Sometimes telemarketing calls are random. Other times, companies trick you into sharing your information so they can sell it to the callers who reach you, the FTC has explained. If the calls came from a form you filled out, blocking the next caller doesn't solve the underlying problem your number is already in circulation.

Sites offering free quotes, discount coupons, warranty comparisons, or sweepstakes entries are often not actually in those businesses. Their product is your contact information. When you enter your phone number, the site owner may sell it simultaneously to multiple telemarketers, with no notification to you. Think of it like a mortgage broker who doesn't lend money: their value is connecting two parties. Except in this case, one of those parties is you, and you weren't told you were in the transaction.

In many cases, a data broker sits between the lead-generation site and the caller. Data brokers are companies that aggregate personal information from public records, social media profiles, online activity, and competitors, then sell it onward. An NSF-funded study by UC Irvine researchers, published a year ago, described this industry as operating "largely in a surreptitious manner," with brokers inferring purchasing behavior, health conditions, and financial status from the data before monetizing it (UC Irvine, July 2025). Your phone number may pass through one or more of these intermediaries before reaching the caller which is partly why it's so difficult to trace a spam call back to a specific form you completed.

The FTC's action against Citizens Disability shows how this works at scale. The agency charged that the company bought consumer contact data sourced from coupon and sweepstakes-style websites, then used it to allegedly place millions of illegal telemarketing calls, including robocalls. The company also allegedly told recipients they were being contacted because of a recent inquiry they'd made about Social Security disability benefits which was false, the FTC said last fall. These are allegations in a proposed settlement, not final adjudicated findings. But they trace the supply chain from entry point to illegal call with a specificity that makes the abstract pipeline concrete.

If your number is registered with the National Do Not Call Registry, you shouldn't receive live sales calls from companies you haven't done business with before. If you do, those calls are illegal and that matters, because it makes every complaint you file afterward easier to assess and enforce.

What registration doesn't reach is illegal robocallers. They don't check the list. The FTC has been direct about this gap: the registry makes certain calls illegal, which strengthens reporting, but determined bad actors ignore it entirely. With over 258 million registered numbers and more than 2.6 million complaints filed in fiscal year 2025, the gap between legal protection and lived experience is obvious, per the FTC's fiscal year 2025 data book. The resale market keeps feeding numbers to callers who have no intention of complying.

Illegal robocalls carry a secondary risk beyond annoyance. Many lead directly to scams, the FTC has warned. Hanging up without pressing any buttons is the right response engaging may confirm that your number is active.

California's Consumer Privacy Act gives residents the legal right to request deletion of their data from registered brokers. The law requires brokers to confirm receipt within 10 business days and respond fully within 45 calendar days. UC Irvine researchers sent legally compliant requests to all 543 registered California data brokers and found that 43% simply didn't respond an apparent violation of state law. Only 57% replied at all (UC Irvine, July 2025).

The researchers described navigating "multistep submission forms, broken links and live phone calls with clueless or poorly trained staff," and noted that after all of it, there was still roughly a 50-50 chance of receiving any response.

There's a secondary problem. Some brokers required people submitting deletion requests to provide their full name, home address, or Social Security number to verify identity. The UC Irvine team flagged the obvious paradox: exercising privacy rights under the CCPA can require surrendering more data than the broker already had (UC Irvine, July 2025). This is why being selective about what you share and where tends to be more durable than trying to claw back data after the fact.

Regulators have noticed. The CFPB proposed a rule in late 2024 that would reclassify data brokers selling sensitive personal identifiers including phone numbers and Social Security numbers as consumer reporting agencies under the Fair Credit Reporting Act, imposing accuracy requirements and safeguards against misuse. The agency said the proposed rule followed monitoring that found brokers routinely sidestepping existing law by claiming they weren't subject to it (CFPB, December 2024). As of publication, that rule remains proposed.

The FTC's late 2024 actions against Gravy Analytics, Venntel, and Mobilewalla all involving proposed orders requiring data deletion and banning further sale of sensitive location data are worth noting here, though they concern location tracking rather than telemarketing lists directly. They're relevant because they show the same underlying logic: data aggregators collecting consumer information without consent and selling it onward, with enforcement coming only after the harm is documented. The Gravy Analytics action was the agency's fifth challenge to unfair handling of sensitive location data by data aggregators since 2022 (FTC, December 2024).

The steps below are ranked by impact: what works on incoming calls now, what cuts future exposure, and what's worth trying with calibrated expectations.

Register and report. Registration at DoNotCall.gov is free and makes live sales calls from unfamiliar companies illegal. Filing complaints there does more than create a paper trail. The FTC and its law enforcement partners use complaint data to spot trends and build enforcement cases, and call-blocking companies use the same data to identify numbers to block, per the FTC's fiscal year 2025 data book. Complaints you file protect other people, not just yourself. Don't engage with suspicious calls before reporting hang up without pressing buttons, then report.

Turn on call-blocking tools. Most carriers offer spam-filtering services, and third-party call-blocking apps are widely available. These tools often rely in part on complaint data, so reporting helps improve them over time. For guidance on specific options, ftc.gov/robocalls is the most reliable starting point.

Be deliberate before entering your phone number online. Coupon sites, insurance quote aggregators, warranty comparison tools, and sweepstakes entries are documented collection points for lead-generation operations, per the FTC. Before submitting your number on an unfamiliar site, search the site name alongside "complaint," "review," or "scam." If the site looks designed primarily to capture your contact information rather than deliver a service, use a secondary number or skip it. Data that never enters the pipeline can't be resold.

Review app location permissions. The FTC alleged that Mobilewalla harvested location data through advertising auction infrastructure collecting and retaining bid-request data even when it lost the auction (FTC, December 2024). Limiting which apps access your precise location reduces how much of your data enters secondary markets. Your phone's privacy settings let you restrict location access to apps that genuinely need it.

Data-broker opt-out requests, with low expectations. If you're a California resident, you have the legal right to request deletion. Attempt it knowing that nearly half of registered brokers may not respond, and that some will ask for sensitive information to process your request (UC Irvine, July 2025). Third-party opt-out services can handle the volume of requests, though coverage and follow-through vary. Outside California, comparable rights don't currently exist in most states, which makes the steps above more important.

The defenses that work operate at different stages. Registration and reporting act on calls already happening, building enforcement records and feeding the blocking infrastructure. Being selective about where you submit your number works upstream, before your data enters the resale market. They're not competing approaches they target different parts of the same problem.

The FTC's proposed orders against Gravy Analytics, Venntel, and Mobilewalla show a pattern of enforcement targeting data aggregators that collected and sold sensitive consumer data without consent. Whether the CFPB's proposed rule on data broker classification advances will determine how much the underlying system changes. Until it does, the practical steps above are the most reliable tools available.

DoNotCall.gov to register or file a complaint. ftc.gov/robocalls for call-blocking guidance and ongoing enforcement updates.