August 8, 2024
Yael Grauer
Yael Grauer is the program manager of Security Planner, a free, easy-to-use guide to staying safer online.
Seven years ago, I typed my own name into a search engine and was horrified to learn that my name, age, home address, and phone number were publicly posted by multiple people-search sites without my knowledge, let alone consent.
Shortly after finding my own data online, I started maintaining a data broker opt-out list for people who wanted to manually remove their own information from people-search sites. I’ve been updating it since 2017, as new sites keep cropping up and existing sites change their opt-out processes.
People-search sites are largely unregulated, have generally opaque practices and operations, and can be confusing and time-consuming for consumers to navigate. Given that, it’s easy to understand why people would prefer to pay to have someone fill out forms and solve captchas on their behalf.
We joined forces with Tall Poppy, an organization that builds tools and offers services to help companies protect their employees against online harassment and abuse, to evaluate seven different people-search removal services. We recruited 32 participants from Community Reports, enrolled them in people-search removal services or manually opted them out in a control group, and evaluated the results.
Today we’re releasing the full report of our findings.
Please reach out to me if you have any feedback at yael.grauer@consumer.org.
(KF note: Original PDF of report attached, reproduced here.)
Introduction
Enter your name into an internet search engine and the first few results will probably include detailed profiles of you compiled by “people-search” websites with names like Intelius, PeopleFinders, and Spokeo.People-search sites are one type of data broker, which is a company that specializes in collecting personal data and selling it to third parties for a variety of purposes. People-search sites collect data from public records, commercial data sources, and even social media websites. Then they bundle it all together under your name and make it easily accessible on the internet.
As a result, the profiles that pop up when someone types your name into a search engine may include your home and email addresses and phone numbers; your educational and employment histories; lists of your purported relatives and properties you’ve lived at and owned; a record of marriages (and divorces), lawsuits, bankruptcies, arrests, criminal cases, and other court proceedings you’ve been associated with; and more. Out-of-date and incorrect information is often mixed in with current and accurate information.
While some portion of this data may be available free of charge, users sometimes have to pay a modest fee or buy a subscription to see all the information contained in people-search profiles.
Even though much of this information is compiled from public sources, bundling it all together and making it so easily accessible can make people feel their privacy has been violated, or they might worry about what may happen if the information gets into the wrong hands. People-search sites put ordinary people at risk of fraud, identity theft, scams, and even stalking and other forms of harassment.
Not surprisingly, a group of companies offers to remove people’s personal data from people-search sites for fees ranging from $19.99 per year to more than $1,000 per year. Some bundle this with other services, and some sell bulk subscriptions so that organizations can offer these services to their employees.
We, the authors of this report, are often asked how effective these services are, especially when compared with filling out opt-out forms for each site individually, and which ones we would recommend. So we decided to evaluate seven of these services to try to get a sense of how well they work, and whether some are more effective and reliable than others.
Disclosure: In 2022, Consumer Reports launched Permission Slip, a mobile app that makes it easy to take control of your personal data. The app shows users what kinds of data companies collect, and lets you tell a company to stop selling your data or to delete your data entirely. While Permission Slip does remove data from some people-search sites, it was not evaluated in this report because it does not offer comprehensive people-search site removal at this time, though it may in the future. This project was completed independently.
Why It Matters
People-search sites are largely unregulated, their practices and operations are generally opaque, and navigating them can be confusing and time-consuming for consumers.No federal laws give consumers the right to “opt out” of people-search sites—that is, to prevent the sites from collecting and selling data about them and to have existing data about them deleted. Several states have passed laws intended to give consumers opt-out rights, but only some sites offer mechanisms for consumers to exercise those rights, while others rely on loopholes in denying those rights. (For instance, several state data privacy laws contain exemptions for public information.)
Some people-search sites do allow users to opt out, either voluntarily or in compliance with state laws. But doing so across many sites is time-consuming, complicated, and often frustrating. The process differs from site to site. Some require users to create accounts and/or divulge information (such as driver’s license numbers or current phone numbers) as a prerequisite for opting out. Some have practices that make it all but impossible to opt out—by, for example, requiring users to have access to defunct accounts, such as an old email address that they no longer use. Some even use deceptive designs that appear intended to trick users into signing up for subscriptions or other paid offerings.
Even when users successfully navigate a site’s opt-out process, it doesn’t always work: The information sometimes doesn’t actually get removed, sometimes doesn’t get removed for weeks or months, and sometimes gets removed but then reappears weeks or months later.
In addition to all these practical concerns, people-search sites are problematic because they collect information that was never shared voluntarily, and they create profiles of private individuals without their knowledge or consent.
Some people are not troubled by this, knowing that there is already information about them online that they have shared themselves on social media sites like Facebook and LinkedIn. Social media sites have data privacy problems of their own, of course. But users of social media websites are usually aware that at least some portion of the information they are sharing can be seen by the public. When we (the authors of this
report) have shown people how much information is available about them on people-search websites in both our personal and professional capacities, they are often shocked—much more so than when the social media profiles they created themselves turn up in a search engine result.
Many people want to pay services to do the work of removing their information from people-search sites for them, but it’s not clear how people-search site removal services stack up. Consumer Reports’ Security Planner teamed up with digital safety organization Tall Poppy to analyze the effectiveness of paid people-search site removal services.
Methodology
Consumer Reports conducted the test using 32 volunteer test subjects, each of whom agreed to allow us to use people-search removal services to attempt to delete their personal data profiles from people-search sites and then evaluate the results.The 32 participants were selected from among a larger group of willing volunteers who were recruited by email because they a) had previously participated in Community Reports, a participatory science project of Consumer Reports; b) were based in New York or California, for reasons we explain below; and c) had indicated an interest in data privacy-related projects.
From that larger group, we eliminated anyone who had previously used a people-search removal service or opted out of people-search sites (to make the sample more consistent and to increase the likelihood of finding data to remove for all participants). We also eliminated volunteers who had not lived at their current address for at least two years, and those who had highly common surnames, which would make it relatively difficult to isolate their profiles on people-search sites.
We selected volunteers only from California and New York because California’s robust digital privacy law, the California Consumer Privacy Act, requires data brokers to make opt-outs publicly available and respond to opt-out requests. We wanted to see whether that law actually makes it easier to opt out of people-search sites compared with New York, which currently has no state privacy law.
Finally, we chose to split the participants between people who own their homes and people who rent their homes, to see whether different types of real estate records would receive different treatment.
Our final group of 32 participants consisted of four groups: eight New York State residents who own their homes, eight New York State residents who rent their homes, eight California residents who own their homes, and eight California residents who rent. We used seven people-search removal services (Confidently, DeleteMe, EasyOptOuts, IDX, Kanary, Optery, and ReputationDefender) to attempt to delete participant profile data from 13 people-search sites (BeenVerified, CheckPeople, ClustrMaps, Dataveria, Intelius, MyLife, Nuwber, PeopleFinders, PublicDataUSA, Radaris, Spokeo, ThatsThem, and Whitepages).
These sites and services were selected in collaboration with our partner, Tall Poppy, an organization that builds tools and offers services to help companies protect their employees against online harassment and abuse. We picked people-search sites that are generally the most widely used in their categories and the most likely to appear on the first page of a Google search. (See the Appendix for more information about the people-search removal services.)
With each group of eight participants, seven participants were randomly assigned one of the people-search removal services; for the eighth, we manually opted out of the 13 people-search sites, to set a baseline for comparison. This means that we evaluated each of the people-search removal services with four participants, one from each of the four groups.
The test was conducted over a four-month period, between May and September 2023. We first did an initial search to see what data we could find about the participants on the 13 people-search sites. We then signed up each participant for a people-search removal site (or, for the control group, manually requested deletion at each of the 13 people-search sites). We then checked each of the 13 people-search sites for data about the participants three different times—one week later, one month later, and four months later—and recorded the results. Specifically, we looked to see whether profiles containing their personal information were still on the sites or had been removed.
We gathered additional information about the people-search removal services from their respective websites and by emailing them questions regarding their policies, such as whether they would consider the personal data they have collected to be a corporate asset in the case of bankruptcy, a merger, or an acquisition. The results of these inquiries are contained in the Appendix. The Appendix also includes additional information on the people-search site removal services, including their cost and the number of brokers they remove data from.
Limitations of This Study
This study included a relatively small sample size and participants were selected from among volunteers in the non-random process described above, so we do not consider the results statistically significant or nationally representative.In addition, it is important to note that we provided the opt-out services with a limited amount of information, including name, current address, and date of birth. Because some people-search removal services decide to leave information online if they are not certain it belongs to the person requesting an opt-out, it’s possible that providing previous mailing addresses and other supplemental data would have yielded better results. In one instance, for example, a removal service asked for names of the participant’s relatives and the relatives’ addresses, which we did not provide.
Services often provided options to upload a driver’s license or state ID, which we did not do. There were sometimes options to enter a middle name (which we did only if required) or to add a phone number. In some instances, the phone number required verification from someone with access to that phone, in which case we did not enter a number.
Another important caveat is that while some people who purchase a subscription to a people-search removal site will diligently check their user dashboards, respond to follow-up questions, and/or file manual requests as needed, our participants did none of these things. We signed users up and then let the services run without further intervention. In addition, some people-search removal services also offer additional or enhanced services beyond the standard ones we evaluated.
Finally, we evaluated the presence of information only on the same page we originally found it on. It’s possible that variations of profiles cropped up on different pages within the same people-search sites. We also did not test for the reappearance of profiles after finding that the user had been deleted from the broker, with the assumption that they would remain deleted. That means that if the profile was gone after a week, we did not recheck it after one or four months.
Findings
1) As a whole, people-search removal services are largely ineffective.Private information about each participant on the people-search sites decreased after using the people-search removal services. And, not surprisingly, the removal services did save time compared with manually opting out.
But, without exception, information about each participant still appeared on some of the 13 people-search sites at the one-week, one-month, and four-month intervals.
We initially found 332 instances of information about the 28 participants who would later be signed up for removal services (that does not include the four participants who were opted out manually). Of those 332 instances, only 117, or 35%, were removed within four months.
Table 1
Profile Removals for People-Search Removal Services
| Initial Number of Profiles | Profiles Removed Within 1 Week | Profiles Removed Within 1 Month | Profiles Removed Within 4 Months |
| 332 | 26% (86) | 30% (100) | 35% (117) |
Some services performed better than others. EasyOptOuts and Optery performed the best of the services we evaluated. (Notably, EasyOptOuts was also the least expensive service we evaluated, at $19.99 per year.) DeleteMe, IDX, and Kanary were midlevel performers. Confidently and ReputationDefender performed the worst.
Table 2
Removal Success Rate for People-Search Removal Services
| People-Search Removal Service | Annual Cost (as of July 2024) | Profiles Removed Within a Week | Profiles Removed Within 1 Month | Profiles Removed Within 4 Months |
| Confidently | $120 | 0% | 2% | 4% |
| DeleteMe | $129 | 13% | 20% | 27% |
| EasyOptOuts | $19.99 | 59% | 61% | 65% |
| IDX (Privacy Tier) | $139.92 | 38% | 38% | 40% |
| Kanary | $179.88 | 16% | 26% | 34% |
| Optery (Ultimate Tier) | $249 | 52% | 58% | 68% |
| Reputation Defender (Privacy Pro) | $99 | 2% | 4% | 6% |
| Manual opt-outs | $0 | 70% | 70% | 70% |
2) Manual opt-outs were more effective than people-search removal services but were also far from perfect.
When we searched the 13 people-search sites for information on each of the four manual opt-out participants—one from each residence type group—we found 47 profiles.
After opting out those four participants at each of the 13 people-search sites, 33 of those 47 profiles were gone after the first week, and three more were gone after the first month. (No additional profiles had been removed after four months.)
That’s a “success rate” of about 70%, compared with a success rate of anywhere from 6% to 68% for people-search removal services.
Of course, this suggests that not even the time-consuming process of filling out opt-out forms at many different people-search sites is likely to completely rid the internet of people-search profile data.
It’s worth noting that opting out manually also had quicker results, with 70% gone within a week, compared with anywhere from 0% to 58.7% removed in the first week via the people-search removal services.
3) Of the information removed within four months, most was removed within a week.
We added up the number of times we saw a volunteer’s information on a people-search site and found a total of 379 such instances, including the manual opt-out group. Of those, 150 were removed—119 (almost 80%) within a week, 14 additional within a month, and 17 more by the four-month mark.
Opting out manually generally had quicker results, with 33 of the 47 profiles (70%) gone within a week, compared with 86 out of 332 (26%) removed in the first week via the people-search removal services, ranging from 0% to 59%.
4) Some people-search removal services advertise on or partner with people-search sites.
While we were performing opt-outs, we found that some people-search removal sites advertised on or even partnered with people-search sites. We see this as an implicit endorsement of the inherently problematic people-search ecosystem. For example, after removing a volunteer’s data from ClustrMaps, we saw an ad for data removal service Onerep. (There has been additional reporting on Onerep’s ties to people-search sites on security news website KrebsOnSecurity.)
Additionally, the people-search site PeopleFinders advertised for the people-search removal site BrandYourself.
5) We found no significant difference in the success rate of removing data between renters and homeowners.
We chose to split the participants between people who own their homes and people who rent their homes to see whether different types of real estate records would receive different treatment. In our evaluation, there was no significant difference: About 40% of New York homeowners’ data was removed, compared with 46% of renters’ data. For California, about 34% of homeowners’ data was removed, compared with about 38% of renters’ data.
Table 3
| Participants | Initial Number of Profiles | Profiles Removed Within 4 Months |
| New York homeowners | 96 | 40% (38) |
| New York renters | 99 | 46% (46) |
| California homeowners | 88 | 34% (30) |
| California renters | 96 | 38% (36) |
6) Some people-search sites removed more data in response to removal service requests than others.
The three people-search sites from which removal services had the most difficulty removing data were CheckPeople, PublicDataUSA, and Intelius. The three that were the best at complying with requests from removal services were PeopleFinders, ClustrMaps, and ThatsThem.
Table 4
| Name of People-Search Site | Profiles Removed Within a Week | Profiles Removed Within 1 Month | Profiles Removed Within 4 Months |
| BeenVerified | 32% | 48% | 55% |
| CheckPeople | 13% | 13% | 16% |
| ClustrMaps | 50% | 50% | 59% |
| Dataveria | 31% | 31% | 31% |
| Intelius | 13% | 20% | 20% |
| MyLife | 32% | 32% | 36% |
| Nuwber | 35% | 38% | 42% |
| PeopleFinders | 53% | 66% | 66% |
| PublicDataUSA | 12% | 12% | 19% |
| Radaris | 28% | 31% | 31% |
| Spokeo | 29% | 29% | 39% |
| ThatsThem | 38% | 42% | 58% |
| Whitepages | 45% | 45% | 48% |
Appendix: The Providers We Tested
The following descriptions are current as of July 2024, though some have changed from the period in which we did our initial testing. Some of the providers offer free tiers, which we did not evaluate.
Confidently charges $120 per year ($10 per month) to remove information from 500-plus businesses, including data brokers. It offers a 30-day free trial period. Confidently members also receive data breach alerts if their information is found in other databases.
DeleteMe charges $129 for an individual for one year or $209 ($8.71 per month) for two years, with discounts for multiple users. It can remove data from hundreds of businesses, depending on the tier. Reports are provided quarterly. DeleteMe’s privacy policy states that it “may sell, transfer, or otherwise share some or all of our business or assets, including your personal information, in connection with a (potential) business transaction such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.” Some privacy-minded subscribers might not want their information to be used this way
EasyOptOuts charges $19.99 per year to remove data from 134 data brokers directly, which leads to 42 indirect removals from data brokers that source their information from the other brokers. Removals take place every four months. The company heavily redacts personal data even when a user is signed in, in case of unauthorized access.
IDX charges $107.52 to $355.32 annually, depending on the tier, or $9.95 to $32.90 per month for an individual account, to remove data monthly from over 100 data broker sites per month. IDX owner ZeroFox’s privacy policy states that it may use and disclose personal information, including to “transfer your information in the case of a sale, merger, consolidation, liquidation, reorganization, or acquisition,” but that the acquirer is subject to obligations under its policy, including your rights to access and choice, and that it will notify users of this change via either email or a notice posted on its websites. Some privacy-minded subscribers might not want their information to be used this way.
Alarmingly, IDX’s connection to verify email addresses was not secure at the time of our evaluation because it did not support HTTPS, or Hypertext Transfer Protocol Secure. HTTPS is the secure version of HTTP, the protocol used to send data between a web browser and a website. HTTPS uses encryption to increase the security of data transfer, and to prevent information you exchange from being spied on or changed while it is traveling across the internet.
Kanary charges $179.98 annually or $16.99 per month for an individual, with an additional monthly fee of $8.49 or annual fee of $89.98 per family member. It offers a 14-day trial period. Kanary scans the web for personal data on 1,000-plus data broker sites, search engines, data breach sites, and doxing sites (sites that post personally identifiable information about people or organizations, often without their consent), but members can run scans whenever they want and send in additional profiles that the scans didn’t cover for removal.
Optery charges anywhere from $39 to $249 per year (or $3.99 to $24.99 per month) to remove information from 320-plus data broker sites once a month or more. “Ultimate” subscribers can submit unlimited custom removal requests for data brokers not already covered by their plan. One area of concern: Optery states in its privacy policy that in the event of a merger, acquisition, or asset sale, “your Personal Data may be transferred as a result of the business transaction.” Some privacy-minded subscribers might not want their information to be used this way. Users will have at least 30 days to delete their account in advance of the close of the business transaction.
ReputationDefender typically charges $1,000 to $5,000 per year for services but also offers a less expensive tier, Privacy Pro, that is $99 per year or $9.95 per month. The site says it removes data from more than 900 brokers either quarterly or monthly, depending on the tier, with custom removals available at the higher tiers. At the $99 tier, data is removed from about 50 sites. ReputationDefender’s privacy policy states that customer account information may be shared with a successor company in the case of a merger or acquisition, or during the process of diligence (pre-transaction assessment) leading up to the transaction itself, though “the processing of your Personal Information would continue to be bound by this Privacy Policy unless and until it is amended.”
