000
re$2
Data Defense: Evaluating People-Search Site Removal Services
Introduction
Enter your name into an internet search engine and the first few results will probably
include detailed profiles of you compiled by “people-search” websites with names like
Intelius, PeopleFinders, and Spokeo.
People-search sites are one type of data broker, which is a company that specializes in
collecting personal data and selling it to third parties for a variety of purposes.
People-search sites collect data from public records, commercial data sources, and
even social media websites. Then they bundle it all together under your name and make
it easily accessible on the internet.
As a result, the profiles that pop up when someone types your name into a search
engine may include your home and email addresses and phone numbers; your
educational and employment histories; lists of your purported relatives and properties
you’ve lived at and owned; a record of marriages (and divorces), lawsuits, bankruptcies,
arrests, criminal cases, and other court proceedings you’ve been associated with; and
more. Out-of-date and incorrect information is often mixed in with current and accurate
information.
While some portion of this data may be available free of charge, users sometimes have
to pay a modest fee or buy a subscription to see all the information contained in
people-search profiles.
Even though much of this information is compiled from public sources, bundling it all
together and making it so easily accessible can make people feel their privacy has been
violated, or they might worry about what may happen if the information gets into the
wrong hands. People-search sites put ordinary people at risk of fraud, identity theft,
scams, and even stalking and other forms of harassment.
Not surprisingly, a group of companies offers to remove people’s personal data from
people-search sites for fees ranging from $19.99 per year to more than $1,000 per year.
Some bundle this with other services, and some sell bulk subscriptions so that
organizations can offer these services to their employees.
We, the authors of this report, are often asked how effective these services are,
especially when compared with filling out opt-out forms for each site individually, and
3
Data Defense: Evaluating People-Search Site Removal Services
which ones we would recommend. So we decided to evaluate seven of these services
to try to get a sense of how well they work, and whether some are more effective and
reliable than others.
Disclosure: In 2022, Consumer Reports launched Permission Slip, a mobile app that
makes it easy to take control of your personal data. The app shows users what kinds of
data companies collect, and lets you tell a company to stop selling your data or to delete
your data entirely. While Permission Slip does remove data from some people-search
sites, it was not evaluated in this report because it does not offer comprehensive
people-search site removal at this time, though it may in the future. This project was
completed independently.
4
Data Defense: Evaluating People-Search Site Removal Services
Why It Matters
People-search sites are largely unregulated, their practices and operations are
generally opaque, and navigating them can be confusing and time-consuming for
consumers.
No federal laws give consumers the right to “opt out” of people-search sites—that is, to
prevent the sites from collecting and selling data about them and to have existing data
about them deleted. Several states have passed laws intended to give consumers
opt-out rights, but only some sites offer mechanisms for consumers to exercise those
rights, while others rely on loopholes in denying those rights. (For instance, several
state data privacy laws contain exemptions for public information.)
Some people-search sites do allow users to opt out, either voluntarily or in compliance
with state laws. But doing so across many sites is time-consuming, complicated, and
often frustrating. The process differs from site to site. Some require users to create
accounts and/or divulge information (such as driver’s license numbers or current phone
numbers) as a prerequisite for opting out. Some have practices that make it all but
impossible to opt out—by, for example, requiring users to have access to defunct
accounts, such as an old email address that they no longer use. Some even use
deceptive designs that appear intended to trick users into signing up for subscriptions or
other paid offerings.
Even when users successfully navigate a site’s opt-out process, it doesn’t always work:
The information sometimes doesn’t actually get removed, sometimes doesn’t get
removed for weeks or months, and sometimes gets removed but then reappears weeks
or months later.
In addition to all these practical concerns, people-search sites are problematic because
they collect information that was never shared voluntarily, and they create profiles of
private individuals without their knowledge or consent.
Some people are not troubled by this, knowing that there is already information about
them online that they have shared themselves on social media sites like Facebook and
LinkedIn. Social media sites have data privacy problems of their own, of course. But
users of social media websites are usually aware that at least some portion of the
information they are sharing can be seen by the public. When we (the authors of this
report) have shown people how much information is available about them on
people-search websites in both our personal and professional capacities, they are often
5
Data Defense: Evaluating People-Search Site Removal Services
shocked—much more so than when the social media profiles they created themselves
turn up in a search engine result.
Many people want to pay services to do the work of removing their information from
people-search sites for them, but it’s not clear how people-search site removal services
stack up. Consumer Reports’ Security Planner teamed up with digital safety
organization Tall Poppy to analyze the effectiveness of paid people-search site removal
services.
6
Data Defense: Evaluating People-Search Site Removal Services
Methodology
Consumer Reports conducted the test using 32 volunteer test subjects, each of whom
agreed to allow us to use people-search removal services to attempt to delete their
personal data profiles from people-search sites and then evaluate the results.
The 32 participants were selected from among a larger group of willing volunteers who
were recruited by email because they a) had previously participated in Community
Reports, a participatory science project of Consumer Reports; b) were based in New
York or California, for reasons we explain below; and c) had indicated an interest in data
privacy-related projects.
From that larger group, we eliminated anyone who had previously used a people-search
removal service or opted out of people-search sites (to make the sample more
consistent and to increase the likelihood of finding data to remove for all participants).
We also eliminated volunteers who had not lived at their current address for at least two
years, and those who had highly common surnames, which would make it relatively
difficult to isolate their profiles on people-search sites.
We selected volunteers only from California and New York because California’s robust
digital privacy law, the California Consumer Privacy Act, requires data brokers to make
opt-outs publicly available and respond to opt-out requests. We wanted to see whether
that law actually makes it easier to opt out of people-search sites compared with New
York, which currently has no state privacy law.
Finally, we chose to split the participants between people who own their homes and
people who rent their homes, to see whether different types of real estate records would
receive different treatment.
Our final group of 32 participants consisted of four groups: eight New York State
residents who own their homes, eight New York State residents who rent their homes,
eight California residents who own their homes, and eight California residents who rent.
We used seven people-search removal services (Confidently, DeleteMe, EasyOptOuts,
IDX, Kanary, Optery, and ReputationDefender) to attempt to delete participant profile
data from 13 people-search sites (BeenVerified, CheckPeople, ClustrMaps, Dataveria,
Intelius, MyLife, Nuwber, PeopleFinders, PublicDataUSA, Radaris, Spokeo, ThatsThem,
and Whitepages).
7
Data Defense: Evaluating People-Search Site Removal Services
These sites and services were selected in collaboration with our partner, Tall Poppy, an
organization that builds tools and offers services to help companies protect their
employees against online harassment and abuse. We picked people-search sites that
are generally the most widely used in their categories and the most likely to appear on
the first page of a Google search. (See the Appendix for more information about the
people-search removal services.)
With each group of eight participants, seven participants were randomly assigned one
of the people-search removal services; for the eighth, we manually opted out of the 13
people-search sites, to set a baseline for comparison. This means that we evaluated
each of the people-search removal services with four participants, one from each of the
four groups.
The test was conducted over a four-month period, between May and September 2023.
We first did an initial search to see what data we could find about the participants on the
13 people-search sites. We then signed up each participant for a people-search
removal site (or, for the control group, manually requested deletion at each of the 13
people-search sites). We then checked each of the 13 people-search sites for data
about the participants three different times—one week later, one month later, and four
months later—and recorded the results. Specifically, we looked to see whether profiles
containing their personal information were still on the sites or had been removed.
We gathered additional information about the people-search removal services from their
respective websites and by emailing them questions regarding their policies, such as
whether they would consider the personal data they have collected to be a corporate
asset in the case of bankruptcy, a merger, or an acquisition. The results of these
inquiries are contained in the Appendix. The Appendix also includes additional
information on the people-search site removal services, including their cost and the
number of brokers they remove data from.
8
Data Defense: Evaluating People-Search Site Removal Services
Limitations of This Study
This study included a relatively small sample size and participants were selected from
among volunteers in the non-random process described above, so we do not consider
the results statistically significant or nationally representative.
In addition, it is important to note that we provided the opt-out services with a limited
amount of information, including name, current address, and date of birth. Because
some people-search removal services decide to leave information online if they are not
certain it belongs to the person requesting an opt-out, it’s possible that providing
previous mailing addresses and other supplemental data would have yielded better
results. In one instance, for example, a removal service asked for names of the
participant’s relatives and the relatives’ addresses, which we did not provide.
Services often provided options to upload a driver’s license or state ID, which we did not
do. There were sometimes options to enter a middle name (which we did only if
required) or to add a phone number. In some instances, the phone number required
verification from someone with access to that phone, in which case we did not enter a
number.
Another important caveat is that while some people who purchase a subscription to a
people-search removal site will diligently check their user dashboards, respond to
follow-up questions, and/or file manual requests as needed, our participants did none of
these things. We signed users up and then let the services run without further
intervention. In addition, some people-search removal services also offer additional or
enhanced services beyond the standard ones we evaluated.
Finally, we evaluated the presence of information only on the same page we originally
found it on. It’s possible that variations of profiles cropped up on different pages within
the same people-search sites. We also did not test for the reappearance of profiles after
finding that the user had been deleted from the broker, with the assumption that they
would remain deleted. That means that if the profile was gone after a week, we did not
recheck it after one or four months.
9
Data Defense: Evaluating People-Search Site Removal Services
Findings
1) As a whole, people-search removal services are largely ineffective.
Private information about each participant on the people-search sites decreased after
using the people-search removal services. And, not surprisingly, the removal services
did save time compared with manually opting out.
But, without exception, information about each participant still appeared on some of the
13 people-search sites at the one-week, one-month, and four-month intervals.
We initially found 332 instances of information about the 28 participants who would later
be signed up for removal services (that does not include the four participants who were
opted out manually). Of those 332 instances, only 117, or 35%, were removed within
four months.
Table 1
Profile Removals for People-Search Removal Services
Initial Number of
Profiles
Profiles Removed
Within 1 Week
Profiles Removed
Within 1 Month
Profiles Removed
Within 4 Months
332
26% (86)
30% (100)
35% (117)
Some services performed better than others. EasyOptOuts and Optery performed the
best of the services we evaluated. (Notably, EasyOptOuts was also the least expensive
service we evaluated, at $19.99 per year.) DeleteMe, IDX, and Kanary were midlevel
performers. Confidently and ReputationDefender performed the worst.
10
Data Defense: Evaluating People-Search Site Removal Services
Table 2
Removal Success Rate for People-Search Removal Services
People-Search
Removal
Service
Annual Cost
(as of July
2024)
Profiles
Removed
Within a Week
Profiles
Removed
Within 1 Month
Profiles
Removed
Within 4
Months
Confidently
$120
0%
2%
4%
DeleteMe
$129
13%
20%
27%
EasyOptOuts
$19.99
59%
61%
65%
IDX
(Privacy Tier)
$139.92
38%
38%
40%
Kanary
$179.88
16%
26%
34%
Optery
(Ultimate Tier)
$249
52%
58%
68%
Reputation
Defender
(Privacy Pro)
$99
2%
4%
6%
Manual
opt-outs
$0
70%
70%
70%
2) Manual opt-outs were more effective than people-search removal services but
were also far from perfect.
When we searched the 13 people-search sites for information on each of the four
manual opt-out participants—one from each residence type group—we found 47
profiles.
After opting out those four participants at each of the 13 people-search sites, 33 of
those 47 profiles were gone after the first week, and three more were gone after the first
month. (No additional profiles had been removed after four months.)
That’s a “success rate” of about 70%, compared with a success rate of anywhere from
6% to 68% for people-search removal services.
11
Data Defense: Evaluating People-Search Site Removal Services
Of course, this suggests that not even the time-consuming process of filling out opt-out
forms at many different people-search sites is likely to completely rid the internet of
people-search profile data.
It’s worth noting that opting out manually also had quicker results, with 70% gone within
a week, compared with anywhere from 0% to 58.7% removed in the first week via the
people-search removal services.
3) Of the information removed within four months, most was removed within a
week.
We added up the number of times we saw a volunteer’s information on a people-search
site and found a total of 379 such instances, including the manual opt-out group. Of
those, 150 were removed—119 (almost 80%) within a week, 14 additional within a
month, and 17 more by the four-month mark.
Opting out manually generally had quicker results, with 33 of the 47 profiles (70%) gone
within a week, compared with 86 out of 332 (26%) removed in the first week via the
people-search removal services, ranging from 0% to 59%.
4) Some people-search removal services advertise on or partner with
people-search sites.
While we were performing opt-outs, we found that some people-search removal sites
advertised on or even partnered with people-search sites. We see this as an implicit
endorsement of the inherently problematic people-search ecosystem.
For example, after removing a volunteer’s data from ClustrMaps, we saw an ad for data
removal service Onerep. (There has been additional reporting on Onerep’s ties to
people-search sites on security news website KrebsOnSecurity.)
12
Data Defense: Evaluating People-Search Site Removal Services
Additionally, the people-search site PeopleFinders advertised for the people-search
removal site BrandYourself.
5) We found no significant difference in the success rate of removing data
between renters and homeowners.
We chose to split the participants between people who own their homes and people
who rent their homes to see whether different types of real estate records would receive
different treatment. In our evaluation, there was no significant difference: About 40% of
13
Data Defense: Evaluating People-Search Site Removal Services
New York homeowners’ data was removed, compared with 46% of renters’ data. For
California, about 34% of homeowners’ data was removed, compared with about 38% of
renters’ data.
Table 3
Participants
Initial Number
of Profiles
Profiles Removed Within 4
Months
New York homeowners
96
40% (38)
New York renters
99
46% (46)
California homeowners
88
34% (30)
California renters
96
38% (36)
6) Some people-search sites removed more data in response to removal service
requests than others.
The three people-search sites from which removal services had the most difficulty
removing data were CheckPeople, PublicDataUSA, and Intelius. The three that were
the best at complying with requests from removal services were PeopleFinders,
ClustrMaps, and ThatsThem.
14
Data Defense: Evaluating People-Search Site Removal Services
Table 4
Name of
People-Search Site
Profiles Removed
Within a Week
Profiles Removed
Within 1 Month
Profiles Removed
Within 4 Months
BeenVerified
32%
48%
55%
CheckPeople
13%
13%
16%
ClustrMaps
50%
50%
59%
Dataveria
31%
31%
31%
Intelius
13%
20%
20%
MyLife
32%
32%
36%
Nuwber
35%
38%
42%
PeopleFinders
53%
66%
66%
PublicDataUSA
12%
12%
19%
Radaris
28%
31%
31%
Spokeo
29%
29%
39%
ThatsThem
38%
42%
58%
Whitepages
45%
45%
48%
15
Data Defense: Evaluating People-Search Site Removal Services
Appendix: The Providers We Tested
The following descriptions are current as of July 2024, though some have changed from
the period in which we did our initial testing. Some of the providers offer free tiers, which
we did not evaluate.
Confidently charges $120 per year ($10 per month) to remove information from
500-plus businesses, including data brokers. It offers a 30-day free trial period.
Confidently members also receive data breach alerts if their information is found in other
databases.
DeleteMe charges $129 for an individual for one year or $209 ($8.71 per month) for two
years, with discounts for multiple users. It can remove data from hundreds of
businesses, depending on the tier. Reports are provided quarterly. DeleteMe’s privacy
policy states that it “may sell, transfer, or otherwise share some or all of our business or
assets, including your personal information, in connection with a (potential) business
transaction such as a corporate divestiture, merger, consolidation, acquisition,
reorganization or sale of assets, or in the event of bankruptcy or dissolution.” Some
privacy-minded subscribers might not want their information to be used this way.
EasyOptOuts charges $19.99 per year to remove data from 134 data brokers directly,
which leads to 42 indirect removals from data brokers that source their information from
the other brokers. Removals take place every four months. The company heavily
redacts personal data even when a user is signed in, in case of unauthorized access.
IDX charges $107.52 to $355.32 annually, depending on the tier, or $9.95 to $32.90 per
month for an individual account, to remove data monthly from over 100 data broker sites
per month. IDX owner ZeroFox’s privacy policy states that it may use and disclose
personal information, including to “transfer your information in the case of a sale,
merger, consolidation, liquidation, reorganization, or acquisition,” but that the acquirer is
16
Data Defense: Evaluating People-Search Site Removal Services
subject to obligations under its policy, including your rights to access and choice, and
that it will notify users of this change via either email or a notice posted on its websites.
Some privacy-minded subscribers might not want their information to be used this way.
Alarmingly, IDX’s connection to verify email addresses was not secure at the time of our
evaluation because it did not support HTTPS, or Hypertext Transfer Protocol Secure.
HTTPS is the secure version of HTTP, the protocol used to send data between a web
browser and a website. HTTPS uses encryption to increase the security of data transfer,
and to prevent information you exchange from being spied on or changed while it is
traveling across the internet.
Kanary charges $179.98 annually or $16.99 per month for an individual, with an
additional monthly fee of $8.49 or annual fee of $89.98 per family member. It offers a
14-day trial period. Kanary scans the web for personal data on 1,000-plus data broker
sites, search engines, data breach sites, and doxing sites (sites that post personally
identifiable information about people or organizations, often without their consent), but
members can run scans whenever they want and send in additional profiles that the
scans didn’t cover for removal.
17
Data Defense: Evaluating People-Search Site Removal Services
Optery charges anywhere from $39 to $249 per year (or $3.99 to $24.99 per month) to
remove information from 320-plus data broker sites once a month or more. “Ultimate”
subscribers can submit unlimited custom removal requests for data brokers not already
covered by their plan. One area of concern: Optery states in its privacy policy that in the
event of a merger, acquisition, or asset sale, “your Personal Data may be transferred as
a result of the business transaction.” Some privacy-minded subscribers might not want
their information to be used this way. Users will have at least 30 days to delete their
account in advance of the close of the business transaction.
ReputationDefender typically charges $1,000 to $5,000 per year for services but also
offers a less expensive tier, Privacy Pro, that is $99 per year or $9.95 per month. The
site says it removes data from more than 900 brokers either quarterly or monthly,
depending on the tier, with custom removals available at the higher tiers. At the $99 tier,
data is removed from about 50 sites. ReputationDefender’s privacy policy states that
customer account information may be shared with a successor company in the case of
a merger or acquisition, or during the process of diligence (pre-transaction assessment)
leading up to the transaction itself, though “the processing of your Personal Information
would continue to be bound by this Privacy Policy unless and until it is amended.”
18
Data Defense: Evaluating People-Search Site Removal Services
Acknowledgments
This report was supported by a number of people both within and outside Consumer
Reports. We would like to thank the following people for their contributions to this report:
Noreen Browne, Andrew Dunham, Chris Griggs, Jonea Gurwitt, Stacey Higginbotham,
Jeff Landale, Scott Medintz, Debasmita Morgan, Alan Smith, and Sam Stuber. Thank
you also to the Community Reports volunteers.
19
