Did you ever Google yourself or a friend, foe or family member and find their home address or apartment immediately? That information appeared because your address is a public record, and it’s one the most benign parts about you that’s considered a public record.
A public record is any information that is “not considered confidential and generally pertain to the conduct of government.” Public records can include...
Assets you own
Liens, judgements, lawsuits and bankruptcies
Arrests and mugshots
Social media (if a company can link it to you)
Email addresses (if you publicly post it, or a company publicly links it to you)
Family members
While some of this information was always considered public record, now that the Internet enables anyone online to find your public records, the impacts you may face from exposed public records increases substantially.
Who is putting my public records online?
Linkedin is a major perpetrator. They allow third parties to pull (or buy) their data, and you are likely putting more accurate on your LinkedIn page, so it’s more dangerous than less reliable information. I say this because…
Very specific information about myself that exists online can only be attributed to my LinkedIn page.
Most of the phishing campaigns against employees I see are emails that have been leaked in third-party breaches. A lot of these third parties sites that are breached pull or purchase data from LinkedIn.
There are two types of companies that will hold your data:
FCRA-compliant companies. If a company wants to make a hiring decision about you, or wants to check your credit report for hiring/firing purposes, they are required by law to get the information from an FCRA-compliant company.
FCRA stands for the Fair Credit Report Act, a Federal law passed to protect U.S citizens from companies exploiting their information surreptitiously.
NON-FCRA compliant companies. These companies acknowledge and proclaim that their information cannot be used in hiring positions. Becuase they don’t comply, they don't have to adhere to any guidelines or regulations. They can therefore do what they want with your data that they purchase or find online.
BeenVerified’s statement on how they are not FCRA. Most information brokers will say they are not FCRA compliant, demonstrating how you, the end user, can or can’t consume their data.
These non-FCRA compliant companies, or Information Brokers, can be dangerous, because they don’t have to vet your data as accurate. They can simply post what they want about you. If you have ever been arrested and had a headshot taken, that information (depending on the state) can be posted online. Even if you were never convicted of a crime, your headshot can permanently end up on Information Broker websites. The true criminal part? You have to pay to take your mugshot offline, even if you weren’t convicted of a crime.
What can I do to take down this information?
Depends on the site. What's dangerous is that U.S. law does little for protecting citizens’ public records online. This means that companies can collect massive amounts of U.S. citizens’ data, post that data online, and sell it to other companies to do the same - as long as it is not used for employment or credit card purposes.
Steps for removing your data from Information Brokers.
Identify what sites have your information, and follow the below steps. For many websites, you have to “claim” yourself in order to say you don’t want your information shared. Search multiple versions of your names to ensure you claim all of your identities.
Mylife:
Email [email protected] or call 1–888–704–1900 and use your best (non) customer telemarketing skills to remove your data. Full removal takes ~1 business week to remove. Here is a video about writing an email for those require extra guidance.
BeenVerified:
Search for your information on their Opt Out Page, and click on the accurate information you find.
Provide an email address for a verification link. Click on the verification link, and wait ~24h-1 week for your information to be removed.
I don’t recommend providing a regularly used email address. Create a temporary email for public records verifications. It’s worth noting BeenVerified is more strict with what specific email you provide them - they won’t accept 33mail or 10-minute mail accounts.
Intelius:
Search your identity and claim/confirm it
Enter an email (a disposable email, if you think Intelius is tracking your email)
Receive verification code (takes ~5mins)
Screenshot, save, keep track of your confirmation code.
Make sure to do this for any alternate versions of your name. See below for a slideshow of how to opt out. Wait a few days to confirm your information is no longer on the website.
Spokeo
Open two new browser tabs: One tab for searching your name, and one for opting out.
Search your name on their site (or search versions, abbreviations of your name first) using the first tab, and use the second to paste the URL of your search.
Enter an email (maybe a trash email so they don’t track your email address?)
Receive verification code (takes ~5mins)
Save a copy of your verified opt out and check in 1 business week to make sure it’s removed.
Note on Spokeo: My information was terribly inaccurate, so I chose not to opt out. Providing disinformation can benefit you in hiding your location.
Radaris:
Search for your information on their homepage.
Hit this tiny arrow next to a giant orange button, and “Control Information”
You have to create an account to claim your information, which is really dumb.
This is why I suggest using a trash email and a VPN. These data brokers are likely tracking additional information about you to attach with future information they find.
You have to put in your phone number with a verification code.
Download a texting app to do this, again. Don’t trust these sites with your accurate information. I suggest Burner.
Once you verify your number, you can hide your information publicly. Again, you have to do this with every variation of your name.
Once your information can be found online, it can be very difficult to take down. Sometimes you need to provide MORE information or even pay to take down your information. Paying attention to key privacy concepts will help prevent you from getting to this point.
Key points:
Your address, phone number, and social media accounts fall under this giant bucket called "public records." Public Records are information about you that are technically available to the public. More information about you is of public record than you realize.
Your information will be online intermittently because public records find new ways to aggregate data. Use the above steps to keep your information offline.
Some information might be inaccurate. Keep it. Disinformation works to your advantage.
Assume your information has already been leaked. You are now conducting damage control on what the average person can find on you.