The brokerage opt-out playbook,applied.

An opt-out engagement runs against a single subject identity, against a list of named brokers, and under a statutory basis the dossier cites by name. The five working steps below are the bounded sequence: intake → evidence grading → takedown filing → response logging → close-out. Each step produces a defined artifact, addressed to a controlled destination, held in a defined format on the dossier. The method is intentionally narrow — anything outside the workflow is closed at the controller, not opened in the brief.

The five working steps:

1. Intake — sealed subject identity, named broker list, named statutory basis

   01

   The engagement opens with a sealed intake brief that names the subject identity, the broker listings to be filed against, and the statutory basis each filing runs under. The brief is acknowledged within two business days and held under the same single-custodian rule that runs through every Threadkin engagement — one practitioner carries it from intake to certificate of destruction.

2. Evidence grading — controller identity, controller portal, lawful basis on file

   02

   Each named broker listing is graded against the controller identity, the controller's own opt-out portal URL, and the lawful basis the dossier cites. Derivative listings are rejected; the dossier holds the controller-named-at-filing, not the aggregator-named-at-search. Each broker row carries the controller record, not the broker-market summary.

3. Takedown filing — letter sent under the named regime, addressed to the controller

   03

   Every broker letter is filed against a named statutory regime — Article 17 (GDPR), §1798.105 (CCPA), or the equivalent state or federal statute — and addressed to the controller's data-protection contact, not to the broker's marketing alias. The letter carries a notebook: record, basis, expected response window. The letter is held in the dossier the day it is sent.

4. Response logging — controller acknowledgement, partial response, non-response

   04

   The dossier logs what came back — controller acknowledgement, a partial removal, a re-collection notice, or a non-response past the standing window. Each broker row in the dossier carries the controller's response verbatim, dated and entered against the broker record. A non-response past the window is the trigger for the regulator escalation, not a request for a second letter under the same regime.

5. Close-out — sealed dossier, certificate of destruction, single acknowledgement

   05

   On closing, the dossier is sealed under a single certificate of destruction. The subject receives one reconciliation record — one note per named broker, one note per named regime, one note per named response. There is no second closing, no separate vendor report, and no aggregated 'success rate' claim. The notebook is the artifact; the artifact travels with the dossier.

A takedown letter is not a free-form request. It is filed under a named statutory basis, addressed to a named controller, and carries five notebook fields the dossier records against every broker row. The notebook is the part that survives the controller's response, the broker's re-collection, and the closure of the engagement — the parts the practitioner can and cannot answer are bounded by what the notebook holds to.

The five notebook fields persisted against every takedown:

1. Named controller record

   01

   The legal entity the request is addressed to — not the broker's marketing name, not a search-result alias, not the domain the dossier found on first search. The controller record is the entity whose data-protection contact receives the letter and whose response (or non-response) the dossier logs.

2. Named statutory basis

   02

   The citation under which the letter is filed — Article 17 GDPR, §1798.105 CCPA, UK GDPR Article 17-equivalent, or the equivalent state or federal statute. The dossier records the basis verbatim because the regulator's complaint form requires it on the same line.

3. Identity-verification note

   03

   What was sent with the letter to satisfy the controller's identity-verification hurdle — and what was not sent, and why. A controller that requires photo-ID is treated differently from a controller that accepts a notarised statutory declaration under the standing regime; the dossier records which path the brief took.

4. Expected response window

   04

   The statutory response window the letter cites at dispatch — one calendar month under GDPR Article 12(3), 30–45 days under §1798.105, an equivalent window under equivalent regimes. A non-response past the cited window is the trigger for regulator escalation, not a trigger for a second letter under the same regime.

5. Response log entry

   05

   What came back — controller acknowledgement, partial removal, re-collection notice, or non-response — entered verbatim, dated, against the controller record. The response log is the dossier's closest thing to a running diary; it is also the artifact a later reviewer (a counsel, a notary, the subject three years on) reads first.