Front Page › Tools & Templates › Template

Cease and desist letter

A dated, written request to stop contacting you, delete your information and stop passing it on - on every channel, every number, and the affiliates and lead vendors behind the next caller.

By MCAFax · Last updated October 12, 2026 · How we source this

What this letter does, and when to use it

Use it when a broker or funding company keeps calling, texting or emailing after you have asked it to stop, or when calls start a few weeks after you got funded or filled out a quote form.

The point of the letter is not that it is scary. It is that it is dated and specific. It gives the company every phone number and email address to suppress, so its compliance team can actually find your records. It revokes any consent the company thinks it has. It asks the company to delete your information, stop sharing it, pass the request on to everyone it shared it with, and tell you where it got your number. And it asks for a written confirmation by a date.

Before the letter, a broker calling you is a nuisance. After it, every contact happens after a written request to stop, from someone who kept a copy and knows when it was delivered. Most shops would rather move you to their do-not-call list than keep a number like that on the dialer.

Read this first. This letter is a request, not legal advice, and MCAFax does not give legal advice. It does not claim the company broke any law, and it does not say your number is on the National Do Not Call Registry or that it is a residential line. Fill in only facts that are true, and keep a copy of everything you send.

The letter

Replace everything in [BRACKETS]. List every phone number and email address you have ever put on a funding or quote form, not just the one that was called, separated by commas.

Email subject line:

Stop contact, delete and do-not-share request - [YOUR NAME] / [YOUR BUSINESS NAME] - [YOUR PHONE NUMBER(S)]

Letter:

[DATE] To: [COMPANY NAME] Attn: Privacy / Compliance / Do-Not-Call Re: Revocation of consent, internal do-not-call request, and request to delete and stop sharing my information Hello, I am writing about calls, texts or emails that I and my business have received from [COMPANY NAME] or from someone acting on its behalf. Please apply every request below to all records you hold that match ANY of these identifiers: Name: [YOUR NAME] Business: [YOUR BUSINESS NAME] Phone number(s): [YOUR PHONE NUMBER(S)] Email address(es): [YOUR EMAIL ADDRESS(ES)] State: [YOUR STATE] 1. Revocation of consent - all numbers, all methods, effective immediately. I revoke any consent you have, or believe you have, to contact me or [YOUR BUSINESS NAME] at the numbers and addresses above. This covers every method: live, autodialed, prerecorded or artificial-voice calls, ringless voicemail, text messages and email. It applies however and wherever any consent was obtained, including any website, lead form, marketplace, partner or list. If you have designated a specific way to revoke consent (for example, replying STOP to a text, pressing a key during a call, or a particular phone number or web page), please treat this letter as made through that method as well. If it cannot be, reply and tell me what the method is, and I will use it too. I make this revocation under the Telephone Consumer Protection Act and the FCC's rules. Those rules require revocation requests to be honored within a reasonable time, not to exceed ten business days. 2. Internal do-not-call list. Please add each phone number above to your internal do-not-call and do-not-text list, and add each email address to your email suppression list. Please also send me a copy of your written do-not-call policy. 3. Delete my information. Please delete all personal and business information you hold about me and [YOUR BUSINESS NAME], and all copies of it. That includes your CRM, dialer, lead-management, marketing and backup systems. It also includes information you received from, or provided to, any lead source, marketplace, aggregator, data vendor or other third party. If you must keep any record, please keep only that record, use it only for the reason you must keep it, and keep my numbers and addresses on your suppression lists so that I am not contacted again. 4. Stop sharing, and pass this request on. Please stop selling, sharing, renting or otherwise disclosing my information to anyone. Please also forward this request (stop contact, delete, stop sharing) to every third party to whom you sold, shared, sent or submitted my information. That includes lenders, funders, brokers, ISOs, marketplaces, data vendors, lead buyers, affiliates, and anyone who has contacted me on your behalf. 5. Tell me who has my information, and where you got it. Please send me, in writing: a. the name and contact details of each third party you sold, shared, sent or submitted my information to, with the approximate date; b. the source from which you obtained my information (the company, website, list or lead vendor, and the date), and a copy of any record of consent you are relying on; and c. the full name of the company that contacted me, and of any company on whose behalf the contacts were made. 6. Written confirmation. Please reply in writing to the email address above: - within 10 business days, confirming that my numbers and addresses are on your internal do-not-call and suppression lists and that consent is revoked; and - within 45 days, confirming that my information has been deleted (or stating what you kept and why), that you forwarded this request (and to whom), and providing the information in item 5. 7. State privacy rights. To the extent a state privacy law applies to you and to my information, please treat this letter as a request to exercise every right that law gives me. That includes deletion; opting out of sale, sharing, targeted advertising and profiling; and access, including the sources of my information and the third parties who received it. I understand that some of these laws do not cover information collected in a business or commercial context, or certain financial institutions or data. I am making these requests regardless, and I ask you to honor them as your policy. If you need to verify my identity for any part of this, tell me what you need and a secure way to provide it. Please do not delay the stop-contact and do-not-share requests while verification happens. [OPTIONAL: PASTE YOUR STATE PARAGRAPH FROM BELOW HERE, OR DELETE THIS LINE] 8. Future forms do not reverse this request. This request stays in effect unless I give you new, express, written consent that names [COMPANY NAME]. Please do not treat any future web form, lead form, loan or quote inquiry, or any list or lead obtained from a third party as consent to contact me or as a reason to undo this request. 9. Records. I am keeping a dated copy of this letter and a log of any contact I receive after it. Contacts received to date include: - [DATE, TIME, FROM NUMBER OR ADDRESS, WHAT IT WAS ABOUT] - [DATE, TIME, FROM NUMBER OR ADDRESS, WHAT IT WAS ABOUT] - [DATE, TIME, FROM NUMBER OR ADDRESS, WHAT IT WAS ABOUT] Thank you for taking care of this. [YOUR NAME] [YOUR BUSINESS NAME] [YOUR EMAIL ADDRESS(ES)] [YOUR PHONE NUMBER(S)]

The three contact lines are optional. Copy them from your call and text log, keep three at most, and delete the block if you have nothing logged yet.

Short version for web forms

Many companies take privacy and do-not-call requests through a web form or privacy portal with a character limit. Paste this into the free-text box (about 900 characters), and also send the full letter by email if the company lists an address.

[YOUR NAME] / [YOUR BUSINESS NAME]. Phones: [YOUR PHONE NUMBER(S)]. Emails: [YOUR EMAIL ADDRESS(ES)]. 1) I revoke any consent to contact me by call, text, ringless voicemail or email at these numbers/addresses, effective now, by any method incl. any opt-out method you designate. 2) Add them to your internal do-not-call and suppression lists. 3) Delete all my personal and business information, incl. data from or to lead sources, marketplaces and data vendors. 4) Stop selling/sharing it and forward this request to every third party you shared it with. 5) Tell me who those third parties are and where you got my information. 6) Confirm in writing: DNC within 10 business days; deletion within 45 days. Any applicable state privacy rights are invoked. A future form fill is not new consent. Full letter sent to [COMPANY NAME] by email on [DATE].

State add-on paragraphs (optional)

If you live in one of these states, paste the matching paragraph into the letter where it says [OPTIONAL: PASTE YOUR STATE PARAGRAPH...]. Each one asks for your rights only to the extent the law applies to the company and to your information. Many of these laws exclude information collected in a business context, so the paragraphs ask the company to honor the request either way. They do not claim the company is covered.

California

California. I am a California resident. To the extent the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code 1798.100 et seq.), applies to you, please treat this letter as: (a) a request to delete my personal information and to notify your service providers, contractors and all third parties to whom you sold or shared it to delete it (1798.105); (b) a request to opt out of the sale and sharing of my personal information - "Do Not Sell or Share My Personal Information" (1798.120); (c) a request to limit the use and disclosure of my sensitive personal information (1798.121); and (d) a request to know the categories of sources of my information and the categories of third parties to whom you disclosed it (1798.110, 1798.115). The CCPA's temporary exemption for business-to-business contact information ended on January 1, 2023. I understand opt-out requests do not require identity verification.

Texas

Texas. I am a Texas resident. To the extent the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541) applies to you and to my information, please treat this letter as a request to delete my personal data and to opt out of its sale, its use for targeted advertising, and profiling (sec. 541.051), with a response within 45 days (sec. 541.052). I understand the Act may not cover information collected in a commercial context; I ask you to honor these requests regardless.

Virginia

Virginia. I am a Virginia resident. To the extent the Virginia Consumer Data Protection Act (Va. Code 59.1-575 et seq.) applies, please treat this letter as a request to delete my personal data and to opt out of targeted advertising, sale and profiling (59.1-577), with a response within 45 days (59.1-578). I ask you to honor these requests even if the Act's commercial-context exclusion applies.

Colorado

Colorado. I am a Colorado resident. To the extent the Colorado Privacy Act (C.R.S. 6-1-1301 et seq.) applies, please treat this letter as a request to delete my personal data and to opt out of targeted advertising, sale and profiling (6-1-1306), with a response within 45 days. I ask you to honor these requests even if the Act's commercial-context exclusion applies.

Connecticut

Connecticut. I am a Connecticut resident. To the extent the Connecticut Data Privacy Act (Conn. Gen. Stat. 42-515 et seq.) applies, please treat this letter as a request to delete my personal data and to opt out of targeted advertising, sale and profiling (42-518), with a response within 45 days. I ask you to honor these requests even if the Act's commercial-context exclusion applies.

Any other state

My state. I am a resident of [YOUR STATE]. If [YOUR STATE] has a consumer privacy law that applies to you and to my information, please treat this letter as a request to exercise each right it provides, including deletion, opting out of sale, targeted advertising and profiling, and - where the law provides it - a list of the specific third parties to whom you disclosed my information.

How to send it

Send one letter per company. Never put several companies on one email.

Email (start here). Send it from an email address you control, as plain text, with the subject line above. Look in the company's privacy policy for a privacy or opt-out address (often privacy@, optout@ or similar) and send it there; add the address that contacted you as a second recipient. If the policy names its own subject line for privacy requests, use that one. Keep the sent copy. Its date and time are your proof of delivery.
The company's web form or privacy portal. If the privacy policy says requests go through a form, use it too. Paste the short version, tick every request type offered (delete, opt out, do not call), and save a screenshot plus any confirmation or ticket number in your log. If the company also lists an email address, send the full letter there.
Reply STOP to every text. Do it on every text thread and every short code, every time. One short code does not cover another. Screenshot each reply.
Certified mail, return receipt requested. Use it when there is no email address or form, when the company ignores your email for more than 10 business days, or when its policy names a mailing address for opt-outs. Print the same letter and mail it to the privacy address in the company's policy, or otherwise to its registered agent. Keep the receipt with your copy. It costs money and takes days, so treat it as the follow-up, not the first step.
When the phone rings anyway. Say: "Please put this number on your company's internal do-not-call list and stop calling and texting me. What is your company's full name?" Then log the call and send the letter.

Follow-up schedule

Day 0: Send the letter. Reply STOP to any texts. Start or update your call and text log.
10 business days, or any new contact after you sent it: If you have no written do-not-call confirmation, send the letter again with the subject "Second request - originally sent [DATE]" and quote your first message.
45 days: If you have no confirmation of deletion and forwarding, or no answer about who has your information, send items 3 to 6 again.
Every time: Log the date, time, number and what was said. Keep every reply you get.

These are dates for your calendar, not threats. The letter works because it is polite, specific and on the record.

The parts that are doing the work

Every number and email, matched on any of them. A company cannot suppress a number it was never given. Lead files are keyed on phone and email, so listing all of them catches the copies filed under your name, your business name or your second cell.
Every channel, named. "Stop calling" invites a text. The letter names calls, texts, ringless voicemail and email, and asks the company to treat it as made through whatever opt-out method it has designated.
Revocation of any claimed consent. Somewhere in a file there may be a checkbox you do not remember. This says: whatever it was, it is over as of today, and a future form fill does not bring it back.
The do-not-call policy request. Asking for the written policy, and how fast it arrives, tells you a great deal about the shop.
Delete, stop sharing, pass it on. Your number was almost certainly bought from a list. Asking for deletion and forwarding is how the request follows the data instead of stopping at one room. Keeping your number on the suppression list stops it from being bought back in.
Who has it, and where it came from. Knowing the source lets you go upstream to the company that sold your number in the first place. Why they have your number at all explains where the lists come from.
Dates for a written answer. Ten business days and 45 days are windows many compliance teams already work to, so the request lands in a queue instead of a trash folder.
The dated contact list. Three lines from your log turn the letter from a form into a specific, documented request.

Note what the letter deliberately does not say: it does not claim your number is on the National Do Not Call Registry, it does not claim it is a residential line, and it does not say the company broke the law. Business lines get less protection than home lines, and a letter should never assert a fact you cannot back. Say only what is true, and say it with dates.

Keep going

How to stop MCA brokers from calling you - the full step-by-step guide.
Stop the Calls - the series: the call script, the written stop request, the call log, UCC leads, call screening and lead sellers.

This letter is a request, not legal advice. MCAFax does not give legal advice.

Questions readers actually ask

What does this letter actually do?

It puts a dated, written request on record asking a company to stop contacting you on every number and email you list, revoke any consent it thinks it has, add you to its internal do-not-call and suppression lists, delete your information, stop sharing it, pass the request on to anyone it shared it with, and confirm all of that in writing by a set date.

When should I send it?

Send it when a broker or funding company keeps calling, texting or emailing after you asked it to stop, or when calls start after you got funded or filled out a quote form. Send one letter per company, as soon as you know the company's name.

Why does it list every phone number and email address I have?

A company cannot suppress a number it was never given. Lead files are keyed on phone and email, so listing every number and address you have ever put on a funding or quote form lets the company find all of your records, not just the one that was called.

Why does it revoke consent if I never gave any?

Somewhere in a lead file there may be a checkbox or form you do not remember. The letter revokes any consent the company has or believes it has, however it was obtained, and says a future form fill is not new consent.

Does it stop the affiliates and the "different" company that calls next week?

It asks the company to stop sharing your information and to forward the request to every lender, funder, broker, marketplace, data vendor, affiliate and lead buyer it shared your information with, and to tell you who they are and where it got your number. That is how the request follows the data instead of stopping at one company.

Why ask for the company's written do-not-call policy?

Companies that make telemarketing calls are generally expected to keep a written do-not-call policy. Whether they send it, and how fast, tells you a lot about who you are dealing with, and an ignored request becomes part of your record.

Is this legal advice?

No. The letter is a request, not legal advice, and MCAFax does not give legal advice. It does not say the company broke any law. Fill in only facts that are true.

Does it say my number is on the National Do Not Call Registry?

No, on purpose. The registry is for personal numbers, and business lines generally get less protection than home lines. The letter does not claim your number is registered or that it is a residential line, because a letter should never assert something you cannot back.

What are the state paragraphs for?

If you live in California, Texas, Virginia, Colorado or Connecticut, you can add a short paragraph asking the company to honor that state's privacy rights to the extent the law applies to it and to your information. There is also a general paragraph for any other state. Many of these laws exclude information collected in a business context, so the paragraphs ask the company to honor the requests either way.

How should I send it?

Email it as plain text from an address you control, to the privacy or opt-out address in the company's privacy policy, and keep the sent copy. If the company uses a web form, paste the short version there too and save a screenshot. Reply STOP to every text. Use certified mail with a return receipt when there is no email or form, or when email is ignored.

What if they keep calling after I send it?

Log every contact. If there is no written do-not-call confirmation after 10 business days, or any new contact, send the letter again marked "Second request" and quote your first message. If there is no confirmation of deletion and forwarding after 45 days, send items 3 to 6 again.

Getting the calls? Shut it down.

Check a broker, then use the finance skill in your own AI. MCAFax has no user accounts and no sign-up.

Open the finance skill