From the workshop. This first appeared in the build log of Privacy Guardian, a tool we are building to find and remove personal data from people-search sites. It has not launched.
The first reaction to finding your home address on a people-search site is usually to assume something was hacked. Almost always, nothing was. Your information was assembled, legally, from sources you probably agreed to without noticing.
Where it came from matters, because it tells you what removal can and cannot do.
Public records
The foundation of nearly every people-search profile.
Property deeds record who owns what. Voter registration records your name and address, and in many states it is available to anyone who asks. Court filings, marriage and divorce records, professional licences and business registrations are public by law.
Each of those is a deliberate policy choice, and mostly a reasonable one. Scraped and combined by a company with a search box, they become something the people who wrote those laws never had in mind.
Permissions you gave without noticing
The warranty card. The loyalty programme. The magazine subscription. The free quote form. The app whose privacy policy mentioned "trusted partners". The retailer that asked for your phone number at checkout.
Each of these usually came with permission to share your details. Nobody reads those terms, and they are not written to be read. This is where most of the phone numbers and email addresses on these sites come from.
The header on your credit file
When you apply for credit, the bureau records your name, current and former addresses, phone number and date of birth. The financial details are protected by law. The identifying header on top of them is not protected the same way, and it is sold.
That is why these sites can list every address you have lived at for twenty years, in order, including ones you barely remember.
Each other
Much of the industry is aggregators buying from aggregators. One site's records become another's, get resold, and reappear under a brand you have never heard of.
This is the most important thing to understand about removal:
- It is why data comes back. You removed it from one site while others still had it and kept selling it.
- It is why the largest sites come first. They are often the source the smaller ones buy from.
Why all of this is legal
Compiling public records is not illegal. Selling data you gave permission to share is not illegal. And in the United States, reading pages that anyone can open has mostly been treated by the courts as lawful (the long-running hiQ Labs v. LinkedIn case is the one usually cited).
Some states have changed the rules at the edges. California gives its residents a right to know what is held about them and to have it deleted, and a few other states have passed similar laws. But in most of the country the trade itself is lawful, which is why opting out exists at all: the companies are not required to stop collecting, only to remove you when asked.
That asymmetry is the whole shape of the problem. Removal is something you have to do again and again, because collection is something they never have to stop.
What this means in practice
- The data is not there because it was stolen. It is there because a dozen small permissions and public records added up.
- Removing it from one site does not remove it from the others. They are separate companies with separate databases, and each needs its own request.
- It comes back, because the upstream sources still have you and the sites buy from them again.
- Starting with the largest sites is not arbitrary. They are often upstream of the rest.
None of this makes it acceptable. It does make it tractable, which is more useful than outrage. The companies collecting this information do not carry the cost when it is used against someone, and until that changes, the practical answer is to remove what you can and keep checking. What you can actually remove is the honest list of what that gets you.