How Public Records Sites Expose You to Identity Theft and Doxxing

Paid data-removal services cleared 35% of their customers’ records from people-search sites within four months. Opting out by hand, one site at a time, cleared 70%, according to Consumer Reports. Both figures describe partial success against the same adversary, and neither is a fix.

That adversary is built from government records that most people cannot delete at the source. A name joined to an address, a birth date and a list of relatives is all identity theft and doxxing need. So the question of how to remove personal information from the internet has no clean answer. What follows is what those records expose, what the law now does, and what removal actually achieves.

Key Takeaways

• Paid removal services cleared 35% of customer records within four months, against 70% for opting out by hand, per Consumer Reports’ 2024 study.
• The FTC logged 1.1 million identity-theft reports in 2024, 18% of everything its Consumer Sentinel Network received.
• California’s privacy regulator forced a people-search site holding billions of public records to shut down for three years, for failing to register as a data broker.
• Threats and other inappropriate communications against federal judges and judiciary staff rose from 926 in 2015 to about 4,449 in 2019, which Congress attributed partly to online access to information.
• Identity-theft cases the Internal Revenue Service closed in fiscal 2024 took an average of over 22 months to resolve.
• California data brokers have had to honor one-click deletion requests since August 1, 2026, tightening to at least every 30 days from January 2027.
• The FBI logged 11,672 harassment or stalking complaints in 2024, and a March 2025 survey found 4 states that name doxxing in law, with others covering it under different wording.

What Public Records Actually Expose About You

The California Privacy Protection Agency publishes its own inventory of the data-broker trade, meaning the companies that collect and sell the personal information of consumers they have no direct relationship with.

It names Social Security numbers, driver’s license numbers, dates of birth and home addresses. The same advisory adds precise geolocation, biometrics, and data on reproductive health, citizenship and union membership. That list runs wider than most people assume.

Destinations run wider still, per CalPrivacy’s advisory. Broker data can reach federal and state governments, foreign actors and developers of generative AI models. Consumers have no direct relationship with these companies, so they may not know which hold them.

Scale surprises people. One California people-search site, Background Alert, had amassed billions of public records. It drew inferences from them to identify people who “may somehow be associated with” whoever was being searched for. Its own marketing line, per the settlement, was “It’s scary how much information you can dig up on someone”.

What eventually closed it was a registration rule rather than a privacy rule. Inference turns separate filings into a dossier:

• Property deeds supply a current address and a purchase date.
• Court dockets supply a case history and, in civil filings, often a home address.
• Voter files supply a name, an address and an age band.
• Marriage and divorce records supply relatives and former names.
• Commercial data layered on top supplies phone numbers and email addresses.

Getting out of a database like that one means filing a request with each site separately. Outside California’s one-click platform, no single switch exists to pull, which is the gap paid removal services sell into. ClearNym, whose per-broker opt-out guide the link opens, sets out the steps on its own site.

It says it searches over 259 data broker sites for a name, address, phone number and age, submits the opt-out forms, routes ambiguous matches to human review, then keeps checking for re-uploads. Its pricing page writes it as 259+, so treat it as a floor, not a fixed total.

Price comes two ways. The homepage lists $29.90 a month with a 14-day money-back guarantee; the pricing page lists $16.50 a month billed annually, marked 45% off, which works out to $198 charged once a year.

Two caveats belong with that. Its own figures carry no independent source, and it was not among the seven services Consumer Reports measured, so no removal rate below describes it. The monitoring step still tells you something, because a service only watches for re-uploads when removal does not hold.

There is a way to look for yourself. California’s Data Broker Registry gives consumers visibility into who is brokering their personal information, though the agency reports brokers failing to provide true and correct information in their registrations.

Pew Research Center’s 2023 survey of US adults found the same lack of visibility, reporting that 73% feel they have little or no control over what companies do with their data, and that 67% say they understand little or nothing about it. Wider data privacy attitudes track that gap over time. Each record type also reaches the brokers by its own route, and that route decides what rights come with it.

Which Public Record Feeds Which Broker

The Judicial Conference of the United States requires five categories of identifier to be redacted from federal filings, and home addresses are on that list for criminal cases only. Public records are not one category with one rule, and each class carries its own removal path.

Each class is opened by a different statute and held by a different office, which is why a single opt-out request never covers a person completely.

Source: Judicial Conference of the United States and Federal Trade Commission, for the court and mobile-app rows. The property, voter and vital-records rows describe how those registers are commonly held, and are not drawn from a cited source.

Court rules are the ones most often misread. That redaction list sounds comprehensive until it is read closely.

Key finding: The Judicial Conference’s redaction list covers Social Security numbers, names of minor children, financial account numbers and dates of birth. Home addresses are on it for criminal cases only. A home address in an ordinary civil filing is outside that list, so one of the most useful identifiers for an attacker is also one of the least protected.

App data arrives by a different door. An FTC order barred InMarket Media from selling or licensing precise location data. The company had collected location information from its own apps and from third-party apps carrying its software development kit. A profile is only a list until somebody uses it.

What an Attacker Can Do With One People-Search Profile

The Federal Trade Commission received 1.1 million identity-theft reports in 2024, or 18% of everything filed to its Consumer Sentinel Network. Identity theft is the harm a public profile most directly enables, though the agency logged more fraud reports overall.

Credit card misuse tops the category. Some 449,032 reports came from people whose information was used on an existing card or to open a new one.

Geography concentrates it. Florida, Georgia, Nevada, Texas and Delaware recorded the highest per-capita rates of reported identity theft in 2024. Fuller identity theft reports break those categories down, and vishing statistics cover the phone-based follow-up a leaked address and number enable.

Repair timelines rarely sit beside the exposure numbers. Identity-theft victims waited an average of over 22 months for the IRS to resolve cases it closed in fiscal year 2024. Set that against California’s statutory cadence, which requires a data broker to access the state platform at least every 45 days to retrieve and process deletion requests.

Asymmetry on that scale is hard to miss. The remedy is measured in weeks and the damage in years. These are two agencies’ clocks rather than one metric, though a person living through both meets them in sequence. Financial fraud is the measurable harm; the one that puts people in danger is harder to count.

Don’t chase tech news. We track it for you.

One weekly briefing with the launches, AI developments, and breaches that matter. No filler.

Email address

Subscribe Now

Read by pros at Fortinet, TSMC, Barclays, and Deloitte.

What Doxxing Is, and How One Profile Feeds It

The FBI logged 11,672 harassment or stalking complaints in 2024. Doxxing means publishing someone’s private identifying details so that others can reach or intimidate them, which is one route into complaints of that kind.

Complaint data captures only fragments of the behavior. The Internet Crime Complaint Center also recorded 86,415 extortion complaints and 64,882 personal data breach complaints that year.

Those counts catch doxxing only where it surfaces as another crime. Our records exposed this year tracker covers the breach side of the same supply, and broader cybersecurity statistics set the scale.

Regulators describe the downstream risk in the same terms. “In the wrong hands, these lists could be used to target people for more than just advertising”, said Michael Macko, the head of enforcement at CalPrivacy, announcing a case against a broker that resold health-condition lists.

Congress has written the mechanism into statute with numbers attached. Threats and other inappropriate communications against federal judges and judiciary personnel rose from 926 in 2015 to approximately 4,449 in 2019. That is a 4.8-fold rise across four years. Those findings name ease of access to free or inexpensive sources of covered information as what lowered the effort needed to find where individuals live.

One case sits behind that statute. An assailant obtained the home address of Judge Esther Salas’s family on the internet, posed as a courier, and killed her 20-year-old son Daniel Anderl. The resulting bill was written to protect judges’ personally identifiable information from resale by data brokers. Congress and several states have legislated against that mechanism, and what the law hands a private individual is narrower.

Is doxxing illegal in the US?

No general federal doxxing statute covers the public at large, though federal law does protect judges’ details. A March 2025 survey of all fifty states and the District of Columbia found only 4 states, Alabama, Arkansas, Illinois and Washington, that criminalize doxxing or create civil actions for it under that name. Elsewhere it turns on the state, and often on the victim’s occupation.

That survey, filed as committee testimony in Vermont, maps the remainder. It sorts them into four further groups:

• Arizona, California, Kentucky, Nevada, Oregon, Texas, Utah and Virginia target unconsented disclosure of private, personally identifying information without calling it doxxing.
• Colorado, Minnesota, Oklahoma and West Virginia cover certain professions or population subgroups only.
• Florida, Georgia, Massachusetts and New York were in the process of adopting laws targeting doxxing.
• The remainder had no explicit or implicit provision when the survey was filed.

Occupational protection is where the strongest rights sit. New Jersey’s Daniel’s Law bars disclosure of covered persons’ residential addresses on state, county and municipal government websites. It also lets an authorized person serve written notice on any other publisher, requiring it to stop disclosing and remove the information.

Those rights have now been tested in court. The New Jersey Supreme Court ruled in Kratovil v. City of New Brunswick. Decided June 17, 2025, a unanimous Court upheld Daniel’s Law against an as-applied challenge. The court treated the official’s address as truthful information, lawfully obtained, on a matter of public concern, but held that Daniel’s Law serves a state interest of the highest order and, as applied to prevent that republication, is narrowly tailored to it.

That ruling marks the current outer limit. A removal-on-demand right can survive a press challenge when it is drawn tightly around a protected class.

For everyone outside a covered occupation, the remedy is the opt-out form, and its measured record is the subject of the next two sections.

Why Opting Out Rarely Sticks

Consumer Reports and the digital safety organization Tall Poppy measured removal directly rather than trusting vendor claims. They recruited volunteers and attempted to remove their data from 13 of the most prominent people-search sites. Across 28 participants signed up for removal services, they found 332 instances of personal information. Only 117 of those, or 35%, were removed within four months.

Curve shape matters more than the headline. Removal reached 26% within one week and 30% within one month before arriving at 35% at four months. Most of what came down over the study window came down in week one; the three months after the one-month mark added five points.

By the numbers: Of 332 profile instances tracked across 13 people-search sites for the paid-service group, 86 were gone within a week. That reached 100 within a month and 117 within four months. The remaining listings were 64.8% of that group’s original set.

Keeping a profile down is a standing obligation rather than a one-off deletion. California’s rules now require brokers to keep a record of deletion requests so information stays deleted going forward. Each broker must report the status of every request within 45 days of retrieving it.

Those figures describe the paid route. The same study measured what happens when people file the forms themselves.

Do paid removal services actually work?

Paid services work partially and unevenly, and the spread between vendors is large. Consumer Reports found the best two services reached 68% and 65% of records at four months, and the weakest two 4% and 6%.

Source: Consumer Reports and Tall Poppy, Data Defense (2024)

DeleteMe, IDX and Kanary were midlevel performers between those ends. No service matched the manual opt-out group, which itself worked only 70% of the time.

Sample design is worth knowing before weighing those numbers. The study recruited 32 volunteers and assigned groups of four to each of seven services, leaving a final group of four to opt out by hand. The manual figure therefore rests on four people, and the paid figures on four apiece.

• Seven services were evaluated: Confidently, DeleteMe, EasyOptOuts, IDX, Kanary, Optery and ReputationDefender.
• EasyOptOuts was the least expensive evaluated, at $19.99 a year in 2024.
• Norton was not among the services tested, so that study says nothing about its product either way.
• Every participant’s information still appeared on some of the 13 sites at the one-week, one-month and four-month checks.

Price and performance did not track each other, which is the most useful finding for anyone comparing plans. Reporting these measurements is not the same as recommending a vendor. Both routes are private workarounds, and one state built the plumbing instead.

Your Opt-Out Rights, and California’s One-Click Experiment

California has built a first-of-its-kind, state-hosted deletion channel. Its Delete Request and Opt-out Platform, DROP, lets consumers request deletion of all personal information held by multiple data brokers with a single click. Those regulations took effect on January 1, 2026, and the obligations phase in on the dates below.

Source: California Privacy Protection Agency, California Civil Code Title 1.81.48

The broker-side duty is live. Brokers have had to process DROP requests since August 2026, moving to at least every 30 days from January 1, 2027. Its design avoids handing them more data than they hold already. Consumer identifiers are hashed immediately on collection, brokers hash their own records to match, and no raw personal information is shared.

Penalties are structured per request rather than as a flat fine. The statute sets a fine of $200 for each deletion request for each day a broker fails to delete as required. Failing to register costs a further $200 a day.

Enforcement has already landed. Background Alert agreed to shut down operations for three years or face a $50,000 fine, after the agency alleged it failed to register. Rickenbacher Data, trading as Datamasters, was fined $45,000 and ordered to stop selling Californians’ personal information. It had resold lists of people with Alzheimer’s disease and other health conditions, along with “Senior Lists” and “Hispanic Lists”.

Both actions ran on registration failures rather than on privacy harm. That is a telling detail about where the working leverage sits. Other privacy enforcement actions follow a similar shape.

Federal policy moved the other way in the same period. The Consumer Financial Protection Bureau withdrew its proposed data-broker rule under Regulation V on May 15, 2025. It determined that legislative rulemaking was “not necessary or appropriate at this time”. Read as one timeline, the two tracks diverged inside twelve months.

How much does it cost to remove your information from the internet?

Cost and performance did not line up in the testing. EasyOptOuts cost $19.99 a year, the least expensive service evaluated, and placed among the two strongest performers, while weaker options cleared 4% and 6% of records at four months.

Opting out by hand costs nothing but time. It also measured better than every paid option in that testing.

How can I remove my personal information from the internet for free?

Doing it by hand measured best in that study. In Consumer Reports’ testing, manual opt-out cleared 70% of records and beat every paid service. The sequence is straightforward, if slow:

1. Search your own name with your city and with former addresses to find which sites list you.
2. Ask search engines to remove results that expose contact details.
3. File each site’s own opt-out form, then save the confirmation.
4. Californians can submit one DROP request covering registered brokers.
5. Re-check after a month, because the study’s removals largely landed in week one.

Timing matters for Californians in particular. Brokers have had to process DROP requests since August 2026, moving to at least every 30 days from January 1, 2027.

Which apps sell your data?

Enforcement records are a more reliable signal here than any list of app names. InMarket Media gathered location data from its own apps and from third-party apps embedding its software development kit. It then cross-referenced users’ location histories with advertising points of interest.

The FTC has acted against several location-data brokers on similar grounds. It alleged that Kochava sold geolocation data drawn from hundreds of millions of mobile devices. X-Mode Social and its successor Outlogic reached the agency’s first settlement with a data broker over sensitive location data, and Gravy Analytics and its subsidiary Venntel settled a comparable action.

Conclusion

Paid removal services cleared 35% of customer records in four months while manual opt-out cleared 70%. That pair remains the clearest measurement of what removal achieves against people-search sites. Records feeding those sites are public by statute, assembled by inference, and resold into a market whose regulator, in both cases captured here, reached it through registration rules.

Anyone whose home address sits in an ordinary civil court filing has least to fall back on, because federal address redaction applies in criminal cases only. Californians have been able to submit one-click deletion requests since January 2026, and the broker-side duty has been live since that August. Two things are worth watching from here: the at-least-30-day processing cadence that arrives in January 2027, and whether any state follows California in building the plumbing rather than leaving removal to the forms.