent to defraud. | The United States | No private suit for spoofing. |
| Debt collectors15 U.S.C. § 1692k | Actual damages, additional damages up to $1,000 per action, not per violation, plus costs and reasonable attorney's fees. | You | One year from the violation, not from when you found out (Rotkiske v. Klemm, 2019). |
| Credit reports15 U.S.C. §§ 1681n, 1681o, 1681p | Willful: actual damages or $100 to $1,000, plus punitive damages and fees. Negligent: actual damages and fees. | You | The earlier of two years from discovery or five from the violation. You need concrete harm (TransUnion, 2021). |
| California privacyCal. Civ. Code §§ 1798.155, 1798.199.90, 1798.150 | Fines and civil penalties up to $2,663 per violation, $7,988 if intentional or involving a minor under 16. Breach suits of $107 to $799 per consumer per incident. | The state. You only for a data breach | An ignored delete request doesn't support a private suit. Amounts adjust in January 2027. |
| California Delete ActCal. Civ. Code §§ 1798.99.82, 1798.99.89 | $200 per day for failing to register, and $200 per deletion request per day for failing to delete, plus costs. | CalPrivacy | Administrative actions must start within five years. |
| Other state privacy lawsSee the state table | Civil penalties, most often up to $7,500 per violation, $20,000 in Colorado, and up to $50,000 for the very large companies Florida's law reaches. | The state | No private suit, and a cure period in some states. |
| Daniel's LawN.J.S.A. 56:8-166.1(c) | Actual damages of not less than $1,000 per violation, and punitive damages for willful or reckless disregard. New Jersey's Supreme Court held on August 12, 2026 that actual-damages liability needs no mental state. | The covered person or their assignee | Its constitutionality is pending in the Third Circuit, No. 25-1555, as of our last check. |
Don't threaten criminal charges
In California, getting property through a threat to accuse someone of a crime or expose a secret can be extortion, and so can sending a letter with that threat. The California Supreme Court held one lawyer's demand letter was extortion as a matter of law, and a threat to report can be legal alone and illegal when joined to a demand for money. So keep a request for money and a mention of any complaint apart, and leave out police, prosecutors and publicity. Our templates do. No court calls that a safe harbor, but it stays clear of the line.
Why a violation doesn't always mean a lawsuit
Federal courts need concrete harm, not just a broken rule. In TransUnion, 6,332 class members whose wrong credit files never went to anyone had no standing, and Spokeo v. Robins, a people-search case, set up that test. Narrow criminal provisions do exist, such as obtaining a credit report under false pretenses, spoofing caller ID to defraud, and New Jersey's reckless posting after notice. We found none that makes an ignored removal letter generally a crime.
Getting your number off a call list
The National Do Not Call Registry is the free first step. It leaves gaps, and the company's own do-not-call list is where a letter fills them.
Start with the free registry
Register at DoNotCall.gov or 1-888-382-1222 from the phone itself. Personal numbers only, no business lines. Entries don't expire, and sales calls can continue for up to 31 days while callers refresh their lists.
What the registry doesn't stop
Political, charity, debt collection, informational and survey calls with no sales pitch. Companies you recently did business with (a purchase within 18 months, an inquiry within 3) or gave written permission, until you tell them to stop. That sentence is what your letter is for.
The company's own list
Anyone telemarketing must have a written do-not-call policy available on demand, train staff on it, record your request when made and honor it within 10 business days of receiving it, for 5 years. A seller's request ends an established business relationship. The FTC's rule makes it abusive to call after you've said no, but sets no day count of its own.
Write to the seller and the caller
A request covers the entity making the call or the one it is made for. If a vendor keeps the list, the company the calls are for is still liable for failing to honor it. Name your affiliates and brands in the letter: a request reaches affiliates only if you'd reasonably expect them included, unless you ask for more.
New on November 25, 2026: how you revoke consent to robocalls and robotexts
The FCC rewrote this rule in October 2026, and most guides don't reflect it yet. If you once agreed to messages, this is the rule that decides whether your letter counts.
| Today, until November 24, 2026 | You can revoke consent to robocalls and robotexts by any reasonable method, a caller can't name an exclusive one, and it must honor your request within 10 business days.47 C.F.R. § 64.1200(a)(10), current text |
| From November 25, 2026, if the caller names a method | A caller may make an automated opt-out, a reply text with standard words, or its own website or phone number the exclusive way to revoke, if it discloses that clearly on the call or text. It need not process anything else. So reply STOP as well as mailing a letter, and watch for the disclosure.FCC 26-67, App. A; 91 Fed. Reg. 67214 (Oct. 26, 2026); new § 64.1200(a)(10) |
| From November 25, 2026, if it names none | Any reasonable means still works, within 10 business days. Once you produce evidence of your request, revocation is presumed unless the caller rebuts it. A dated, delivered letter is that evidence.New 47 C.F.R. § 64.1200(a)(11) |
| Either way | The new order doesn't amend the company do-not-call rule at § 64.1200(d). That's why our revocation letter is also a company do-not-call request. The order never mentions mail, and how the two rules fit together is untested. The FCC is also asking about a shorter deadline and a revoke-all method.FCC 26-67, App. A and ¶¶ 30, 37-38 |
How your number got there
Call lists and data lists are the same list at different stages. A number typed into a web form goes to a lead seller and on to a telemarketer the same day. The same number, bought from an app or copied from a public record, sits with a data broker, which sells it on to people-search sites and marketing lists. That's why this page covers both. Removing one copy leaves the others, and a caller's answer to "where did you get my number?" is worth asking for in writing.
What the courts have done lately
Texts and the do-not-call suit
The Seventh Circuit held in July 2026 that § 227(c)(5) doesn't let people sue over unwanted texts. It binds federal courts in Illinois, Indiana and Wisconsin, it leaves agency enforcement alone, and it did not decide state claims. Elsewhere, district courts are divided: E.D. Pa. says a text is a call, N.D. Ga. says it isn't.
Texts and robocalls
The Ninth Circuit held in January 2026 that a text is a call under § 227(b), a different subsection, though that plaintiff lost because they had to press play on the prerecorded video.
What counts as an autodialer
A device must use a random or sequential number generator to store or produce numbers. Many targeted calls and texts fall outside § 227(b) for that reason, though a prerecorded or artificial voice is still covered.
The FCC is not the last word
Courts in private suits decide what the TCPA means for themselves and aren't bound by the FCC's reading, so any FCC rule quoted here can be rejected by a court. The Fifth Circuit has done so on oral consent.
Lead sellers
The Eleventh Circuit vacated the FCC's one-to-one consent rule, so a single web form can still name many sellers. Send your letter to the seller and, if you can find it, to the lead source.
Who can sue, and where
Federal and state courts both hear private TCPA suits. The four-year federal catch-all limit has been applied to the TCPA. A separate private suit under the FTC's rule needs a pattern of violations and more than $50,000 in actual damages per person.
State telemarketing laws
Many states add their own rule or their own claim. Some cover texts where federal courts won't, and two make a reply of STOP the step that counts. Read your state's statute before relying on it.
| State | The rule | What it allows |
|---|---|---|
| FloridaFla. Stat. § 501.059 | No sales calls or texts after an opt-out or to its no-sales list. Before suing over sales texts, reply STOP to the number that texted; the sender has 15 days. A mailed letter doesn't meet that step. | Actual damages or $500, whichever is greater; up to three times if willful or knowing. |
| GeorgiaO.C.G.A. § 46-5-27 | More than one violating voice solicitation in 12 months. You can name the caller, the party it called for, or both. Two-year limit. | Fees, plus actual loss or up to $1,000 per violation. |
| MarylandMd. Code, Com. Law §§ 14-4502, 14-4503 | No solicitations from 8 p.m. to 8 a.m., no more than three in 24 hours on one subject, and no automated ones without prior express written consent. | Up to $500 or actual damages; up to three times. |
| Oklahoma15 O.S. §§ 775C.4, 775C.6 | No commercial solicitation calls before 8 a.m. or after 8 p.m., and no more than three in 24 hours on one subject. Broad exemptions apply. | Actual damages or $500; up to three times if willful or knowing. |
| TexasTex. Bus. & Com. Code chs. 302, 304, 305 | Since Sept 1, 2025, a telephone solicitation includes texts and images, and a Chapter 304 violation is actionable as a deceptive trade practice. | $500 or actual damages, up to $1,500 or treble if knowing or intentional (§ 305.053). Chapter 302 sets civil penalties up to $5,000 per violation. |
| VirginiaVa. Code §§ 59.1-514, 59.1-515 | Honor a no-solicitation request for at least 10 years. Since Jan 1, 2026, a text opt-out is made by replying UNSUBSCRIBE or STOP. | $500 for a first violation, $1,000 for a second, $5,000 for each later one; up to $5,000 for a willful first or second. |
| WashingtonRCW 80.36.390; RCW 19.190.060 | Stop for at least one year on request; no calls before 8 a.m. or after 8 p.m. Commercial texts need clear prior consent. | At least $1,000 per violation for repeated solicitation calls, plus fees. For text suits filed since June 11, 2026, $100 or actual damages. |
| CaliforniaCal. Bus. & Prof. Code §§ 17592, 17593 | Uses the national registry. A recipient can seek a small claims injunction first. | Up to $1,000 for violations within 30 days after serving the injunction. |
| ConnecticutConn. Gen. Stat. § 42-288a | Covers calls and texts: 9 a.m. to 8 p.m., identify within 10 seconds, prior express written consent. | Unfair trade practice; state fines up to $20,000 each. Private suits run through CUTPA. |
| New YorkN.Y. Gen. Bus. Law § 399-z | Covers calls and texts: 8 a.m. to 9 p.m., and telemarketers must offer and honor addition to the seller's do-not-call list. | State fines up to $20,000 per violation. This section creates no damages suit. |
| ArizonaA.R.S. § 44-1282 | No outbound solicitation calls or texts to registered numbers, with exceptions. | Consumer Fraud Act violation; Attorney General penalties capped at $1,000 per violation. |
| IndianaInd. Code ch. 24-4.7; ch. 24-5-14 | Its own do-not-call law, with autodialers regulated separately. | Attorney General enforcement. |
The one federal stop-calling right built around a letter
Debt collection calls are exempt from the Do Not Call Registry. What stops them is a written notice, and by mail it takes effect the day it arrives, which is what a delivery record shows.
The stop notice
If you tell a debt collector in writing to stop, or that you refuse to pay, it must generally stop. It can still tell you it's ending its efforts, or that it or the creditor may or will use a specific remedy. It doesn't erase the debt, and a suit can still follow.
It counts when it arrives
A mailed notice is complete on receipt. The CFPB's own example: mailed August 3, received August 6, and an email sent on August 4 breaks no rule. Regulation F also accepts an electronic notice sent through a channel the collector takes messages on.
Who counts
A business whose main purpose is collecting debts, or that regularly collects debts owed to someone else. A creditor's own employees collecting in its own name don't. A company collecting debts it bought may not fit the second test, though it can still be a collector if collecting is its main business.
Just one channel
You can stop calls without ending all contact: tell the collector to stop using a phone number or another medium. Every collector email or text must explain a simple way to opt out, and it can't charge you to do it.
How many calls is too many
A collector is presumed to violate the harassment ban if it calls more than seven times in seven days about a debt, or within seven days after a phone conversation about it. That's a presumption and not a cap.
Disputing the debt itself
Dispute in writing within 30 days of the validation notice, and the collector must stop collecting that debt until it sends verification. That's a different letter from a stop notice, and you can send both. California's Rosenthal Act adds its own remedies, up to $1,000 for willful and knowing violations.
Getting your data off a broker's list
A data broker sells information about people it has no direct relationship with. Federal law mostly leaves them alone, so this is a state fight, and California is the furthest along.
No federal right to delete
No single federal law governs company data privacy, and we found no federal data broker deletion law enacted as of today. The CFPB withdrew its proposal to treat data brokers as consumer reporting agencies in May 2025. Two bills are pending. The rights that exist come from states, and from the FCRA where a company sells consumer reports.
California's DROP comes first
California residents can send one free deletion request to every registered broker at privacy.ca.gov/drop. Since August 1, 2026, brokers must check it at least every 45 days, delete within 45 days of receipt, and delete again every 45 days. A broker that doesn't owes $200 per request per day. CalPrivacy reported over 550,000 sign-ups and over 650 registered brokers in October 2026. You can submit for a child or an elderly relative too.
What DROP and a letter can't reach
DROP reaches registered brokers, not the companies you deal with directly, and activity covered by the FCRA or GLBA, and public records, can stay. Under the CCPA, the right to delete reaches data collected from you, which often leaves out what a broker bought from someone else. The right to stop its sale is the one that bites there.
If you mail a California request
A letter doesn't force processing. Under the 2026 regulations, a delete, correct or know request sent by a method the business didn't designate must be either treated as properly submitted or answered with how to submit it. It can't just vanish, and your delivery record shows when the clock could have started. Use the designated method first.
California's deadlines and fines
Confirm a delete request in 10 business days, respond in 45 calendar days, extendable to 90 with notice. Honor an opt-out as soon as feasible and within 15 business days, with no identity check and no driver's license demand. Fines run up to $2,663 per violation, or $7,988 if intentional, and only the state collects them: the one private suit is for data breaches.
Regulators are collecting
CalPrivacy announced 2026 penalties for failing to register: Datamasters $45,000, S&P Global $62,600, LocateSmarter $116,490, Cybba $52,400 and SalesIntel $36,400. LocateSmarter also demanded partial Social Security numbers for opt-outs. We found none yet for missed DROP deletions.
Where to find a broker's address
Four states keep public registries, each with contact or opt-out details. A registration is a phone book and gives you no deletion right of its own. New Jersey's registry is due about March 27, 2027, and Connecticut's law requires registration from January 1, 2027, with a state deletion mechanism by July 1, 2028.
People-search sites
- Try the site's free opt-out first. It's usually faster, and the letter is for when that form fails or the listing comes back.
- A registered broker in California should be reached by DROP. A site that isn't registered is worth reporting to CalPrivacy.
- Public records are mostly outside state privacy laws, which is the reason sites give for refusing. The sale of your profile can still be opted out of, and the FCRA is the other lever.
- A site that sells reports for jobs, housing, credit or insurance can be a consumer reporting agency whatever its disclaimer says. The FTC settled on that theory with Spokeo in 2012 ($800,000), Instant Checkmate in 2014 ($525,000) and TruthFinder and Instant Checkmate in 2023 ($5.8 million). Those are settlements, not rulings, and they don't make every such site one.
- Don't send an ID to get an ID off the internet. Give what they need to find you, and ask them to use it only for this request.
Your state's privacy law
20 states have a comprehensive privacy law in force today, counting Florida's narrow one, and 4 more are enacted and waiting: Alabama, Louisiana, Oklahoma, Vermont. In all of them the attorney general or a state agency enforces it, so an ignored request becomes a complaint and not a lawsuit. Where a cure period survives, the company gets time to fix a violation first. The letter fills in your state's law from the state you enter, and a state with no law gets an honest request with no law claimed.
| State and law | Took effect | Deadline | Enforced by | Most per violation | Cure period | Opt-out signal |
|---|---|---|---|---|---|---|
| CaliforniaCal. Civ. Code § 1798.100 et seq.; 11 C.C.R. § 7000 et seq. | Jan 1, 2020 | 45 days, plus 45 | AG and CalPrivacy | $2,663; $7,988 if intentional | No mandatory cure | Required |
| ColoradoC.R.S. § 6-1-1301 et seq. | Jul 1, 2023 | 45 days | AG and district attorneys | Up to $20,000 | Repealed Jan 1, 2025 | Required since Jul 1, 2024 |
| ConnecticutConn. Gen. Stat. §§ 42-515 to 42-526 | Jul 1, 2023 | 45 days | AG | Up to $5,000 per wilful violation | Discretionary since Jan 1, 2025 | Required since Jan 1, 2025 |
| Delaware6 Del. C. ch. 12D | Jan 1, 2025 | 45 days | Department of Justice | Up to $10,000 per wilful violation | Discretionary since Jan 1, 2026 | Required since Jan 1, 2026 |
| FloridaFla. Stat. § 501.72 | Jul 1, 2024 | 45 days | Department of Legal Affairs | Up to $50,000, tripled in some cases such as ignored deletion requests | Discretionary 45 days | Reaches very large companies only |
| IndianaInd. Code art. 24-15 | Jan 1, 2026 | 45 days | AG | Up to $7,500 | 30 days, still applies | Not required |
| IowaIowa Code ch. 715D | Jan 1, 2025 | 90 days | AG | Up to $7,500 | 90 days, still applies | Not required |
| KentuckyKy. Rev. Stat. §§ 367.3611 to 367.3629 | Jan 1, 2026 | 45 days | AG | Up to $7,500 for continued violations | 30 days, still applies | Not required |
| MarylandMd. Code, Com. Law §§ 14-4701 to 14-4714 | Oct 1, 2025; reaches processing from Apr 1, 2026 | 45 days | AG's consumer division | Up to $10,000 | Discretionary 60 days, through Apr 1, 2027 | A link or a signal |
| MinnesotaMinn. Stat. §§ 325M.10 to 325M.21 | Jul 31, 2025 | 45 days | AG | Up to $7,500 | Ended Jan 31, 2026 | Required |
| MontanaMont. Code Ann. § 30-14-2801 et seq. | Oct 1, 2024 | 45 days | AG | Up to $7,500 | Removed Oct 1, 2025 | Required since Jan 1, 2025 |
| NebraskaNeb. Rev. Stat. §§ 87-1101 to 87-1130 | Jan 1, 2025 | 45 days | AG | Up to $7,500 | 30 days, still applies | Opt-outs by agent technology |
| New HampshireN.H. RSA ch. 507-H | Jan 1, 2025 | 45 days | AG | Up to $10,000 | Discretionary since Jan 1, 2026 | Required since Jan 1, 2025 |
| New JerseyN.J.S.A. 56:8-166.4 et seq. | Jan 15, 2025 | 45 days | AG | Consumer Fraud Act penalties | Ended about Jul 1, 2026 | Required from about Jul 15, 2025 |
| OregonORS 646A.570 to 646A.589 | Jul 1, 2024 | 45 days | AG | Up to $7,500 | Ended Jan 1, 2026 | Required since Jan 1, 2026 |
| Rhode IslandR.I. Gen. Laws ch. 6-48.1 | Jan 1, 2026 | 45 days, as reported | AG | $100 to $500 per intentional wrongful disclosure; up to $10,000 under its deceptive practices act | None | Not required, as reported |
| TennesseeTenn. Code Ann. § 47-18-3301 et seq. | Jul 1, 2025 | 45 days | AG | Up to $7,500, trebled if willful | 60 days, as reported | Not required, as reported |
| TexasTex. Bus. & Com. Code ch. 541 | Jul 1, 2024 | 45 days | AG | Up to $7,500 | 30 days, still applies | Opt-outs by agent technology since Jan 1, 2025 |
| UtahUtah Code ch. 13-61 | Dec 31, 2023 | 45 days, plus 45 | AG | Up to $7,500, plus actual damages | 30 days, still applies | Not required |
| VirginiaVa. Code §§ 59.1-575 to 59.1-584 | Jan 1, 2023 | 45 days | AG | Up to $7,500 | 30 days, still applies | Not required |
| AlabamaAla. HB 351 (2026) | Starts May 1, 2027 | 45 days | AG | Up to $15,000, only after a failure to cure | 45 days | Unsettled |
| LouisianaLa. Act 502 (2026) | Starts Jan 1, 2027 | 45 days | AG | Unfair trade practices penalties | 30 days, through Jul 31, 2027 | Opt-outs by agent technology |
| OklahomaOkla. SB 546 (2026) | Starts Jan 1, 2027 | 45 days | AG | Up to $7,500 | 30 days | Not required |
| VermontVt. Act 145 (2026) | Starts Jan 1, 2028 | 45 days | AG | Up to $10,000 per act | 60 days, through Jun 30, 2029 | Required |
None of these laws gives you a private suit for an ignored request, apart from California's breach claim. Some entries rest on secondary trackers, and Delaware, Connecticut and others changed this year, so read the statute. Checked 31 October 2026.
Credit bureaus and specialty reports: the FCRA
If a company sells reports used for credit, insurance, jobs or housing, the Fair Credit Reporting Act applies, and here the deadlines are federal.
Dispute with the bureau
A consumer reporting agency must finish a free reinvestigation within 30 days of receiving your dispute, extendable up to 15 days if you send more in that time. After the bureau passes it on, the furnisher must investigate and fix or block what it can't verify. Send it to the bureau as well as the lender: a dispute sent only to the lender doesn't support a private suit.
Age limits
Reports generally can't include collections and other adverse items older than seven years, or bankruptcies older than ten. Exceptions cover credit or life insurance of $150,000 or more and jobs paying $75,000 or more. Convictions aren't limited.
Freezes and fraud alerts
Security freezes are free: within 1 business day of a phone or online request, 3 of a mailed one. A fraud alert lasts at least a year, seven years for identity theft victims with a report. Information from identity theft is blocked within 4 business days of the right papers. A freeze limits access; it deletes nothing.
Pre-approved offers
Opt out of prescreened credit and insurance lists at optoutprescreen.com or 1-888-5-OPT-OUT for five years. For the permanent opt-out, start there and return the signed election form they issue: a letter you wrote yourself isn't the named method.
Email, junk mail, DMV records, health data and the rest
Each of these has its own rule, and some are narrower than people think. The last column says what a letter can do.
| The list | Your right | Where a letter fits |
|---|---|---|
| Marketing email15 U.S.C. §§ 7704(a)(3)-(4), 7706 | Every commercial email needs a working opt-out for at least 30 days. The sender must stop within 10 business days and can't sell your address. The FTC, states and internet providers enforce it, and the law doesn't list individual recipients among those who may sue. | Rarely needed. The unsubscribe link is the named route. |
| Junk postal mailDMAchoice FAQ (private program) | No general federal right. DMAchoice, an industry program, costs $8 online or $9 by mail for 10 years and takes up to 90 days. It leaves out current customers, political mail and prescreened offers. | A mailing-list removal letter asks a sender directly. It's a request, and the template says so. |
| Sexually oriented ads39 U.S.C. §§ 3008, 3010; DMM 508.9-10 | A USPS Prohibitory Order, on PS Form 1500 at any Post Office with the ad and its envelope. It takes effect on the 30th day after the sender receives it. It isn't a general junk mail remedy, though some sites say so. | Not this. File with USPS, which is also adding an electronic form. |
| Pre-approved credit offers15 U.S.C. § 1681b(e) | Five years at optoutprescreen.com or 1-888-5-OPT-OUT. Permanent with the signed form they issue, which lasts until you cancel it. | Use their form. Your own letter isn't the named method. |
| DMV records18 U.S.C. §§ 2721, 2724 | State DMVs can't release your record except for listed uses, and bulk marketing needs your consent. A knowing misuse allows a suit with liquidated damages of at least $2,500. It's not a deletion right. | Evidence for a claim, not a way to remove anything. |
| Children's data15 U.S.C. § 6502; 16 C.F.R. § 312.6 | A parent can refuse further use and direct deletion of data from a child under 13, on child-directed sites or where the operator knows. The amended rule's compliance date was April 22, 2026. | A parent's written request works, and the operator must verify you're the parent. |
| Banks and insurers15 U.S.C. § 6802 | You can opt out of sharing with non-affiliates. It doesn't let you delete bank records, and many kinds of sharing are outside it. | Use the opt-out in their privacy notice. |
| Health records45 C.F.R. §§ 164.522, 164.526 | HIPAA gives amendment, not deletion: a response in 60 days, plus one 30-day extension. You can ask for limits, though the provider usually needn't agree unless you paid in full. | A written amendment request to the provider or plan. |
| Health data in apps (Washington)RCW 19.373.040, .090 | My Health My Data lets you delete consumer health data within 45 days, plus a 45-day extension, with a route to suit through the Consumer Protection Act. | A written deletion request, with a date to point to. |
| Biometrics (Illinois)740 ILCS 14/20; P.A. 103-769 | A private suit with $1,000 per negligent or $5,000 per reckless or intentional violation. Repeated collection by one method now counts once (Clay v. Union Pacific, 7th Cir. 2026). | Evidence and a request, ahead of a claim. |
| Sale of your data (Nevada)NRS 603A.345, 603A.360 | Website operators must offer a designated address for requests not to sell, and respond within 60 days, plus 30. Only the attorney general enforces it, up to $5,000 per violation. | Send it to the designated address they name. |
| Intimate imagesTAKE IT DOWN Act, Pub. L. 119-12, § 3 | Covered platforms must remove nonconsensual intimate images within 48 hours of a valid request, signed physically or electronically. The FTC has enforced this since May 19, 2026, at up to $53,088 per violation, and takes complaints at TakeItDown.ftc.gov. | Use the platform's own request channel: it's the fastest valid route. |
| Federal judgesDaniel Anderl Act, Pub. L. 117-263, § 5934 | A person or business that gets a written request must remove a covered judge's information from the internet within 72 hours, and data brokers can't sell it. News and voluntarily published information are excepted. | A written request is the trigger, so a delivery record marks the start. |
| California public officialsCal. Gov. Code §§ 7928.205, 7928.215 | A business that gets an official's written demand must take down a home address or phone within 48 hours. An elected official's demand lasts four years. Confirm the current text before relying on it. | A written demand is the trigger. |
| Foreign adversaries15 U.S.C. § 9901 | Data brokers can't sell Americans' sensitive data to foreign adversary countries or entities they control. The FTC enforces it, and it gives you no removal right. | None. It's a complaint for the FTC. |
Certified Mail isn't always the first step. Here is when it earns its price.
We'd rather you use the free route when it works. A letter is for when it doesn't, and for the times the law asks for writing.
| The route | Use it when | The catch |
|---|---|---|
| National Do Not Call Registry | Do this first, for free. It stops most sales calls within about 31 days and never expires. | Exempts debt collectors, charities, politics and recent customers. |
| Reply STOP | Do this for any text. Florida requires it before you can sue over sales texts, and Virginia names it as the text opt-out. | From November 25, 2026, it may be the caller's only accepted method. |
| The company's privacy form | The designated method under most privacy laws, so it starts the clock cleanly. Screenshot it. | You have only a screenshot, and forms break, loop and ask for your ID. |
| California DROP | One free request to every registered broker, if you live in California. | Registered brokers only, and status updates can take up to 90 days. |
| Certified letter | When the free route failed or doesn't exist, when the law says written, when you want a dated record before a complaint or a claim, or when a collector needs written notice. | Costs money, takes days, and doesn't force a business to process it where it named another method. |
Where the law itself asks for writing
In these, the letter isn't just evidence. It's the step that starts something, and in California's case the statute names certified or registered mail.
Debt collectors
A written stop notice. By mail, it's complete on receipt, so the delivery date is the date that counts. A collector's message sent while your letter is in the mail doesn't break the rule.
California consumer claims (CLRA)
30 days' written notice before suing for damages, by certified or registered mail, return receipt requested, to the place of the transaction or the California principal place of business.
Massachusetts (Chapter 93A)
A written demand mailed or delivered at least 30 days before filing. A reasonable written offer in those 30 days can cap what you recover.
Texas (DTPA)
Written notice at least 60 days before a damages suit, describing the complaint and what you seek.
Georgia (FBPA)
A written demand delivered at least 30 days before suit, with the same tender rule.
Maine (UTPA)
A written demand mailed or delivered to the last known address at least 30 days before a damages action.
New Jersey (Daniel's Law)
Written notice from an authorized person starts the 10 business days. Covered persons only, and the law is under a First Amendment challenge.
California small claims
The form says to ask for payment before you sue, in person, by phone or in writing. A letter gives you the record.
The deadline runs from the day they receive it
Every clock here starts on receipt, not on the day you sent it. That's the reason to want a delivery record, and the reason to wire it to a webhook.
| On receipt | A debt collector's stop notice15 U.S.C. § 1692c(c) |
| 10 business days | Company do-not-call request; revocation of consent; Daniel's Law notice; a CAN-SPAM opt-out47 C.F.R. § 64.1200(a), (d)(3); N.J.S.A. 56:8-166.1; 15 U.S.C. § 7704(a)(4) |
| 15 business days | California opt-out of sale or sharing, at the outside11 C.C.R. § 7026(f)(1) |
| 30 days | Credit report reinvestigation, sometimes 45; a debt validation dispute must be sent within 30 days of the notice15 U.S.C. §§ 1681i(a)(1), 1692g(b) |
| 45 days | Deletion under most state privacy laws, and each DROP cycleSee the state table; Cal. Civ. Code § 1798.99.86 |
| 60 days | A health record amendment under HIPAA; Nevada's sale opt-out45 C.F.R. § 164.526; NRS 603A.345 |
| 90 days | California and Utah when extended; Iowa's own deadline11 C.C.R. § 7021(b); Iowa Code ch. 715D |
A green card proves an envelope arrived. It doesn't prove what was in it.
USPS records cover the outside of the envelope. Staff at our facility in Manhattan Beach, CA photograph the inside: the pages, and the envelope they went into.
| The record | What it shows | Its limit |
|---|---|---|
| USPS mailing receipt | A piece with this number was mailed on this date. | Not that it arrived, or what was in it. |
| USPS delivery record | Delivery or attempted delivery, with the recipient's signature on file. Direct evidence of who received it and when. | USPS lists Certified records as kept for two years, so download yours early. |
| Electronic return receipt | Who received it, when, and the actual delivery address. | Also kept two years. Retrieval takes longer after 60 days. |
| Our photos of the pages and the sealed envelope | What was printed, and the envelope and label it went into. No USPS record covers this. | We keep only blurred previews, so save the photos when they arrive. |
| The mailbox rule | A properly addressed letter is presumed to have arrived. In the Third Circuit, certified mail supports a stronger presumption than regular mail, and a sworn denial alone can defeat the regular-mail one. | A presumption, not a record, and courts differ. Hagner v. United States (1932); Lupyan v. Corinthian Colleges (3d Cir. 2014). |
What you get, step by step
| 01Before it prints | A dry run gives the exact price and a preview. With approval on, nothing prints until you say so. |
| 02Printed and sealed | Staff photograph the printed pages and the sealed envelope with its label. mail.ready fires, and GET /v1/mail/:id returns the photos. |
| 03Matched | A photo of each prepared letter must match the order's own first page and postage label before it can be marked ready, so your letter can't leave under another order's label. |
| 04Handed over | The mailing date, the certified number and a photo of the receipt. mail.mailed fires. |
| 05Delivered | The USPS delivery scan, and the return receipt's record of who signed. mail.delivered fires, and your clock starts. |
| 06Kept private | Your file is encrypted at rest and deleted once the piece is mailed, so keep your own copy. |
The seven parts of a clear letter
- 1Your name and return address. Use a mailing address you're happy for them to hold. A mailbox.bot address ($15/mo) keeps your home address off the envelope, and replies reach your agent as scanned mail.
- 2The date. It should match the day it goes out. Your delivery record does the real work.
- 3How it was sent. "Via USPS Certified Mail, Return Receipt Requested" tells a mailroom this one is being tracked.
- 4The right desk. The privacy or compliance contact in their privacy policy, then the contact in a state broker registry. A registered agent, listed by the Secretary of State, accepts court papers and is a fallback, not a privacy channel.
- 5A subject line that names the law. It helps get the letter routed. "Do-not-call request under 47 C.F.R. § 64.1200(d)(3)" means something to a compliance desk. "Stop calling me" doesn't.
- 6The facts, the request and the date. Which number, which calls, what you want done and by when. Identifiers only as needed. Ask for written confirmation, and ask for the do-not-call policy, which they must provide on demand.
- 7Your signature. A typed name prints as is. To sign by hand, sign and scan the page, then upload the PDF. It goes out in your name, and you can read every word first.
What to leave out
- Any threat of police, prosecution, jail, exposure or publicity. Stick to the statute and your civil remedies.
- A demand for money next to a mention of reporting them to an agency. Keep complaints and money apart.
- Your Social Security number, a photo of your ID, or anything else the request doesn't need.
- Claims you can't back up, such as a date you never registered or calls you didn't log.
The day after the clock runs out
Your record makes the next step easy to show. Send a second letter if there's a reason to think the first was misrouted, then file. A complaint is free, and regulators read patterns, even when they can't act on yours alone.
FCC Consumer Complaint Center ↗
Unwanted calls and texts. The FCC doesn't resolve individual complaints: it uses them for policy and enforcement.
FTC: DoNotCall.gov and ReportFraud ↗
Report sales calls to registered numbers at DoNotCall.gov, and scams or money lost at ReportFraud.ftc.gov.
CFPB ↗
Debt collection, credit reports and other financial products. It sends your complaint to the company, which generally responds in 15 days.
CalPrivacy ↗
CCPA and Delete Act complaints from Californians. It doesn't represent you individually.
Your state attorney general ↗
The one who enforces your state's privacy law in nearly every state. The NAAG directory lists them all.
Small claims or a lawyer
A court decides what a violation is worth. These laws don't require a lawyer to send a notice, but a lawyer can advise on your facts and on suing.
Let your agent watch the list and keep the clock
Every step in this page has a machine shape. Connect Claude, ChatGPT, your IDE or your agent harness over MCP or REST: it finds the listing or reads the call log, fills in a template, prices the letter and waits for your approval, then tracks the deadline by webhook.
Start in one minute, with no key
Paste the prompt into Claude, ChatGPT, your IDE or your agent harness, or call the templates yourself. The catalog is JSON, the PDFs come from the same fixed wording as this page, and no AI runs on that route: your agent supplies the values, and a missing blank answers 422 with the list.
Help me get off call lists and data broker lists.
Read this first:
https://mailbox.bot/use-cases-do-not-call-list-request-letter.md
1. Ask who keeps calling or where my data is listed.
Log the dates.
2. Use the free route first: the registry, STOP, the
company's form, California's DROP.
3. If that fails, GET the catalog at
https://mailbox.bot/api/v1/letter-templates
Let me pick the letter, then POST my details to
render it. Keep the wording exactly as written.
4. Show me the letter and the price. Mail nothing
until I approve it.
5. If I have no mailbox.bot key, POST the PDF to
/api/v1/mail-drop and give me the signup link.
6. With a key, send it Certified with a return
receipt and requires_approval=true.
7. On mail.delivered, set the deadline from the
template, check again after it, and tell me.
File nothing on your own.# Every letter, its blanks, its law, its deadline. No key.
curl https://mailbox.bot/api/v1/letter-templates
# A finished PDF from the fixed wording. Nothing is kept.
curl -X POST \
https://mailbox.bot/api/v1/letter-templates/do-not-call \
-H "Accept: application/pdf" \
-H "Content-Type: application/json" \
-o do-not-call-sunrise-solar.pdf \
-d '{"values":{
"phone_number":"310-555-0142",
"contact_dates":"October 1, 8 and 14, 2026",
"sender_name":"Dana Reyes",
"sender_line1":"88 Elm St",
"sender_city":"Torrance",
"sender_state":"CA",
"sender_zip":"90501",
"recipient_name":"Sunrise Solar LLC",
"recipient_line1":"100 Congress Ave",
"recipient_city":"Austin",
"recipient_state":"TX",
"recipient_zip":"78701"}}'
# In the catalog, each letter carries its clock:
# "deadline": {"days":10,"unit":"business_days",
# "from":"receipt","cite":"47 C.F.R. § 64.1200(d)(3)"}No account yet? Send it to the mail drop
An agent with no key can POST a document to /api/v1/mail-drop. It reads the file in memory, keeps nothing and mails nothing, and always answers 401, so nothing written against it can mistake the answer for mailed. The reply gives your agent the page count, the SHA-256, a price estimate and the sentence to tell you, with the signup link. You sign up and create a key, and it sends the same file with requires_approval=true, so it lands in your Outbound list waiting for you. Credits are only needed to approve it.
# No key, no account. Nothing is mailed and nothing is kept.
curl -i -X POST https://mailbox.bot/api/v1/mail-drop \
-F "document=@do-not-call-sunrise-solar.pdf"- 01Your agent renders a letter, or brings its own PDF, and posts it with no key to the mail drop.
- 02It gets the 401, with
human_signup_required, and tells you what the reply says to tell you. - 03You open the link. The signup page says your agent sent something and that nothing has been mailed.
- 04You verify your email and phone, add a return address and credits, and create an agent key under API Keys.
- 05Your agent sends the same file to
POST /api/v1/mail. The hash in the first reply lets it prove it's the same one.
HTTP/1.1 401 Unauthorized
{
"error": "A person needs to sign up before
this can be mailed.",
"reason": "human_signup_required",
"mailed": false,
"stored": false,
"document": {
"filename": "do-not-call-sunrise-solar.pdf",
"format": "pdf",
"pages": 1,
"sha256": "3fa9c1…"
},
"signup_url": "https://mailbox.bot/signup?
intent=outbound&from=agent-drop",
"relay_message": "I tried to mail … Sign up here …"
}With a key: price it, send it, get told when it lands
A letter your agent sends with requires_approval=true lands in the same Needs Approval list as one you wrote on this page: one queue for people and agents, encrypted at rest, and no credits spent until you approve it. Over MCP: get_mailbox_md, then send_outbound_mail with dry_run=true, then the same call with requires_approval=true, and get_outbound_mail for status and photos. An agent can't buy credits.
# Price it first: nothing is created or charged
curl -X POST https://mailbox.bot/api/v1/mail \
-H "Authorization: Bearer $MAILBOX_AGENT_KEY" \
-H "X-Mailbox-MD-Version: $MAILBOX_MD_VERSION" \
-F "document=@do-not-call-sunrise-solar.pdf" \
-F "recipient_company=Sunrise Solar LLC" \
-F "recipient_line1=$STREET" \
-F "recipient_city=$CITY" \
-F "recipient_state=$STATE" \
-F "recipient_zip=$ZIP" \
-F "mail_class=certified_return_receipt" \
-F 'metadata={"case":"dnc-0142","kind":"dnc",
"law":"47 CFR 64.1200(d)(3)"}' \
-F "dry_run=true"
# Then send it with requires_approval=true.
# It waits in Needs Approval. mail.pending_approval fires.curl -X POST https://mailbox.bot/api/v1/webhooks/endpoints \
-H "Authorization: Bearer $MAILBOX_AGENT_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"removal-clock",
"url":"https://you.example/hooks/mail",
"agent_id":"'$MAILBOX_AGENT_ID'",
"environment":"live",
"event_types":["mail.mailed","mail.delivered",
"mail.failed"],
"rules":[]}'The signing secret is shown once. Each event carries mail.id, status, carrier, tracking_number, mailed_at, delivered_at, error_message and your metadata, with api_url for the rest.
Start the clock from the delivery event
import { createHmac, timingSafeEqual } from "node:crypto";
// Calendar days from delivery, from the table on this page.
const CLOCK = { dnc: 14, delete: 45, dispute: 30 };
export async function POST(req: Request) {
const raw = await req.text();
const id = req.headers.get("webhook-id")!;
const ts = req.headers.get("webhook-timestamp")!;
const sigs = req.headers.get("webhook-signature")!;
// Standard Webhooks v1: HMAC-SHA256 over id.timestamp.body
const key = Buffer.from(process.env.MAILBOX_WHSEC!.slice(6), "base64");
const want = createHmac("sha256", key).update(`${id}.${ts}.${raw}`).digest();
const good = sigs.split(" ").some((s) => {
const got = Buffer.from(s.split(",")[1] ?? "", "base64");
return got.length === want.length && timingSafeEqual(got, want);
});
const fresh = Math.abs(Date.now() / 1000 - Number(ts)) < 300;
if (!good || !fresh) return new Response("bad signature", { status: 401 });
const event = JSON.parse(raw);
if (event.event_type === "mail.delivered") {
const { id: mailId, delivered_at, tracking_number, metadata } = event.mail;
const due = new Date(delivered_at);
due.setDate(due.getDate() + CLOCK[metadata.kind]);
// Keyed by webhook-id, because deliveries can repeat.
await cases.upsert(id, { case: metadata.case, mailId, tracking_number, delivered_at, due });
}
return new Response(null, { status: 204 });
}## Removal letters
- Free route first: registry, STOP, the
company's form, DROP. Log the date.
- Use the template as written. Fill the
blanks. Never change the legal wording.
- Never add police, prosecutors, publicity
or a threat of any kind.
- certified_return_receipt, addressed to the
privacy or compliance contact.
- requires_approval=true on every letter,
with case, kind and law in metadata.
- On mail.delivered, set the date: 10
business days for do-not-call, 45 days
for deletion, 30 for a credit dispute.
- After that date, check again and tell me.
File nothing on your own.Rehearse the whole loop for free
Prove your deadline code before you mail anything. Create a Sandbox webhook (environment: test), then walk a test letter to delivered with a sandbox key (sk_agent_test_). Your receiver gets the same events a real letter sends. Over MCP, it's create_test_outbound_mail and advance_test_outbound_mail.
# A sandbox key mails nothing and costs nothing.
curl -X POST https://mailbox.bot/api/v1/test/mail \
-H "Authorization: Bearer $MAILBOX_SANDBOX_KEY" \
-H "Content-Type: application/json" \
-d '{"recipient_company":"Sunrise Solar LLC",
"mail_class":"certified_return_receipt",
"metadata":{"case":"dnc-0142","kind":"dnc"}}'
# Walk it forward: submitted, ready, mailed, delivered.
# Each call fires your webhook, ending in mail.delivered.
curl -X POST \
https://mailbox.bot/api/v1/test/mail/$MAIL_ID/advance \
-H "Authorization: Bearer $MAILBOX_SANDBOX_KEY"Four jobs an agent can run, with a person signing off
Spam call to suppression record
A call log or voicemail transcript names the caller. The agent fills in the do-not-call template, prices it and asks you. On delivery it sets a date 10 business days out and logs any later call against it, with the date and the number.
People-search watch
The agent checks a list of URLs for your name each week. A new listing gets the free form first, then a letter if it's still there. On day 46 it checks again, and either closes the case or tells you.
The reply comes back
With a mailbox.bot return address, the broker's answer arrives as scanned mail. A keyword rule on "privacy" or "verification" pings your webhook, and the agent reads the page text and updates the case.
A privacy team's queue
One Certified letter per client and broker, each tagged with the client and the law. A person approves each one, and the mailing dates and delivery records file themselves. Batch mail is First-Class from 10 pieces, so Certified letters go one at a time.
Your agent isn't your authorized agent
Under the CCPA regulations, an authorized agent is a person or business you authorized, with signed permission a company can ask to see, and those rules don't mention software. No authority we found addresses this directly, but on the text, someone who signs and sends their own request using software appears to remain the requester. So the letter goes out in your name and over your signature, your agent only prepares it, and we only print and mail it. Acting for someone else is a different job with its own rules (Cal. Code Regs. tit. 11, §§ 7001(d), 7063).
For anyone with a list they want off of
Anyone a seller won't stop calling
You're on the registry and the calls keep coming, or a company you bought from once won't let go. Fill in the letter and we'll mail it, with a dated record behind you.
People who found themselves online
Your name, address and phone on a people-search site, your relatives listed beside you, and a removal form that loops. Take the free route first, and then put it in writing.
Judges, officers and their families
New Jersey's Daniel's Law turns on a written notice, and federal judges have the Daniel Anderl Act. A delivery record marks the day the 10 business days began.
Privacy teams and lawyers
Client requests sent by Certified with per-client metadata, proof that files itself, and a person approving each piece. You choose the law and the letter, and we handle the mail.
Families helping someone
A parent for a child, an adult child for an elderly parent. DROP lets you submit for another California resident, and a letter can go out in their name, over their signature.
Developers with an agent
Connect Claude, ChatGPT, your IDE or your agent harness over MCP or REST. It watches the call log or the listing, drafts from a template, and tracks each clock by webhook.
A checklist for your letter
- Free route first: the registry, STOP, the company's form, DROP. Note the date you did each.
- A call log: date, time, the number that called, who they said they were.
- The address from their privacy policy or a state broker registry, checked against the Secretary of State's listing.
- The seller, the telemarketer and any brand or affiliate you want covered, named in the letter.
- Only the identifiers they need. No Social Security number and no ID copy.
- Your own copy of the PDF, because we delete the file after it's mailed.
- A named person on the envelope if you want Restricted Delivery: USPS requires one, so it won't fit a letter addressed only to a company.
- Send it early enough. Every deadline here runs from when they receive it.
What we don't do
- Legal advice. We're a printing and mailing fulfillment service, so we don't tell you which letter or law fits your facts. You choose the letter.
- Writing in our own name, signing for you, or acting as your authorized agent.
- Filing complaints or lawsuits, or removing you from any list ourselves. We print and mail what you send.
- Guarantee any outcome. A letter can start a clock and create a record. It isn't a court order, and a company may still ignore it or refuse.
- Mail outside the United States.
Do not call and data removal letters, answered
What is a do not call list request letter?
A written request telling a company to stop calling your number and add it to its own do-not-call list. FCC rule 47 C.F.R. § 64.1200(d)(3) gives a telemarketer at most 10 business days from receipt, and the request lasts five years.
Do I need one if I'm on the National Do Not Call Registry?
Register first: it's free at DoNotCall.gov and never expires. A letter fills the gaps. Companies you recently did business with can call a registered number until you tell them to stop, and a company-specific request ends that relationship. A letter also gives you a dated record if the calls keep coming.
How long does a company have to stop calling?
At most 10 business days from receiving your request under the FCC's rule, and calls to a newly registered number can continue for up to 31 days. Debt collectors are different: a written stop notice takes effect when they receive it.
Will a letter stop robocalls and texts I once agreed to?
Reply STOP as well. Today you can revoke consent by any reasonable method, honored within 10 business days. From November 25, 2026, a caller can name an automated opt-out, a reply text, or its website or phone number as the exclusive way, and need not process anything else. If it names none, any reasonable means still works, and a dated letter is your evidence. Our letter is also a company do-not-call request, which that order doesn't amend.
Can I sue over unwanted texts?
It depends on where you are. The Seventh Circuit held in 2026 that the do-not-call suit in § 227(c)(5) doesn't reach texts, and other federal courts are divided. The robocall section, § 227(b), has been read to cover texts, and some state laws such as Florida's, Texas's and Connecticut's cover them expressly. In Florida you must reply STOP and wait 15 days first.
Will they face charges if they ignore my letter?
Generally not criminal ones. These are civil claims a court decides, and regulatory penalties an agency collects: up to $500 per violation under the do-not-call section, $1,000 per action under the FDCPA, and state fines under privacy laws. A few narrow criminal provisions exist, but we found none that makes an ignored removal letter generally a crime.
Can my letter threaten to report them to the police?
Don't. In California, a letter threatening to accuse someone of a crime to get money can be extortion, whoever sends it, and Flatley v. Mauro held one lawyer's letter was exactly that. Name the statute and your civil remedies, and keep any request for money apart from any mention of a complaint. Our templates do.
Is mailbox.bot a law firm? Do you guarantee the result?
No to both. We're a printing and mailing fulfillment service: we print, envelope, label and mail what you send, and we don't review it for legal sufficiency. The templates aren't legal advice, no outcome is guaranteed, and you use them at your own risk. You choose the letter, and it goes out in your name.
Do I need a lawyer to send one?
These laws don't require a lawyer to send this notice. A lawyer can advise on your facts and on suing, and our templates aren't a substitute for that advice.
Does a data broker have to delete my data if I mail a letter?
Not automatically. In California, a request sent outside the methods a business designated must either be treated as submitted or answered with how to submit it. The right to delete reaches data collected from you, so a broker that bought your data may rely on the right to stop its sale instead. Use the company's form and DROP first. Other states' laws are enforced by attorneys general, and only some reach brokers fully.
What is California's DROP?
The Delete Request and Opt-out Platform, free at privacy.ca.gov/drop for California residents. One request reaches every registered data broker. Since August 1, 2026, brokers must check it at least every 45 days and delete within 45 days of receipt, or owe $200 per request per day.
Who do I address the letter to?
The privacy or compliance contact in the company's privacy policy first, then the contact in a state data broker registry. A registered agent, listed by the Secretary of State, accepts court papers and is a fallback. For calls, write to the seller and to the telemarketer if you know it.
Is Certified Mail required?
Rarely. California's CLRA names certified or registered mail, return receipt requested, for its 30-day notice. Other laws say written, or any reasonable means. Certified is what gives you a mailing receipt and a delivery record, and on these laws the clock usually runs from receipt.
Does Certified Mail prove what was in the envelope?
No. USPS records show the piece was mailed and who received it. So keep your copy, and save the photos we take of the printed pages and the sealed envelope. We keep only blurred previews after that.
What's the difference between Certified and Restricted Delivery?
Restricted Delivery directs delivery only to the addressee or their authorized agent, and USPS requires the addressee to be a named person. It doesn't fit a letter addressed only to a company. It adds $10.00 here when you name a person.
What does the AI do with what I type?
It copies your details into the blanks of the letter you chose, and that's all. You pick the letter, and its wording is fixed and sourced, so the AI can't invent a law or word a threat. Your text goes through our AI provider to a model that keeps no copy and doesn't train on it, and we don't save it. You can skip AI and fill in the blanks yourself.
Where does my file go when I upload it?
Before you have an account, it stays in your browser, so nothing reaches our servers. You can remove it at signup, which is worth doing on a shared computer, and a draft older than 24 hours is wiped the next time you visit. Once you sign up, your letter lands in your Outbound list as Needs Approval, whether you wrote it here or uploaded it. If you skipped the address or the service, it waits in the send form until you add them. From there it's encrypted at rest with its own key and deleted after the piece is mailed.
What happens after I sign up?
Your letter is in your Outbound list as Needs Approval, with the address and service you picked. Nothing is charged until you approve it, and you can add credits at that point or cancel it. It stays there until you approve or cancel, and we send a reminder. If you skipped the address or the service, it's attached in the send form instead, and the same happens if you sign in to an account you already had.
Why do I have to sign up to send it?
The mail goes out from an account in your name: a verified email and phone, a return address and accepted terms, which takes about five minutes. There's no card to join, and you add credits before live mail.
Can my AI agent send the letter?
Yes, once you have a key. Without one, it can POST the file to /api/v1/mail-drop, and the reply says a person needs to sign up and gives it the link to pass on. With a key, it prices each letter with a dry run and sends it with requires_approval=true, so it waits in the same Needs Approval list as a letter you wrote here. You approve it, and the certified number and delivery date come back by webhook. The letter is still yours: it goes out in your name.
Is there an API for the templates?
Yes, and it needs no key. GET /api/v1/letter-templates lists each letter, its blanks, its law, a machine-readable deadline and the state privacy laws. POST /api/v1/letter-templates/{id} with your details returns a finished PDF from the fixed wording, and it keeps nothing. No AI runs on that route: your agent supplies the values.
Can I test this without mailing anything?
Yes. A sandbox key (sk_agent_test_) with POST /api/v1/test/mail and its advance route walks a letter from submitted to delivered and fires each webhook, for free, with nothing mailed. So you can prove your deadline code before you send a real letter.
Can I send the same letter to many brokers?
Yes: one letter per broker. On this page, write each one and up to 10 wait in your browser, and each lands as its own order when you sign up. Certified letters go one at a time through the send form or POST /v1/mail, so each has its own number and clock. Batch mail runs First-Class from 10 pieces, with no USPS delivery record.
How much does it cost?
The templates are free. For one black-and-white page: Certified Mail $20.00, Certified with an electronic return receipt $24.00, First-Class $2.00. Each extra page adds $0.40 plus any postage increase. A mailbox.bot return address is $15/mo. You see the exact price before you pay.
- 47 U.S.C. § 227, the Telephone Consumer Protection Act
- 47 C.F.R. § 64.1200, the FCC's telemarketing and robocall rules
- FCC 26-67, revocation of consent order (effective Nov. 25, 2026)
- 16 C.F.R. § 310.4, the Telemarketing Sales Rule
- FTC: National Do Not Call Registry FAQs
- 15 U.S.C. § 6104, private telemarketing suits
- FTC notice on 2026 civil penalty amounts
- Steidinger v. Blackstone Medical Services (7th Cir. 2026)
- McLaughlin Chiropractic v. McKesson (U.S. 2025)
- Facebook v. Duguid (U.S. 2021)
- Howard v. Republican National Committee (9th Cir. 2026)
- Bradford v. Sovereign Pest Control (5th Cir. 2026)
- Insurance Marketing Coalition v. FCC (11th Cir. 2025)
- In re Dish Network, FCC 13-54 (2013)
- Mims v. Arrow Financial Services (U.S. 2012)
- 15 U.S.C. § 1692c, debt collector communications
- 15 U.S.C. § 1692k, debt collector liability
- Regulation F, 12 C.F.R. § 1006.6 and its commentary
- 12 C.F.R. § 1006.14, harassment and call frequency
- 15 U.S.C. § 1681i, credit report reinvestigation
- 15 U.S.C. § 1681b, prescreened lists
- 15 U.S.C. § 1681c, age limits on report items
- 15 U.S.C. § 1681c-1, fraud alerts and freezes
- 15 U.S.C. § 1681n, willful noncompliance
- 15 U.S.C. § 1681a, consumer reporting agency definition
- TransUnion v. Ramirez (U.S. 2021)
- Spokeo v. Robins (U.S. 2016)
- FTC: Spokeo settlement (2012)
- FTC: TruthFinder and Instant Checkmate (2023)
- CFPB withdrawal of the data broker rule, 90 Fed. Reg. 20568
- CalPrivacy: the Delete Request and Opt-out Platform
- CalPrivacy: DROP FAQ (Oct. 6, 2026)
- Cal. Civ. Code § 1798.99.86, DROP duties
- CCPA regulations, effective Jan. 1, 2026
- CalPrivacy: current CCPA dollar amounts
- California data broker registry
- Oregon data broker registry
- 9 V.S.A. § 2446, Vermont data brokers
- Connecticut Public Act 26-64
- New Jersey P.L. 2026, c. 25, data broker law
- State privacy law count (a tracker, 2026)
- Atlas Data Privacy v. We Inform (N.J. 2026), Daniel's Law
- Daniel Anderl Act, Pub. L. 117-263
- TAKE IT DOWN Act, Pub. L. 119-12
- 15 U.S.C. § 7704, CAN-SPAM
- 39 U.S.C. § 3008, prohibitory orders
- DMAchoice FAQ
- USPS Domestic Mail Manual 503, extra services
- USPS: Electronic Return Receipt
- Cal. Civ. Code § 1782, CLRA notice
- Mass. G.L. c. 93A, § 9
- Tex. Bus. & Com. Code § 17.505
- 5 M.R.S. § 213, Maine
- California small claims form SC-100
- Cal. Penal Code § 519
- Flatley v. Mauro (Cal. 2006)
- Hagner v. United States (U.S. 1932)
- Fla. Stat. § 501.059
- Va. Code § 59.1-514
- RCW 80.36.390, Washington
- Texas S.B. 140 (2025)
- FCC: how complaints are handled
- NAAG: find your attorney general
Last checked against these sources on 31 October 2026. Where an official site blocks automated reads, we used a named mirror or a law firm's summary, so read the statute itself before relying on it.
Disclaimer. mailbox.bot is a printing and mailing fulfillment service. We print, envelope, label and mail the documents you send us, and we don't review them for legal sufficiency. We are not a law firm, and nobody at mailbox.bot acts as your lawyer. This page, the templates, the letter desk and its AI step are general information and self-help tools, provided as is. They are not legal advice and not a substitute for the advice of an attorney, and using them doesn't create an attorney-client relationship. You choose the letter, and you are responsible for what it says, who it goes to, whether it's accurate and whether it's right for your situation. We don't guarantee any outcome: not that a company will comply, stop calling, delete your data or pay you, not that a letter meets a legal requirement or a deadline, and not that a delivery record or a photo will be accepted as evidence. You use all of this at your own risk. Laws change and courts disagree, so check the current rule, and talk to a lawyer about your facts, before you rely on anything here. mailbox.bot isn't affiliated with or endorsed by the FCC, FTC, CFPB, USPS, CalPrivacy or any state agency. Mail you send through us is covered by our Terms of Service, including Section 9B.
Put it in writing. We'll put it in the mail.
Fill in a free template or upload your own. Staff in Manhattan Beach, CA print it, mail it Certified and photograph every step.
mailbox.bot is a printing and mailing service, not a law firm. Templates aren't legal advice or a substitute for the advice of an attorney, no outcome is guaranteed, and you use them at your own risk.