F*CK Data Brokers

The Basics:

We have all done it, googled ourselves at 2am, morbidly curious about what the internet thinks it knows about your life. We will also sheepishly admit to searching up friends who we have lost touch with, and seeing how many kids our old crushes from high school have. Don't pretend you haven’t done it, we know you have!

But what if you weren’t comfortable with any random person being able to find out your age, your relative’s names, your phone number, where you used to live, where you currently reside? What if there was a very specific person you don’t want to have be able to access that information? Beyond just being uncomfortable with strangers discovering personal information, there are thousands of survivors of domestic abuse who, justifiably, don’t want their ex-partners to be able to show up at their new homes. The pervasive availability of this information has literally cost people their lives.

What can be done about this? Well, if you live in the United States not very much. While states like California have their own laws that try to protect the personal data of their citizens there is no law on the federal level that regulates what data about an adult can be made available for free or sold on the internet, and certainly no regulations requiring that your data be expunged when you request it. Many of the data broker sites have an “opt-out” form that you can fill out, but there is nothing that requires them to fulfill that request. But even if they do remove your data, it may just be temporary, as they can re-add your profile on their site at any time.

No big deal you say, you’ll just take an evening every month and manually request removal from all these services. Technically you could do that, but we will remind you that they are not at all required to honor these requests, but even if they do there are more then four thousand registered data brokers out there, and though not all of them sell their services to the general public the ones that do number in the hundreds. Still, if you believe that you can submit requests for removal on a regular cadence let us throw you another curveball. Since there is no regulation to require data brokers to remove your data there is also no standardization for what these companies can extort in return for “doing you this favor“. Admittedly some make it as easy as flagging your specific profile for removal. While others demand that you give them more information - such as your birthdate or a photo of your license - to prove your identity before they remove anything, and since there is no legal requirement for them to actually remove your data they can simply store this new data and then post or sell it at their leisure.

In our opinion, the worst offenders are the data brokers who masquerade as data broker removal services, companies we refer to internally as data scrubbers. Instead of allowing you to simply request removal from their site they will direct you to a “partner company“ - which they almost certainly own - which will charge you a fee to remove you from this site and all other data broker sites this one company owns. Essentially what these data brokers are doing is creating the problem and charging you for the solution.

So is it all hopeless? Our answer, kind of. The only way to address this problem is policy from the federal level, which doesn’t look like it is coming anytime soon. Keep in mind this post only addresses data brokers that sell information to the public, not companies like Facebook that collect thousands of terabytes of data a minute to sell to advertisers.

Our Recommendation:

What makes it only kind of hopeless is that there are companies not affiliated with the data brokers who you can pay to scrub as much of your personal information. We don’t love that any company will profit off our personal data, but we would rather it be made by working to remove our information than by selling our data to whoever wants it. When the team at We Assume Breach was searching for a company we could pay to brute force the solution for us our research lead us to a company called Removaly.

Removaly is a relatively new player to the game - as it was founded in 2020 - and is a small company founded by people who share our hatred of data brokers. Not only is their GUI sleek and simple to use, they are also incredibly responsive to any problems we encounter. Their services aren’t cheap - it is about $120 per person per year - but it is a price that we are willing to pay to have our personal data removed from the 50+ most common data brokers. They also scan for your data everyday and continuously submit requests for removal on your behalf. While they do not remove your data from every single data broker, they are constantly adding services they can remove from and overall they make it much harder for interested parties to find sensitive information about you.

In short, fuck data brokers, and we hope that there will eventually be federal legislation that recognizes our right to privacy.