We re-created that experiment using a fictional person named "Daniel Reyes" and a mock people-search site. Daniel isn't real. The process is. Sites like these build profiles on millions of real people from public records, social media and data they buy from other companies, and they sell them to anyone who asks (FTC).

The good news: you can remove most of it yourself, and most of the tools are free. This guide walks through every step. You'll find which sites list you, get your address out of Google, opt out of the 15 biggest people-search sites, use state laws like California's DROP, and keep your information from coming back.

Quick answer: Start with Google's free Results about you tool. Then opt out of each people-search site that lists you, one at a time, using its official form. If you live in California, file one free request through DROP. Re-check every few months, because listings come back.

Every opt-out link in this guide was checked on October 12, 2026. Sites change their forms often. Where we couldn't load a page ourselves, we say so and tell you to check the current page.

#How data brokers get your information

People-search sites are one kind of data broker. According to the Federal Trade Commission, they put together reports from three main places (FTC):

• Government and public records, such as property records, court records and voter files where those are public.
• Public social media profiles, including names, photos, workplaces and connections you or others have posted.
• Data bought from other companies, including other brokers.

Then they sell those reports to anyone, usually with no questions asked. The scale is large. California alone has more than 600 registered data brokers (CalPrivacy), and brokers resell to each other, so a single record often becomes many listings on many sites. For what's actually in those files, see what data brokers know about you.

Two facts shape everything else in this guide:

1. There's no federal law that gives you the right to opt out of people-search sites (Consumer Reports, 2024). Most sites offer opt-outs anyway, and some state laws require them, but the rules are a patchwork.
2. Opting out doesn't delete the underlying public records. It stops that site from showing and selling your profile. The courthouse or county recorder still has the original (FTC; Spokeo opt-out page).

#How to find out which sites have your information

Before you remove anything, make a list. Opt-out forms almost always ask for the exact URL of your listing, so you'll need it anyway.

Step 1: Search Google. Try each of these, and use quotation marks around your name and phone number:

• "Your Full Name" + your city
• "Your Full Name" + each past city or address
• your phone number in quotes, in both formats: "555-555-0100" and "(555) 555-0100"
• your personal email address in quotes
• your name with a middle initial, a maiden name or a nickname

Step 2: Search the big sites directly. Go to each site in the list below and search your name and state. Many listings don't rank in Google but are still on the site.

Step 3: Keep a tracker. A simple spreadsheet works. Use these columns, and fill in a row for every listing you find:

Step 4: Use a separate email address. Most opt-outs send a confirmation link. A dedicated email address for privacy requests keeps your main inbox out of more databases. Give each form only the information it requires (FTC).

#How to remove your address from Google

Google doesn't host people-search listings, but it's how most people find them, so removing results there cuts off most casual lookups while you work on the source sites. Google's free Results about you tool watches Search for your home address, phone number, email address and some ID numbers, alerts you when they appear, and lets you request removal in a couple of taps. More than 10 million people have used it (Google, Feb. 2026).

Two things to know: Google removes the search result, not the page itself, so you still need to opt out at the source site; and it usually won't remove results from government sites or news outlets (Google Search Help).

Full walkthrough: our step-by-step guide, How to remove your address from Google, covers setup, alerts, removal from the results page, what Google won't remove, and how to clear old cached copies.

#How to opt out of the 15 biggest people-search sites

Every site works a little differently, but most follow the same pattern: find your listing → copy its URL → paste it into the opt-out form → confirm by email or phone. Opting out is free on every site below. If a page asks you to pay to remove your listing, you're not on the official form.

Many of these sites are owned by the same company. One request can cover several sites, so we've grouped them where that's the case.

#1. Whitepages opt-out

Paste your listing URL at whitepages.com/suppression-requests and verify with an automated phone call; if you'd rather not give a phone number, Whitepages also takes requests by web form or email (Whitepages Consumer Privacy Rights). Full instructions and troubleshooting: How to remove yourself from Whitepages.

#2. Spokeo opt-out

• Opt-out URL: spokeo.com/optout
• What you need: your profile URL (it looks like spokeo.com/Name-Name/City/ST/p12345678) and an email address.
• How: Paste the URL, enter your email, click Opt Out, then click the link in the confirmation email.
• Time: 24–48 hours, according to Spokeo.
• Gotchas: You may have several Spokeo listings, and each must be opted out separately. Spokeo also says that because it keeps receiving new public records, "your information may reappear on Spokeo in the future without notice." Re-check regularly.

#3. BeenVerified opt-out

• Opt-out URL: beenverified.com/app/optout/search. Check current page: a bot check blocked us from loading it on Oct 12, 2026.
• What you need: search for your name and state, select your record, and enter an email address for verification.
• Time: check current page.
• Gotchas: Make sure you're on beenverified.com and that the form never asks for payment. Watch for the confirmation email in your spam folder.

#4. TruePeopleSearch opt-out

• Opt-out URL: truepeoplesearch.com/removal. Check current page: a bot check blocked us from loading the form.
• What you need: check current page. These forms typically ask you to find your record and confirm by email.
• Gotchas: TruePeopleSearch often ranks near the top of Google for name searches, so it's worth doing early. Also remove the Google result through Results about you.

#5. FastPeopleSearch opt-out

• Opt-out URL: fastpeoplesearch.com/removal
• What you need: your name and email address, plus a captcha. FastPeopleSearch emails you a link to a second form, where you enter details that match the record you want removed.
• Time: The email link expires after 24 hours. FastPeopleSearch asks you to allow 3 days for removal.
• Gotchas: The site says leaving out or mistyping information "will only hinder the opt-out process," so match the record exactly.

#6–8. Intelius, Instant Checkmate and TruthFinder (one request)

These three sites, plus USSearch, belong to PeopleConnect. They share one opt-out tool, the PeopleConnect Suppression Center.

• Opt-out URL: suppression.peopleconnect.us. TruthFinder's own opt-out page sends you here too.
• What you need: an email address. You'll get a verification link, then you find your background report and choose to suppress it.
• Time: not stated.
• Gotchas: PeopleConnect says suppression stops your background report from showing when someone searches you by name on its sites. Guides that quote the tool's FAQ say reverse phone or address searches can still show you, so check those too. PeopleConnect also says the tool is free; the official tool never asks for payment.

#9. PeopleFinders opt-out

• Opt-out URL: PeopleFinders' help article "How do I remove my information from PeopleFinders?" links to its online removal form. Check current page for the form itself, since a bot check blocked us from loading it. You can also call (800) 718-8997. PeopleFinders doesn't accept opt-outs by fax or mail.
• Gotchas: PeopleFinders.com is a different company from PeopleFinder.com (no "s"), so check which one lists you. PeopleFinders says it can only block records in databases it controls.

#10. MyLife opt-out

• Opt-out URL: mylife.com/privacyrequest (Privacy Request Form), or email membersupport@mylife.com. Check current page: the older address, mylife.com/ccpa/index.pubview, returned a 404 when we tested it.
• What you need: your profile URL, name, location and an email address for verification.
• Gotchas: MyLife's help page offers removal to "residents of states with applicable privacy laws." If you live elsewhere, try the form anyway. Removing your profile also closes any MyLife account tied to your information.

#11. Radaris: currently offline

When we checked on October 12, 2026, radaris.com showed a notice that a New Jersey court had transferred the domain to Atlas Data Privacy Corporation. The court entered a final default judgment on August 27, 2026, under New Jersey's Daniel's Law (Atlas Data Privacy Corp. v. Radaris.com, MID-L-000847-24). There's currently no Radaris opt-out form to use. Keep it on your tracker and re-check later, and remove any old Radaris results from Google with Results about you.

#12. Nuwber opt-out

• Opt-out URL: nuwber.com/removal/link
• What you need: find your listing by name and state, paste its URL, and enter your email address. Confirm from the email you receive.
• Time: up to 48 hours.
• Gotchas: Nuwber says your page can still appear in Google for up to 8 weeks. To check removal, open your old listing URL; Nuwber says a "410" response means the page is gone.

#13. ThatsThem opt-out

• Opt-out URL: thatsthem.com/optout
• What you need: full name, street address, city, state, ZIP code, email and phone. All are required fields.
• Time: typically 72 hours, followed by a confirmation email.
• Gotchas: This form asks for more than most. That's what the form requires, but give only what it asks for. Opting out only affects ThatsThem's own search results.

#14. USPhoneBook opt-out

• Opt-out URL: usphonebook.com/opt-out
• What you need: name and email address, plus a captcha. Then click the emailed link within 24 hours and fill in a form that matches your record.
• Time: allow 3 days.
• Gotchas: The same "match the record exactly" rule applies here as with FastPeopleSearch.

#15. PeopleLooker opt-out

• Opt-out URL: peoplelooker.com/svc/optout/search/optouts
• What you need: search for yourself, select your record, and confirm by email.
• Time: usually about 24 hours after the confirmation email.
• Gotchas: The online form removes only one record. If you have more than one, email privacy@peoplelooker.com. You don't need to be a member, and you never have to pay.

What about the rest? Hundreds of smaller sites exist. If you find yourself on one that isn't listed here, look in its footer for links like "Do Not Sell or Share My Personal Information," "Opt Out," "Privacy Request" or "Remove My Listing." You can also search for "[site name] opt out."

#State laws that help

#California: the Delete Act and DROP

If you live in California, you have the strongest tool in the country (full DROP walkthrough). DROP (the Delete Request and Opt-out Platform at privacy.ca.gov/drop) was created by the Delete Act. It lets you send one free request to more than 600 registered data brokers (CalPrivacy).

How it works:

• You confirm that you're a California resident and create a profile with the details you choose.
• Since August 1, 2026, registered brokers must check DROP at least every 45 days and delete matching data, including inferences they've made about you, unless an exemption applies.
• Brokers must keep a suppression list, so data that doesn't match yet is blocked if it shows up later.
• Status updates can take up to 90 days.
• Brokers that don't comply can be fined $200 per day per request (CalPrivacy; CPPA).

DROP only covers registered data brokers and California residents. It doesn't remove Google results or public records. You'll still use Results about you and individual opt-outs for anything DROP doesn't reach.

#Other states

• Comprehensive state privacy laws: Whitepages' own privacy notice lists rights processes for residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. If you live in one of these states, look for a "Your Privacy Choices" or "Do Not Sell" link. Some sites, like MyLife, limit removal to residents of states with these laws.
• New Jersey's Daniel's Law protects the home addresses and unpublished home phone numbers of covered people, including law enforcement officers, prosecutors and judges. It's the law behind the Radaris domain seizure described above (what the Radaris judgment means). If you're a covered person in another state, check whether your state has a similar law. PeopleConnect, for one, accepts suppression requests from protected people such as judges and law enforcement officers under applicable law.

#If you're in danger

If you're dealing with domestic violence, stalking or harassment, removing your information is about safety, not just privacy. A few things are different for you:

• Get expert help first. The National Domestic Violence Hotline (1-800-799-7233, or chat at thehotline.org) can help with safety planning, including online privacy. NNEDV's Safety Net Project (techsafety.org) publishes guides on technology safety for survivors.
• Ask about an Address Confidentiality Program (ACP). Most states run ACPs, sometimes called "Safe at Home." They give survivors of domestic violence, and in many states sexual assault and stalking, a substitute address for public records such as voter registration and driver's licenses. That keeps a new address out of the records brokers copy (NNEDV; NASS). The National Association of Confidentiality Programs keeps a state-by-state list with contacts, and the NASS issue brief (Jan. 2026) lists which agency runs each state's program.
• Moving? Our guide to keeping a new address private after stalking or abuse goes step by step.
• Think about timing. Removing listings before a move works better than after, because a new address can show up in records within months.
• Be careful what you give opt-out forms. Give each form only what it requires. Use a separate email address. Don't confirm your new address to any site that doesn't already have it.
• Use Google's doxxing protections. Google also accepts removal requests for content that shares your personal information to harm you (Google Search Help).

#Why your information comes back

This is the part most guides skip. Opting out stops a site from selling the information it already has. It doesn't stop the site from getting new information (FTC). Listings come back when:

• public records change, like a move, a new property record or a new phone number
• a relative's report lists you as an associate
• the site buys a fresh batch of data from another broker
• you opt out of one listing but you had several (Spokeo, for one, gives each listing its own URL)

Spokeo says plainly that your information "may reappear... in the future without notice." That's why removal is maintenance, not a one-time job. If you want it laid out on a calendar, see our 30-day plan to delete yourself from the internet.

#A simple maintenance schedule

• Week 1: Run Results about you, do every opt-out on your tracker, and file DROP if you're in California.
• Day 30: Re-check every listing URL, and re-submit any that are still live.
• Day 90: Search yourself again with the same queries from step 1. Check DROP status.
• Every 3–6 months after that: Repeat the full search. Do it right away after you move, change your phone number or buy property.
• Ongoing: Keep Results about you notifications on, so Google tells you when new results appear.

#DIY vs. removal service

Can you pay someone to do this? Yes, and plenty of companies will take your money. Before you choose, look at the best independent test so far.

In 2024, Consumer Reports and security firm Tall Poppy tested 7 removal services with 32 volunteers across 13 people-search sites (Consumer Reports, Aug. 2024). They found:

• After four months, the services had removed only about 35% of the profiles overall. The best removed 68% and the worst 4%.
• Manual opt-outs did better, about 70%, and most worked within a week.
• Some sites required ID or an account, or used deceptive designs that made opting out harder.

So the honest answer is this: doing it yourself can be more thorough. What it costs you is time.

The FTC suggests asking any paid service exactly which sites it covers, how it removes you, and what happens after (FTC).

#Where UndoLeak fits

We built UndoLeak for people who don't have hours to spend on opt-out forms and re-checks. It sends removal requests for you, keeps checking the sites on a schedule, and re-files when a listing comes back. It doesn't do anything you couldn't do yourself with this guide. What it saves you is the time and the remembering. If that trade is worth it to you, scan your name for free at undoleak.com. If not, the free checklist below will get you most of the way.

#Free checklist

Copy this into your notes and work down it:

• Create a separate email address for privacy requests
• Start a tracker: site, listing URL, date submitted, confirmed, re-check date
• Search Google for your name + city, past addresses, phone and email
• Set up Google Results about you with all your addresses, phones and emails, and turn on notifications
• Request removal of every result that shows your contact info
• Opt out of Whitepages
• Opt out of Spokeo (every listing URL)
• Opt out of BeenVerified and PeopleLooker
• Opt out of TruePeopleSearch, FastPeopleSearch and USPhoneBook
• Suppress your report at the PeopleConnect Suppression Center (Intelius, Instant Checkmate, TruthFinder)
• Opt out of PeopleFinders, MyLife, Nuwber and ThatsThem
• California residents: file a DROP request at privacy.ca.gov/drop
• If you're at risk: contact your state's Address Confidentiality Program
• Day 30: re-check every listing URL
• Day 90: repeat your Google searches and check DROP status
• Every 3–6 months, and after any move: repeat the full search

#Conclusion

You can't erase yourself from the internet, but you can make yourself much harder to find. The stranger in our experiment found everything in four minutes because nobody had done the work described here. Start with Google's Results about you, work through the 15 sites above, file DROP if you're in California, and put your re-check dates on your calendar. Search your own name tonight. You might be surprised what's there.

#Sources

1. FTC Consumer Advice, What To Know About People Search Sites That Sell Your Information
2. Consumer Reports and Tall Poppy, Data Defense: Evaluating People-Search Site Removal Services (Aug. 2024), and Consumer Reports' summary
3. California Privacy Protection Agency (CalPrivacy), DROP and processing DROP requests
4. CPPA, Information for Data Brokers (Delete Act, Cal. Civ. Code 1798.99.86)
5. Google Search Help, Find and remove personal info in Google Search results
6. Google Search Help, Remove my private info from Google Search
7. Google blog, Results about you update (Feb. 10, 2026)
8. The Verge, Google makes it easier to remove your contact info from Search results
9. Whitepages, opt-out and Consumer Privacy Rights
10. Spokeo, opt-out
11. FastPeopleSearch, removal
12. USPhoneBook, opt-out
13. PeopleConnect, Suppression Center (Intelius, Instant Checkmate, TruthFinder, USSearch)
14. PeopleFinders Help Center, How do I remove my information from PeopleFinders?
15. MyLife, Help
16. Nuwber, opt-out
17. ThatsThem, opt-out
18. PeopleLooker, opt-out
19. Radaris.com court-order notice (viewed Oct. 12, 2026)
20. National Domestic Violence Hotline
21. NNEDV Safety Net Project, Address Confidentiality Programs
22. NASS, Voting and State Address Confidentiality Programs (Jan. 2026)
23. NACAP, Address Confidentiality Programs by State (June 2025)

Name: Priya Raman, 41 Address: 18 Linden Ct, Columbus, OH (owned since 2017); previous: 2 addresses Phone: (614) 555-0142 (mobile), (614) 555-0177 (old landline) Email: praman@example.com Relatives / associates: 4 listed, including a sister and an ex-roommate Household: married, 2 children under 12, 1 dog Estimated income: $100–125K. Home value: estimated Interests: running, home improvement, "budget travel" Segment: "Suburban mom, active lifestyle" Purchase signals: bought allergy medication 3 times this year

None of that is secret in the dramatic sense. It's what happens when public records, shopping data and online activity are matched to one name. This post breaks down what's in files like this, where each piece comes from, and what you can do about it. For the full removal process, see our pillar guide on how to remove your personal information from the internet.

#Three kinds of data brokers, three kinds of files

The FTC's landmark study of the industry looked at nine brokers and grouped their products into three types (FTC, 2014):

1. Marketing products. Lists and "segments" used to target ads and mail. This is where income estimates, interests and life events live.
2. Risk-mitigation products. Identity verification and fraud detection, used by banks and retailers to check you are who you say you are.
3. People-search products. The sites anyone can use to look up a name and get an address, phone number and relatives.

People-search sites are the ones most people see, because they publish profiles openly. Marketing brokers are the ones with the deepest files, because they hold inferences about your habits. They're often connected: the FTC found brokers buying and selling data with each other, so one fact can travel through several companies (FTC, 2014).

#What's in the file

#Identity and contact details

Name, age or birth date, current and past addresses, phone numbers and email addresses. People-search sites build profiles from public records, social media and data bought from other companies, according to the FTC's consumer guidance (FTC, people-search sites). This is the layer that lets a stranger find your door.

#Relatives and "associates"

People-search reports list relatives, and often people you've shared an address with. That's why removing your own listing doesn't fully hide you: your name and current city can still appear on your parents' or siblings' pages. Our pillar guide explains why listings come back for this reason.

#Property and money

Home ownership, purchase price and estimated value are taken from public property records. Marketing files add estimated income and net worth, often as a range.

#What you buy

The FTC found brokers collecting purchase data from retailers and catalog companies, such as product categories and how often you buy (FTC, 2014). That's how "bought allergy medication 3 times" can end up in a profile without anyone reading your receipt.

#Inferences: who they think you are

This is the part most people don't expect. Brokers sort people into segments, labels that bundle traits together. The FTC reported that one broker, Acxiom, had about 3,000 data segments for nearly every U.S. consumer (FTC, 2014). Segment names in the report included "Expectant Parent," "Diabetes Interest" and "Cholesterol Focus," alongside lifestyle and ethnicity-based categories.

Those labels are guesses. They can be wrong, and the FTC raised concerns that some, especially health-related ones, could be sensitive even when they're accurate (FTC, 2014).

#Where you go

Some companies sell location data collected from phone apps. The FTC has taken action over this: it sued Kochava in 2022 for selling location data that could track people to places like reproductive health clinics and places of worship, and in 2024 it finalized orders banning X-Mode Social and InMarket from selling sensitive location data (FTC press releases). Location data isn't on a typical people-search page, but it's part of the broader market.

#Where it all comes from

The FTC's 2014 report noted consumers generally don't know these companies exist, because they don't deal with you directly.

#How to see your own file

There's no single place to see everything, but you can get a rough picture in an afternoon:

1. Search your name plus city, and your phone number, on Google. People-search results tend to show up on the first page. Google's Results about you tool can flag pages showing your contact details automatically; our Google removal guide walks through it.
2. Check the big people-search sites directly. Look yourself up on Whitepages, Spokeo and similar sites. Don't pay for a "full report" just to see it; the free preview usually shows enough to opt out.
3. Ask marketing brokers for access. If you live in a state with a comprehensive privacy law, such as California, you can request a copy of the data a broker holds. Look for "Your Privacy Choices" or "Privacy Request" links in a broker's footer.
4. Check your phone's ad and location settings. On both iPhone and Android you can limit ad tracking and review which apps have location access.

When Priya (our fictional example) did this, her biggest surprise wasn't her address. It was that her sister's people-search page listed Priya's current street, and her own listing showed a phone number she'd given up years earlier.

#How to shrink it

You can't delete every record, but you can cut the parts that do the most harm:

• Opt out of people-search sites first. They're the ones that publish your address to anyone. Start with the largest; our Whitepages removal guide shows the pattern most sites follow.
• Remove results from Google so the remaining listings are harder to find.
• Use state rights. Californians can file a single request to 600+ registered brokers through DROP (our DROP walkthrough). Residents of other states with privacy laws can file "Do Not Sell or Share" requests with individual brokers.
• Cut the inflow. Use a separate email for loyalty programs, skip optional fields on warranty cards, and turn off precise location for apps that don't need it.
• Re-check. New records keep arriving. The FTC notes that opting out doesn't stop a site from collecting new information later (FTC, people-search sites).

The re-checking is the slow part. UndoLeak can take that over by scanning listings on a schedule and filing again when profiles come back, which saves time but isn't something you can't do yourself with a calendar reminder.

#Sources

1. FTC, "Data Brokers: A Call for Transparency and Accountability" (May 2014). https://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf
2. FTC Consumer Advice, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
3. FTC press release, "FTC Sues Kochava for Selling Data that Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations" (Aug. 2022). https://www.ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other
4. FTC press releases on X-Mode Social (Jan. 2024) and InMarket Media (Jan. 2024) orders. https://www.ftc.gov/news-events/news/press-releases
5. CalPrivacy, DROP. https://privacy.ca.gov/drop/

Priya Raman, her address and phone numbers are fictional (555 numbers, example.com).

One honest caveat first: you can't fully delete yourself from the internet. Public records, news articles and government sites will stay (Google Search Help). What you can do is make yourself much harder to find, which is what most people actually want.

For the detailed how-to behind each step, keep our pillar guide open in another tab: how to remove your personal information from the internet. This post is the schedule.

#Before Day 1: set up three things (15 minutes)

• A tracker. A spreadsheet with columns: site, URL, date filed, confirmation, re-check date. You'll use it every day.
• A separate email address just for opt-outs. Many forms want an email for confirmation, and this keeps those messages, and any marketing that follows, out of your main inbox.
• A list of your identifiers: every name variant, every address in the last 10 years, every phone number and email you've used. Brokers match on old data.

Our fictional example, Tom Becker of Denver, wrote down 3 names (Tom, Thomas, Thomas J.), 4 addresses, 3 phone numbers including (720) 555-0199, and 4 emails. That list took him 12 minutes and saved him hours later.

#Week 1: find out what's out there

Day 1: Search yourself. In a private browser window, search Google for your name in quotes plus your city, then your phone number, then your email. Write every result that shows personal details into the tracker. Tom found 11 people-search listings on the first two pages.

Day 2: Turn on Google's Results about you. Add your name, addresses, phone numbers and emails, and turn on alerts. Google says the first notification usually arrives within hours. Our step-by-step Google guide covers setup. Don't request removals yet; just let it collect.

Day 3: Check the big people-search sites directly. Search yourself on Whitepages, Spokeo, BeenVerified, TruePeopleSearch and FastPeopleSearch. Copy each listing URL into the tracker. Listings for you may appear more than once under different addresses.

Day 4: List your old accounts. Search your inbox for "welcome," "verify your email" and "your account." Every result is an account you might have forgotten. Add the ones you don't use to the tracker.

Day 5: Check data breaches. Look up each email address on Have I Been Pwned (haveibeenpwned.com). Note which services leaked your data; if any of those accounts still exist, put them on your deletion list. If you find anything, our post on what to do when your email is in a data breach has the next steps.

Day 6: Look at your photos. Run a reverse image search on your main profile photos using Google Lens or TinEye. Note where they show up. (More in our guide to finding your photos online.)

Day 7: Rest and sort. Sort the tracker by priority: anything showing your home address or phone goes first, then old accounts, then everything else.

#Week 2: people-search sites

This is the week with the biggest payoff. Each opt-out takes 5 to 15 minutes once you know the pattern: find listing → copy URL → paste into the official opt-out form → confirm by email or phone. Never pay to opt out (FTC).

Day 8: Whitepages. Do this one first. It's one of the largest, and the process teaches you the pattern. Follow our Whitepages removal guide.

Day 9: Spokeo (each listing has its own URL, so file one per listing).

Day 10: The PeopleConnect group. One request at the PeopleConnect Suppression Center covers Intelius, Instant Checkmate and TruthFinder (PeopleConnect).

Day 11: BeenVerified and PeopleLooker.

Day 12: TruePeopleSearch, FastPeopleSearch and USPhoneBook. These three tend to show up together in search results.

Day 13: Nuwber, ThatsThem, MyLife, PeopleFinders. Four in one day is doable now that you know the pattern.

Day 14: Catch-up. Click every confirmation link you missed. Mark anything that bounced. Note sites asking for ID or a phone call, and decide whether you're comfortable giving that; give only what each form requires.

California resident? Add one step on any day this week: file a single DROP request to 600+ registered brokers (our DROP guide).

#Week 3: Google and your own accounts

Day 15: Request Google removals. Open Results about you and request removal for each result showing your contact details. Remember that Google removes the search result, not the page (Google Search Help), which is why Week 2 came first.

Day 16: Delete dead accounts, part 1. Start with old social media and shopping accounts that hold your address. Look for "delete account" in settings or search "[service] delete account." Download anything you want to keep first.

Day 17: Delete dead accounts, part 2. Forums, old blogs, dating apps, fitness apps. Some apps only delete your account through the website or a support request.

Day 18: Lock down the accounts you keep. Set social profiles to private or friends-only, remove your phone number and birthday from public profile fields, and turn off "find me by phone number/email" where the platform offers it.

Day 19: Clean up what other people posted. Old group photos, tagged posts, a cousin's public family tree. Ask politely first; most people will remove something if you ask.

Day 20: Contact site owners for anything else. For a page you can't opt out of, such as an old club roster, email the site owner and ask them to take down your details. Keep it short and specific: the URL, what you want removed, and why.

Day 21: Rest. Check the tracker: what's confirmed, what's pending, what's ignored?

#Week 4: close the gaps and set up upkeep

Day 22: First re-check. Open every Week 2 listing URL. Most sites state 24 hours to 3 days for removal. Anything still live gets re-filed.

Day 23: Data you give away. Opt out of prescreened credit and insurance offers at OptOutPrescreen.com, the official site run by the credit bureaus (FTC), and remove your number and email from shopping and loyalty accounts you keep.

Day 24: Phone settings. Review app location permissions and limit ad tracking on your phone.

Day 25: Your phone number. If spam calls are part of why you're doing this, register on the National Do Not Call Registry at donotcall.gov and turn on your carrier's call blocking (why spam calls happen).

Day 26: Old results from deleted pages. If a deleted listing still shows in Google, use Google's Refresh Outdated Content tool so Google updates its copy.

Day 27: Second people-search sweep. Search yourself again with your Day 1 queries. New sites will have moved up into the spots the old ones left. Opt out of those.

Day 28: Family. Your parents' and siblings' listings may show your name and city. Share this plan with them, or offer to do their Week 2 with them.

Day 29: Write the maintenance calendar. Put re-check dates in your calendar: Day 60, Day 90, then every 3 to 6 months, and right away after you move or change numbers.

Day 30: Search yourself one last time. Compare it with Day 1. Tom went from 11 people-search results on the first two pages to 2, both already re-filed.

#What "done" looks like

After 30 days you won't be invisible, but you should see:

• few or no people-search listings showing your current address on Google's first pages
• old accounts closed
• Google alerting you when something new appears
• a calendar telling you when to look again

Listings come back. The FTC notes that opting out doesn't stop a site from collecting new information later (FTC). That's why Day 29 matters more than any single opt-out. If you'd rather not run the re-checks yourself, UndoLeak can scan and re-file on a schedule; it saves time, but the steps above work without it.

#Sources

1. FTC Consumer Advice, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
2. Google Search Help, "Find and remove personal info in Google Search results." https://support.google.com/websearch/answer/12719076
3. Google Search Help, "Remove my private info from Google Search." https://support.google.com/websearch/answer/9673730
4. PeopleConnect Suppression Center. https://suppression.peopleconnect.us/
5. FTC Consumer Advice, "Stop Unsolicited Mail, Phone Calls, and Email" (OptOutPrescreen.com). https://consumer.ftc.gov/articles/stop-unsolicited-mail-phone-calls-and-email
6. FTC, National Do Not Call Registry FAQs. https://consumer.ftc.gov/articles/national-do-not-call-registry-faqs
7. Have I Been Pwned. https://haveibeenpwned.com/
8. CalPrivacy, DROP. https://privacy.ca.gov/drop/

Tom Becker and his details are fictional.

Maya Okafor, a fictional nurse in Sacramento, filed her DROP request in January on her lunch break. It took her about ten minutes. Then nothing seemed to happen for seven months: every time she checked, her status said "Pending." She wondered if she'd done it wrong.

She hadn't. Under the law, data brokers didn't have to start processing DROP requests until August 1, 2026 (CalPrivacy). If you filed early, or you're filing now, this guide explains what to enter, what each status means, and what DROP can and can't do.

If you're new to all this, start with our pillar guide, how to remove your personal information from the internet. DROP is one piece of it.

#What DROP is, in one paragraph

DROP stands for Delete Request and Opt-out Platform. It was created by California's Delete Act and is run by the California Privacy Protection Agency, which now calls itself CalPrivacy. It lets a California resident send one deletion request to more than 600 registered data brokers at once, for free (CalPrivacy). Before DROP, you'd have had to find each broker and file with each one separately.

#Who can file

• You must be a California resident. DROP checks this before you can create a request (CalPrivacy).
• You can file for someone else with their permission, for example a parent for a child. You still have to verify the residency of the person you're filing for (CalPrivacy, Help with DROP).
• One person per request. The terms prohibit putting information about several people in one request (DROP terms).

If you've recently moved out of California, or you live elsewhere, DROP isn't available to you. Other states' privacy laws and the site-by-site opt-outs in our pillar guide still apply.

#How to file, step by step

Allow 10 to 15 minutes. Have your past addresses and old phone numbers handy; you'll see why below.

#Step 1: Go to the official site

The consumer portal is consumer.drop.privacy.ca.gov, linked from privacy.ca.gov/drop. DROP is free. Any site that asks you to pay to "file DROP" is not the state.

#Step 2: Verify that you live in California

DROP uses the California Identity Gateway, the state's digital identity system, to confirm residency. You can enter your details directly or sign in with Login.gov; CalPrivacy suggests Login.gov only if you already have an account. You don't need to create a Gateway account, and CalPrivacy says the information used to verify you isn't kept by DROP (CalPrivacy). The DROP terms name Socure and Login.gov as state-contracted verification vendors.

If verification fails: check for typos and try again. If it still says "Unable to verify," click Request a review of your eligibility. You'll describe your residency, and CalPrivacy will reply by email (CalPrivacy, Help with DROP).

#Step 3: Build your profile

DROP asks for some required details, such as name, date of birth and email, and then lets you add more. How much you add is up to you, but CalPrivacy is direct about the trade-off: "The more personal information you provide, the greater the likelihood of registered data brokers finding the personal information they maintain about you" (DROP terms).

That's the key decision. Brokers match records against what you give them. Think about what a broker might have on file:

Everything must be true and about you (DROP terms). You can update your profile later, but only once every 45 days (CalPrivacy, Help with DROP), so it's worth taking an extra five minutes now.

#Step 4: Submit and save your DROP ID

The confirmation page shows a DROP ID. CalPrivacy's "How DROP works" page describes it as an 8-digit ID you can also have emailed to you. Save it somewhere safe and don't share it. You'll need it to check your status, and there's a recovery option if you lose it (CalPrivacy).

#What happens after you submit

This is where most people get confused, because DROP runs on the brokers' schedule, not yours.

The official timeline (CalPrivacy):

• January 1, 2026: DROP opened to Californians.
• August 1, 2026: registered brokers had to start processing requests.
• Up to 90 days after that: brokers report back on what they did, so statuses can take up to 90 days to update.
• November 2026: CalPrivacy expects every broker to have completed its first download-and-upload cycle by now.
• Every 45 days after that: brokers must check DROP again and delete newly matching data. CalPrivacy calls DROP "ongoing – not a one-time action."

So if you filed in January like Maya, "Pending" all spring and summer was normal. If it's past November 2026 and many brokers still show Pending, that's worth noting (see "If something looks wrong" below).

#What your DROP statuses mean

You'll see a status for each broker. The labels on CalPrivacy's site include:

• Pending. The broker hasn't processed your request yet.
• Deleted (or similar). The broker matched your information and deleted it, unless an exemption applies.
• Opted-out. The broker couldn't make an exact match with what you provided. CalPrivacy says these brokers "still have your data, but they can no longer sell or share it."
• No records / not found (or similar). The broker found nothing matching your details.

CalPrivacy also notes that results vary: some brokers may have no matching records, and others "may be legally required or allowed to keep certain data" (CalPrivacy).

What to do with an "Opted-out" result: this usually means the broker had something close, but not an exact match. Next time your 45-day update window opens, add the old address, phone or name variant it might be keyed on. A fictional example: Maya's DROP profile listed her current Sacramento address, but a marketing broker's file still had her at a Fresno apartment from 2018. Adding the Fresno address gave the broker something to match.

#What DROP covers, and what it doesn't

Many people-search sites are registered brokers, but don't assume every site you see is covered. If a people-search listing is still live a few months after November 2026, opt out directly with that site. Our Whitepages removal guide is a good example of how a direct opt-out works, and the pillar guide covers 15 sites.

#If something looks wrong

• You can't verify residency: use the eligibility review link (above), or contact CalPrivacy through its official contact page.
• A broker still shows your listing after its status says Deleted: take a screenshot with the date, note the URL, and file a complaint with CalPrivacy. Under the Delete Act, brokers that fail to comply can face $200 per day per request in penalties (CPPA, data broker information).
• Someone is pressuring you to pay for DROP filing: DROP itself is free. A paid service can help you track other sites, but it can't file DROP "better" than you can.

#A realistic DROP routine

1. Today: file, with every past address and phone you can remember. Save your DROP ID.
2. Set a 45-day reminder to review statuses and add anything a broker might be missing.
3. After November 2026: review every "Opted-out" and "Pending" result.
4. Whenever you move or change numbers: update your profile at the next allowed window.
5. Keep doing the non-DROP steps: Google removal, and direct opt-outs with sites DROP doesn't reach.

Tracking 45-day windows, rechecking listings and filing with sites outside DROP is the part people tend to drop after a few months. That's the part a service like UndoLeak can save you time on, by re-checking listings on a schedule. DROP itself is free and you should file it either way.

#Sources

1. CalPrivacy, "Delete Request and Opt-out Platform (DROP)." https://privacy.ca.gov/drop/
2. CalPrivacy, "How DROP works." https://privacy.ca.gov/drop/how-drop-works/
3. CalPrivacy, "Help with DROP." https://privacy.ca.gov/drop/help-with-drop/
4. DROP consumer portal and terms. https://consumer.drop.privacy.ca.gov/
5. CPPA, Information for Data Brokers (Delete Act, Cal. Civ. Code 1798.99.86 et seq.). https://cppa.ca.gov/data_brokers/
6. CalPrivacy, "Process DROP requests" (data broker guidance). https://privacy.ca.gov/drop-for-data-brokers/process-drop-requests/

Maya Okafor is a fictional example.

If you've tried to look someone up on Radaris recently, or tried to file a Radaris opt-out, you got a court notice instead. The headline at the top reads: "This Domain Has Been Transferred by Court Order."

Radaris isn't down for maintenance. A New Jersey court took the domain away from the people who ran it. Here's what happened, what the judgment actually covers, and what it means if your information was on Radaris.

#The short version

• On August 27, 2026, the Superior Court of New Jersey, Middlesex County, entered a final judgment by default against Radaris.com, Rehold.com and Trustoria.com in Atlas Data Privacy Corporation, et al. v. Radaris.com, et al. (Docket MID-L-000847-24), according to the notice now on radaris.com.
• The court found the defendants violated New Jersey's Daniel's Law and ordered radaris.com transferred to the plaintiff, Atlas Data Privacy Corporation.
• KrebsOnSecurity reported on September 16, 2026 that the court had so far transferred 14 domains from the Radaris family to Atlas (KrebsOnSecurity).
• Radaris's lawyer told KrebsOnSecurity it has moved to vacate the default judgment and intends to appeal.
• The judgment protects the specific people who brought claims. It does not delete everyone's data and it doesn't give the general public new rights.

#What is Daniel's Law?

Daniel's Law is a New Jersey statute (N.J.S.A. 56:8-166.1 et seq.) that protects the home addresses and unpublished home phone numbers of "covered persons," such as law enforcement officers, prosecutors and judges, and their families (radaris.com notice; KrebsOnSecurity). It was passed in 2020 after the son of U.S. District Judge Esther Salas was killed at the family's home by a gunman who had found her address online (radaris.com notice links NJ.com coverage of the law's origin).

Covered people can send a data broker a written request to stop publishing their protected information. KrebsOnSecurity reports the law provides for fines of $1,000 per violation against companies that ignore those requests.

#Timeline

Note: KrebsOnSecurity describes the judge's finding on August 26; the notice on radaris.com gives August 27 as the date the final judgment was entered.

#What the judgment does

Based on the court language quoted on radaris.com:

1. Moves the domain. radaris.com now belongs to Atlas and shows the notice instead of people-search results.
2. Bars disclosure for covered people. The defendants and "all persons in concert" with them are permanently barred from disclosing the protected information of the individual plaintiffs and covered persons, through radaris.com, rehold.com, trustoria.com, any affiliated sites in their control, and "any databases, computer systems, records or materials, however stored."

#What it doesn't do

This is the part most headlines skip.

• It doesn't protect the general public. The injunction covers the plaintiffs and covered persons in the case. If you're not a New Jersey officer, judge, prosecutor or other covered person who assigned a claim, you aren't covered by this order.
• It doesn't order the data deleted. The court barred disclosure by the defendants. It didn't order Radaris's underlying database destroyed (radaris.com notice language).
• It doesn't shut down the wider network. Atlas told KrebsOnSecurity that radaris.com and at least 25 other people-search sites are run by the same small group. The court has transferred 14 domains so far; others may still be online.
• It may not be final. Radaris says it has moved to vacate and will appeal (KrebsOnSecurity). KrebsOnSecurity also notes that in a separate 2017 case, a court-ordered transfer of radaris.com was later halted after Radaris challenged it.
• Daniel's Law itself is being challenged. KrebsOnSecurity reports that data brokers sued by Atlas have challenged the statute under the First Amendment in federal court, and a federal court found West Virginia's version facially unconstitutional in August 2025.

#What this means for you

#If you were on Radaris

Your old Radaris page is not reachable at radaris.com right now. But:

• Google may still show old Radaris results. KrebsOnSecurity noted radaris.com still appeared prominently in name searches. Use Google's Results about you or the Refresh Outdated Content tool to clear stale results (our Google guide).
• Your information may live on sister sites. If you find a near-identical profile on another people-search site, opt out there directly.
• Keep Radaris on your tracker. If the judgment is vacated and the site returns, you'll want to know. Re-check in 60 to 90 days.

A fictional example: Elena Vasquez, a teacher in Tucson, had a Radaris listing with her address and (520) 555-0123. In October 2026 she searched her name and still saw a Google result titled "Elena Vasquez – Radaris," which led to the court notice. She used Google's outdated content tool for the result and checked the other people-search listings showing the same address.

#If you're a covered person in New Jersey

Daniel's Law gives you a direct right to demand that brokers stop publishing your home address and unpublished phone number. Your agency or union may have information on how to send requests. For legal advice on your situation, talk to a New Jersey attorney.

#If you're a judge, officer or prosecutor in another state

KrebsOnSecurity reports at least 14 other states have passed laws modeled on Daniel's Law. Check your state's statute. Federal judges also have protections under a separate federal law. Some people-search companies, PeopleConnect among them, accept suppression requests from protected people like judges and law enforcement officers under applicable law.

#Everyone else

The lesson from Radaris is that protections are uneven. If you're not covered by a law like this one, your tools are the ordinary ones: opt out site by site (our Whitepages removal guide shows the pattern), remove Google results, and, in California, file DROP (our DROP guide). The full process is in our pillar guide, how to remove your personal information from the internet.

#Why it matters beyond Radaris

Radaris had a long reputation for ignoring removal requests, according to KrebsOnSecurity. The case shows a court can take a domain when a broker doesn't show up to defend itself. It also shows the limits: years of litigation, a narrow group of protected people, and a judgment that's still being contested.

We'll update this post if the judgment is vacated, an appeal is decided, or Radaris-family sites change.

#Sources

1. Court-order notice on radaris.com (viewed Oct. 12, 2026), citing Atlas Data Privacy Corporation, et al. v. Radaris.com, et al., Superior Court of New Jersey, Law Division, Middlesex County, Docket No. MID-L-000847-24. https://radaris.com/
2. KrebsOnSecurity, "Data Broker Radaris Loses Domains in Privacy Fight" (Sept. 16, 2026). https://krebsonsecurity.com/2026/09/data-broker-radaris-loses-domains-in-privacy-fight/
3. New Jersey Daniel's Law, N.J.S.A. 56:8-166.1 et seq. (New Jersey Legislature). https://www.njleg.state.nj.us/
4. PeopleConnect Suppression Center. https://suppression.peopleconnect.us/

Elena Vasquez is a fictional example.

If this is happening to you right now: you don't have to handle it alone. In the US, the Cyber Civil Rights Initiative's 24/7 Image Abuse Helpline is 844-878-2274 (cybercivilrights.org). If the images show someone under 18, go to takeitdown.ncmec.org or report to NCMEC's CyberTipline at 1-800-843-5678. If you're in immediate danger, call 911.

Since May 19, 2026, websites and apps covered by a federal law called the TAKE IT DOWN Act must remove intimate images shared without consent within 48 hours of a valid request. That includes real photos and AI-made fakes (FTC). This post explains what the law says, what counts as a valid request, and what to do if a platform doesn't act.

#The law in four sentences

The TAKE IT DOWN Act (Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act) was signed on May 19, 2025 (FTC). It does two separate things. First, it makes it a federal crime to knowingly publish intimate images of someone without consent, including "digital forgeries" such as AI deepfakes (Congress.gov, S.146). Second, it requires covered platforms to run a notice-and-removal process and take reported images down within 48 hours. Platforms had a year to comply, and the FTC started enforcing that part on May 19, 2026 (FTC).

#Part 1: The criminal side

The Act added federal penalties for knowingly publishing non-consensual intimate images, real or AI-generated. Penalties go up to 2 years in prison when the image is of an adult, and up to 3 years when it's of a minor, plus fines (Congress.gov, S.146). Threatening to publish such images is also covered.

You don't need to bring a criminal case to use the removal process in Part 2. If you want to report the person who posted the images, you can contact local police or the FBI's Internet Crime Complaint Center (ic3.gov). An advocate (see the resources below) can help you decide whether and how to do that.

#Part 2: Your removal rights

#Which platforms have to comply?

"Covered platforms" are public websites, apps and online services that mainly host user-generated content, such as social media, messaging, image and video sharing, and gaming platforms (FTC business guidance). Sites that regularly publish non-consensual intimate content are also covered. In May 2026, the FTC's chairman wrote to Alphabet, Amazon, Apple, Automattic, Bumble, Discord, Match Group, Meta, Microsoft, Pinterest, Reddit, SmugMug, Snapchat, TikTok and X reminding them to comply (FTC press release).

The FTC has also sent warning letters to 12 companies offering so-called "nudify" tools, saying they appeared to be violating the law by not offering a removal process (FTC, May 20, 2026).

#What platforms must do

• Offer a clear, conspicuous, plain-language process for removal requests (FTC).
• Remove the image within 48 hours of a valid request.
• Make reasonable efforts to remove known identical copies within the same 48 hours. You don't have to report each copy yourself (FTC).

#What makes a request "valid"

Under the Act, your request should be in writing and include (Congress.gov, S.146; FTC):

1. Your physical or electronic signature. Typing your name usually counts as an electronic signature.
2. Enough information to find the image, such as the link (URL), username, or post ID.
3. A brief statement that you believe in good faith the image was published without your consent, with any relevant information.
4. Your contact information so the platform can reach you.

You can also make the request on someone's behalf if you're authorized to act for them.

#A sample request

Here's how a request might read, using a fictional person. Adjust it to the platform's form.

Subject: TAKE IT DOWN Act removal request

I am requesting removal of an intimate image of me published without my consent, under Section 3 of the TAKE IT DOWN Act.

Location: https://example.com/post/48213 (posted by user "x_example_22")

Statement: I believe in good faith that this intimate image was published without my consent. [Optional: It is an AI-generated image made from a photo on my public profile.]

Contact: Jordan Lee, jordan.lee@example.com, (555) 555-0148

Signature: /Jordan Lee/ Date: Oct 12, 2026

Keep it factual. You don't need to explain your relationship to the person who posted it, or justify how the image was made or shared.

#Step by step: what to do

1. Save evidence first, carefully. Take screenshots showing the image's URL, the account that posted it and the date, but don't download or share the explicit image itself, especially if it involves a minor. NCMEC specifically asks people not to send, share or download images to submit to Take It Down. Store screenshots somewhere private.
2. Use the platform's removal process. Look for a link like "Report non-consensual intimate content" or "TAKE IT DOWN request" in the help center or report menu. Include all four elements above.
3. Note the time. Write down when you sent the request. The 48-hour clock is your benchmark.
4. Block future uploads. Create a hash with StopNCII.org (if you were 18 or over in the image) or Take It Down from NCMEC (if you were under 18 in it, even if you're an adult now). Your image never leaves your device; only a digital fingerprint is shared with participating platforms (StopNCII; NCMEC).
5. Remove it from Google Search too. Google has a request form for non-consensual explicit images, including fake ones (Google Search Help). This removes search results, not the page, so do it alongside step 2.
6. If 48 hours pass with no action, report the platform to the FTC at TakeItDown.ftc.gov. The FTC also accepts reports about platforms that have no removal process at all (FTC). Violations can lead to civil penalties of up to $53,088 per violation (FTC).

#What the law doesn't do

• It doesn't cover every site. Sites outside the US, or that aren't "covered platforms," may not comply. For those, Google removal and hashing tools still help.
• It doesn't promise the image vanishes everywhere. Platforms must remove known identical copies, but edited or cropped versions may need separate reports.
• It doesn't remove your contact details. If your name, address or phone number were posted alongside the image, use doxxing-removal options and people-search opt-outs too. Our Google removal guide and Whitepages guide cover two common places, and the pillar guide, how to remove your personal information from the internet, covers the rest.

For AI-generated images specifically, see our step-by-step guide: how to get AI deepfake nudes removed.

#Where to get support

• Cyber Civil Rights Initiative Image Abuse Helpline: 844-878-2274 (24/7, US) for support and referrals. cybercivilrights.org
• NCMEC Take It Down: takeitdown.ncmec.org, for images taken when you were under 18. CyberTipline: 1-800-843-5678 or report.cybertip.org.
• StopNCII.org: for adults, to hash images and block uploads on partner platforms.
• RAINN National Sexual Assault Hotline: 800-656-4673, or text HOPE to 64673.
• VictimConnect Resource Center: call or text 1-855-484-2846 for referrals for crime victims.

What happened isn't your fault, regardless of how the image was made or who you shared it with.

#Sources

1. Congress.gov, S.146, TAKE IT DOWN Act (119th Congress), enrolled text. https://www.congress.gov/bill/119th-congress/senate-bill/146/text
2. FTC, "Take It Down Act enforcement starts now" (May 19, 2026). https://www.ftc.gov/business-guidance/blog/2026/05/take-it-down-act-enforcement-starts-now-what-know-about-ftc-tida
3. FTC press release, "FTC Begins Enforcing the TAKE IT DOWN Act" (May 19, 2026). https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-begins-enforcing-take-it-down-act
4. FTC, "Complying With the Take It Down Act." https://www.ftc.gov/business-guidance/resources/complying-take-it-down-act
5. FTC press release, warning letters to "nudify" companies (May 20, 2026). https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-sends-warning-letters-companies-about-compliance-take-it-down-act
6. FTC complaint site. https://takeitdown.ftc.gov/
7. NCMEC, Take It Down and FAQ. https://takeitdown.ncmec.org/ · https://takeitdown.ncmec.org/faq/
8. StopNCII.org FAQ. https://stopncii.org/faq/
9. Google Search Help, "Remove personal sexual content from Google Search." https://support.google.com/websearch/answer/9116649
10. Cyber Civil Rights Initiative Crisis Helpline. https://cybercivilrights.org/ccri-crisis-helpline/
11. RAINN National Sexual Assault Hotline. https://rainn.org/help-and-healing/hotline/
12. VictimConnect Resource Center. https://victimconnect.org/get-help/
13. NCMEC CyberTipline. https://www.missingkids.org/gethelpnow/cybertipline

Jordan Lee and the example details are fictional.

First, the most important thing: this is not your fault. Someone took an ordinary photo of you and used software to make a fake. You didn't cause that by posting a picture, wearing what you wore, or being visible online. You also have more tools to get it taken down than you would have had even a year ago.

Support you can reach today (US):

• Cyber Civil Rights Initiative (CCRI) Image Abuse Helpline: 844-878-2274, 24/7.
• Under 18 in the image, or a parent of a child? NCMEC's Take It Down (takeitdown.ncmec.org) and the CyberTipline (1-800-843-5678).
• RAINN: 800-656-4673, or text HOPE to 64673.
• In immediate danger: call 911.

You can work through the steps below at your own pace, or ask a trusted friend or an advocate to do some of them with you. You don't have to look at the images again to do most of this.

#Before you start: protect yourself while you document

You'll want a record of where the images are, but you don't need to keep the images themselves.

• Screenshot the page, not the picture. Capture the URL bar, the account name, the date and any messages or threats. If you can, cover or crop the explicit part of the screen.
• Don't download, forward or re-share the image to "prove" it. NCMEC specifically asks people not to send, share or download images to submit to Take It Down. If a minor is shown, sharing it can be a crime even with good intentions.
• Write a simple log: URL, platform, date found, date reported, outcome. A friend can keep this for you.
• Lock down your accounts. Set profiles to private for now, and review who can download or tag your photos.

#Step 1: Report it to each platform (the 48-hour rule)

Under the federal TAKE IT DOWN Act, covered platforms such as social networks, image and video sites, messaging and gaming services must remove non-consensual intimate images, including AI-generated "digital forgeries," within 48 hours of a valid request, and make reasonable efforts to remove identical copies (FTC). That requirement has been enforced since May 19, 2026.

A valid request needs four things (Congress.gov; FTC):

1. your signature (typing your name works as an electronic signature)
2. the link or enough detail to find the image
3. a short statement that you believe in good faith it was posted without your consent
4. your contact information

You don't have to prove it's fake. Saying it's an intimate image of you shared without consent is enough. Our TAKE IT DOWN Act explainer has a sample request you can copy.

Where to look on a platform: the report menu on the post ("Report" → "Nudity" or "Non-consensual intimate imagery"), or the help center's privacy or safety section. Many large platforms have a dedicated form.

If a platform ignores you for more than 48 hours or has no way to report, file a complaint with the FTC at TakeItDown.ftc.gov.

#Step 2: Remove it from Google Search

Even after a page is removed, Google can keep showing it for a while, and some sites won't respond at all. Google accepts removal requests for sexually explicit images that are fake, including AI-made ones, when you're identifiable in them and they were shared without consent (Google Search Help).

1. Search for Google's "Remove personal sexual content" or "involuntary fake pornography" request form in Google Search Help.
2. Add each URL where the image appears, plus the URL of the search results page where you found it.
3. Google can also try to filter similar explicit results from searches for your name once a request is approved (Google Search Help).

Removing a search result doesn't delete the page itself, so do this together with Step 1, not instead of it.

#Step 3: Block it from being uploaded again

Hashing tools create a "digital fingerprint" of an image on your own device. Only that fingerprint is shared, not the image. Partner platforms then use it to detect and remove matching uploads.

Limits to know: hashing finds exact or near-identical copies, so heavily edited versions may need their own report. It only works on participating platforms, and NCMEC notes it doesn't work on encrypted services (NCMEC FAQ; StopNCII FAQ).

If you don't have a copy of the image, skip this step. Don't download one just to hash it if that would be distressing or, for images of minors, unlawful. Platform reports and Google removal still work.

#Step 4: Deal with the people involved, if and when you're ready

Reporting to police. Since May 2025, knowingly publishing intimate deepfakes of someone without consent has been a federal crime, with higher penalties when the person shown is a minor (Congress.gov). Many states have their own laws too. You can report to local police or the FBI at ic3.gov. You don't have to report to use the removal steps above, and an advocate can help you weigh it.

If it's happening at school. If a student made or shared images of another student, tell a parent, counselor or administrator. Images of minors should go to NCMEC's CyberTipline. Schools can act under their own conduct policies.

If someone is threatening or extorting you. Don't pay and don't send more images. Save the messages, stop responding, and report the account. Contact CCRI's helpline or, for minors, NCMEC.

Legal options. A lawyer can tell you whether state law gives you the right to sue. CCRI's helpline can share referrals.

#Step 5: Check whether your personal details went with it

Deepfakes are sometimes posted alongside a name, school, workplace or address so people can find the victim. If that happened:

• Ask Google to remove results with your contact details (our Google removal guide).
• Opt out of people-search sites showing your address, starting with the largest (our Whitepages removal guide).
• The full process is in our pillar guide, how to remove your personal information from the internet.

#Step 6: Keep watching, gently

Set a reminder to check once a week for a few weeks, then less often. Searching your name and using a reverse image search on the original source photo can help you spot new copies (how to find your photos online). If checking is upsetting, ask someone you trust to do it for you and only tell you what needs action.

#A fictional example

Sam, a 24-year-old graduate student, found a fake explicit image of herself on a forum, made from a photo on her public running-club page. Her friend screenshotted the thread URL and the poster's username. Sam filed a report through the forum's non-consensual imagery form that evening, submitted the image's URL to Google's removal form, and created a hash on StopNCII from a copy a classmate had sent her. Two days later the forum post was gone. She filed one FTC complaint about a second site that had no removal form. She also set her running-club profile to private, which is a change she chose, not something she "should have done."

#Sources

1. FTC, "FTC Begins Enforcing the TAKE IT DOWN Act" (May 19, 2026). https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-begins-enforcing-take-it-down-act
2. FTC, "Complying With the Take It Down Act." https://www.ftc.gov/business-guidance/resources/complying-take-it-down-act
3. Congress.gov, S.146 TAKE IT DOWN Act text. https://www.congress.gov/bill/119th-congress/senate-bill/146/text
4. FTC complaint site. https://takeitdown.ftc.gov/
5. Google Search Help, "Remove personal sexual content from Google Search" and "Get help removing explicit or intimate personal images." https://support.google.com/websearch/answer/9116649 · https://support.google.com/websearch/answer/13650142
6. StopNCII.org and FAQ. https://stopncii.org/ · https://stopncii.org/faq/
7. NCMEC, Take It Down and FAQ. https://takeitdown.ncmec.org/ · https://takeitdown.ncmec.org/faq/
8. NCMEC CyberTipline. https://www.missingkids.org/gethelpnow/cybertipline
9. Cyber Civil Rights Initiative Crisis Helpline. https://cybercivilrights.org/ccri-crisis-helpline/
10. RAINN National Sexual Assault Hotline. https://rainn.org/help-and-healing/hotline/

"Sam" is a fictional example. This guide is general information, not legal advice.

You got an alert from your password manager, your bank or a breach-checking site: your email address showed up in a data breach. Take a breath. On its own, an exposed email address is common and usually low-risk. What matters is what else leaked with it. This guide helps you figure that out and tells you what to do in the right order.

#First: what does "your email was in a breach" actually mean?

It means a company you had an account with, or one that bought your data, lost a database that included your email address. Depending on the breach, the same record might also contain:

Breach-checking sites like Have I Been Pwned (haveibeenpwned.com) list which breaches your address appeared in and which data types each one exposed. Look up the breach by name to see what was in it.

#The first hour: passwords

1. Change the password on the breached account if it still exists (FTC).
2. Change it anywhere you reused that password. This is the most important step. Attackers take leaked email-password pairs and try them on banks, email providers and shopping sites.
3. Secure your email account first. Your inbox can reset every other password, so give it a long, unique password and turn on two-factor authentication.
4. Turn on two-factor authentication (2FA) on important accounts. An authenticator app or security key is stronger than text-message codes (FTC; CISA).
5. Use a password manager so every account gets a unique password and you only have to remember one.

A fictional example: Marcus Hill's email, marcus.hill@example.com, appeared in a 2023 breach of an old photo-printing site. The breach included passwords. Marcus had used the same password for his streaming account and an old shopping account. He changed all three and turned on 2FA for his email, which took 25 minutes. He deleted the photo-printing account entirely.

#The first day: check what else is at risk

If a Social Security number or financial information leaked:

• Freeze your credit at all three bureaus: Equifax, Experian and TransUnion. Freezes are free to place and lift, and you contact each bureau separately (FTC). A freeze stops new lenders from seeing your report, which blocks most new-account fraud. You can lift it temporarily when you apply for credit.
• Or place a fraud alert, which is also free. Placing one with one bureau notifies the other two (FTC).
• Watch your bank and card statements closely, and tell your bank if card numbers were exposed.

If the breached company emailed you: read its notice for what was exposed, and whether it offers free credit monitoring. Go to the company's site directly rather than clicking links in the email, because breach notices get imitated by scammers.

Get a tailored plan. The FTC's IdentityTheft.gov/databreach gives step-by-step advice by type of information exposed.

#The first week: watch for phishing

After a breach, the most common follow-up isn't hacking. It's convincing phishing: messages that use your real name, the company's name, or details from the breach to look legitimate (FTC).

Watch for:

• "Your account has been compromised. Click here to verify."
• Fake refund or "breach compensation" offers.
• Texts or calls claiming to be your bank, using details you'd assume only your bank knows.

The rule: never use the link or phone number in the message. Go to the company's website or app yourself, or call the number on your card.

#Ongoing: watch your credit and your inbox

• Check your credit reports for free at AnnualCreditReport.com, the official site (FTC). Look for accounts or inquiries you don't recognize.
• Turn on breach notifications. Have I Been Pwned's free "Notify me" service emails you if your address shows up in a newly indexed breach.
• If someone uses your information, report it at IdentityTheft.gov to get a recovery plan (FTC).

#How breaches feed people-search sites

This part gets less attention. Data that leaks in breaches or is sold by companies adds to the wider pool of personal data, and people-search sites build their profiles from public records, social media and data bought from other companies (FTC, people-search sites). An email address can become the link that ties your name, phone number and address together into one profile.

That's why it's worth searching your email address in Google once you've secured your accounts. If it turns up on people-search pages:

• Ask Google to remove results showing your email and other contact details with its Results about you tool (our Google guide).
• Opt out of the people-search sites that list you (our Whitepages guide shows the process).
• Our pillar guide covers the rest: how to remove your personal information from the internet.

#Reduce the damage next time

You can't stop companies from being breached, but you can limit what each breach exposes:

• Use email aliases for shopping and sign-ups. Apple, Firefox and many email providers offer masked or alias addresses, so a breach at one store exposes an address you can turn off.
• Close accounts you no longer use. A dead account can still leak.
• Give less. Skip optional fields like birthday and phone number.
• Unique passwords everywhere, so one breach can't unlock other accounts.

#A quick checklist

• Look up which breach and what data types leaked
• Change the breached password and every reused copy
• Secure your email with a unique password + 2FA
• 2FA on bank, phone carrier and main shopping accounts
• SSN or financial data leaked? Freeze credit at all 3 bureaus
• Ignore links in breach-related emails and texts
• Turn on breach alerts
• Check annualcreditreport.com
• Search your email in Google; remove people-search listings

#Sources

1. FTC Consumer Alert, "Have you been affected by a data breach? Read on." https://consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
2. IdentityTheft.gov, data breach guidance. https://www.identitytheft.gov/databreach
3. FTC, "Credit Freezes and Fraud Alerts." https://consumer.ftc.gov/articles/credit-freezes-and-fraud-alerts
4. FTC, "How to Recognize and Avoid Phishing Scams." https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
5. FTC, "Free Credit Reports" (AnnualCreditReport.com). https://consumer.ftc.gov/articles/free-credit-reports
6. CISA, "More than a Password" (multifactor authentication). https://www.cisa.gov/MFA
7. Have I Been Pwned. https://haveibeenpwned.com/
8. FTC, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information

Marcus Hill and his details are fictional.

There are three common reasons people go looking for their own photos: someone is using their pictures on a fake profile, they've found an old photo they want gone, or they want to know what a stranger could find from their face. The tools are the same for all three, and most are free. This guide shows how to search, what each tool is good at, and what to do with what you find.

#The 10-minute version

1. Pick 3 to 5 photos: your main profile picture on each social network, a work headshot, and any photo you've posted publicly a lot.
2. Run each one through Google Lens, Bing Visual Search and TinEye.
3. Search your name in Google Images.
4. Write down every page you didn't expect, then use the removal steps below.

#Choosing a tool

A note on face-search engines. These sites match faces rather than files, so they can find photos of you that you've never seen. That also means anyone can use them on you. If you use one, use it for yourself only. PimEyes offers a free opt-out that asks for a photo of your face and proof of identity, and removes matching results from its own search; it doesn't delete the photos from the sites hosting them (PimEyes).

#How to run each search

#Google Lens

• On a computer: go to images.google.com, click the camera icon, and upload your photo or paste an image link. You can drag the selection box to focus on your face.
• On a phone: open the Google app, tap the Lens icon, and pick a photo from your gallery.
• Look at the "Exact matches" option where it appears; it shows pages using the same image rather than lookalikes.

#TinEye

Upload the image or paste its URL at tineye.com. Sort results by "Oldest" to see where the image first appeared, which helps when someone claims a photo is theirs (TinEye).

#Name searches

Search your full name in quotes in Google Images, plus variations with your city, school or employer. Old team photos, event galleries and news photos usually show up this way rather than through image matching.

#What you might find, and what to do

#1. Someone is using your photos on a fake profile (impersonation)

This is the most common reason to search, and also the easiest to fix on major platforms. Every large social network has an impersonation report, and most don't require you to have an account.

• Screenshot the fake profile, including the URL and username.
• Use the platform's "Report → Pretending to be someone → Me" option, or its impersonation form in the help center. You'll often be asked for a photo of your ID.
• Warn friends and family not to accept requests or send money. Romance and "friend in trouble" scams often use stolen photos (FTC).

A fictional example: Lauren Park, a dental hygienist, ran her LinkedIn headshot through Google Lens and found it on a dating profile under a different name, located in another country. She reported it as impersonation through the app's help center and posted a short "this isn't me" note for friends. The profile was gone within a day.

#2. A photo you took is posted without permission

If you took the photo, you usually own the copyright. Most US sites honor a DMCA takedown notice sent to their designated agent; many have a copyright form in their help center. You'll need the URL, a link to or description of your original, and a statement that you own it.

#3. A photo of you that someone else took

Copyright belongs to the photographer, so a DMCA notice may not work. Try:

• Asking the person or site to remove it. This works more often than people expect, especially for old event galleries, team rosters and blogs.
• The platform's privacy reporting. Many platforms remove photos of private individuals posted to harass or identify them.
• Google removal. Google can remove search results that show your personal contact information or doxx you, and has separate policies for intimate images and images of minors (Google Search Help). Use Results about you for contact details (our Google removal guide).

#4. An intimate image, real or AI-generated

Please go straight to our dedicated guides: the TAKE IT DOWN Act and your 48-hour removal rights and how to get AI deepfake nudes removed. Platforms covered by the TAKE IT DOWN Act must remove these within 48 hours of a valid request (FTC). Support is available 24/7 through the Cyber Civil Rights Initiative at 844-878-2274.

#5. Your photo on a people-search profile

Some people-search sites pull profile photos from social media into their reports. Opting out of the listing removes the photo with it. Our Whitepages guide shows the process for one of the largest sites, and the pillar guide on how to remove your personal information from the internet covers 15.

#After removal: get Google to update

When a page is deleted, Google may keep showing its old copy or thumbnail for a while. Use Google's Refresh Outdated Content tool with the old URL to ask Google to update its results (Google Search Help).

#Make your photos harder to find next time

• Use a different profile picture on each platform. One photo on every site makes it easy to link your accounts together.
• Check the "who can see" setting for profile photos; on some networks the profile photo is always public.
• Strip location data before posting. Phones can save GPS coordinates in a photo's metadata. Both iPhone and Android let you turn off location in the share sheet or camera settings.
• Watch the background. House numbers, street signs, school logos and car plates are often more revealing than your face.
• Search again every few months, and right after anything that makes you more visible, like a new job announcement or press coverage.

If you'd rather not repeat the people-search part of this yourself, UndoLeak re-checks those listings on a schedule. The image searches above are free and worth doing yourself either way.

#Sources

1. Google Search Help, "Search with an image on Google" (Google Lens). https://support.google.com/websearch/answer/1325808
2. TinEye. https://tineye.com/
3. Google Search Help, "Remove my private info from Google Search" (doxxing, minors, intimate images). https://support.google.com/websearch/answer/9673730
4. Google Search Help, "Find and remove personal info in Google Search results." https://support.google.com/websearch/answer/12719076
5. Google Search Console Help, "Refresh Outdated Content tool." https://support.google.com/websearch/answer/7041092
6. PimEyes, opt-out form. https://pimeyes.com/en/opt-out-request-form
7. FTC, "What To Know About Romance Scams." https://consumer.ftc.gov/articles/what-know-about-romance-scams
8. U.S. Copyright Office, Section 512 (DMCA notice-and-takedown). https://www.copyright.gov/512/
9. FTC press release, "FTC Begins Enforcing the TAKE IT DOWN Act" (May 19, 2026). https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-begins-enforcing-take-it-down-act

Lauren Park is a fictional example.

It's 9:14 a.m. and your phone shows "Possible spam" for the third time today. Yesterday it was a "car warranty" robocall, a text about a package you never ordered, and a call from a number that looked almost exactly like yours.

You're not imagining it, and you probably didn't do anything wrong. Here's why it happens, which part of it you can control, and what actually helps.

#Reason 1: Calling is cheap, and scammers ignore the rules

The FTC's explanation is blunt: "it's easy and cheap for scammers to call people anywhere in the world" (FTC). Internet calling lets one operation dial huge numbers of phones for very little money. Even if only a tiny share answer, it pays.

Those callers don't follow the National Do Not Call Registry. The Registry is a list that tells law-abiding telemarketers which numbers not to call. It doesn't block calls, so it can't stop scammers (FTC).

#Reason 2: Your number is on lists, and lists are for sale

Most spam starts with a list. Your number can end up on one through:

• People-search sites and data brokers. These sites build profiles from public records, social media and data bought from other companies, and many profiles show phone numbers tied to a name and address (FTC). Anyone can look you up, including marketers and scammers.
• Forms and sign-ups. Contests, quote requests ("compare insurance rates"), warranty registrations and some apps collect your number. Some forms include consent language allowing several "partners" to contact you.
• Data breaches. Leaked databases often include phone numbers (what to do if your info was in a breach).
• Answering or engaging. The FTC warns that pressing a number to be "removed" from a robocall list "might lead to more unwanted calls" (FTC). Answering can tell the caller the number is live.

Where people-search sites fit. They aren't the only source, and opting out won't stop every call. But they're the most public source: they turn a phone number into a profile with your name, age, address and relatives. That's what makes "Hi Rebecca, this is about your home at 14 Elm…" calls and texts sound believable. Removing those listings cuts that link.

#Reason 3: Spoofing makes it look local

Calls "from your area code," or from a number that looks like yours, are usually spoofed. Scammers fake the caller ID to make you more likely to answer (FCC). The number you see often isn't the number calling. Blocking it may do nothing, because the next call will show a different one.

#"Why all of a sudden?"

If spam jumped recently, common triggers include:

• You filled out an online quote form or entered a contest.
• Your number appeared in a newly leaked database.
• You moved or bought a home. Property records are public, and new homeowners often get a wave of mail and calls.
• A new people-search listing appeared for you.
• You answered or pressed a key on a robocall.

A fictional example: Rebecca Cho of Tampa got two or three spam calls a week until she requested online insurance quotes. Within days she was getting six a day, several using her full name. A Google search of her number, (813) 555-0164, showed it on two people-search pages next to her address. She opted out of both, registered on the Do Not Call list to cut legal sales calls from the quote companies, and turned on her carrier's spam filter. Over the next month, she said the named calls largely stopped, though anonymous robocalls didn't disappear.

#What actually reduces spam calls

Ranked by how much difference they usually make:

#1. Turn on call blocking and labeling

The FTC calls this your best defense (FTC). There are three layers:

• Your carrier: most mobile carriers offer free spam labeling or blocking, often in their app. Check yours.
• Your phone: iPhone's "Silence Unknown Callers" and Android's spam protection send unknown numbers to voicemail. Real callers leave messages.
• A call-blocking app: many exist; check reviews and what data the app collects.

The FCC has also allowed carriers to block suspected illegal calls and required caller ID authentication to reduce spoofing (FCC).

#2. Don't engage

Don't answer unknown numbers if you can avoid it. If you do and hear a recording, hang up. Don't press buttons or call back (FTC). For texts, don't reply "STOP" to obvious scams, and don't click links. Forward spam texts to 7726 (SPAM), which most carriers support (FCC).

#3. Register with the Do Not Call Registry

It's free at donotcall.gov or 1-888-382-1222 (call from the phone you want to register). It won't stop scammers, but it reduces sales calls from legitimate companies and makes the rest easier to recognize as scams (FTC). Registered telemarketers must remove registered numbers from their lists at least every 31 days (FTC Do Not Call Data Book 2025). As of September 30, 2025, there were 259 million active registrations.

#4. Take your number off people-search sites

Search your phone number in quotes on Google. If it shows up on people-search pages:

• Opt out of each listing. Our Whitepages removal guide covers one of the largest, which also offers reverse phone lookups.
• Ask Google to remove results showing your phone number with Results about you (our Google guide).
• For the full list of sites, see our pillar guide, how to remove your personal information from the internet.

#5. Stop handing your number out

Use a free secondary number (many apps and some carriers offer one) for quote forms, store loyalty programs and online sign-ups. Leave "phone" blank whenever it's optional.

#6. Report illegal calls

Report robocalls and spam to the FTC at donotcall.gov or reportfraud.ftc.gov, including the number on caller ID, any callback number and the time (FTC). You can also file with the FCC. Reports help regulators find patterns, even if your call was spoofed.

#What not to bother with

• Blocking every number manually. Spoofed numbers change constantly.
• Paying to be removed from a "call list." Real opt-outs are free.
• Changing your number as a first step. It helps only if you also keep the new number off forms and people-search sites. Otherwise the new one ends up on lists too.

#The honest summary

Spam calls come from a mix of cheap calling technology, scammers who ignore the law, and lists that make your number easy to get. Call blocking handles the volume. Not engaging keeps you off "live number" lists. Removing your number from people-search sites cuts the link between your phone and your name and address, which matters most for the calls that sound like they know you. Listings can reappear, so re-check every few months; UndoLeak can do that re-checking for you if you'd rather not, but it's the same work you can do with a calendar reminder.

#Sources

1. FTC, "National Do Not Call Registry FAQs." https://consumer.ftc.gov/articles/national-do-not-call-registry-faqs
2. FTC, "Robocalls." https://consumer.ftc.gov/articles/robocalls
3. FTC, "How To Block Unwanted Calls." https://consumer.ftc.gov/articles/how-block-unwanted-calls
4. FCC, "Stop Unwanted Robocalls and Texts." https://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts
5. FTC, National Do Not Call Registry Data Book FY 2025. https://www.ftc.gov/system/files/ftc_gov/pdf/DNC-Data-Book-2025.pdf
6. FTC, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information

Rebecca Cho and her number are fictional.

If you're in danger right now, call 911. National Domestic Violence Hotline: 1-800-799-7233 (1-800-799-SAFE), text START to 88788, or chat at thehotline.org. Free, confidential, 24/7. If you're worried someone is monitoring your devices, consider reading this on a device they can't access, such as a library or work computer or a friend's phone.

If you're planning a move, or you've already moved, to get away from someone who hurt or followed you, you deserve to be safe in your new home. None of what happened is your fault, and keeping your address private is not something you "should have done" sooner. It's hard, partly because so many systems share addresses by default.

This guide covers the main ways a new address gets out and what you can do about each. Not every step will fit your situation. An advocate can help you decide which ones matter most for you.

#Start with a safety plan, and an advocate

Advocates at the National Domestic Violence Hotline help with personalized safety planning, including planning a move and online privacy (The Hotline). If you're dealing with stalking, the Hotline also has a stalking safety-planning guide, and the Stalking Prevention, Awareness, and Resource Center (SPARC) at stalkingawareness.org has information on how stalking works. SPARC doesn't counsel survivors directly; it points to local services. For referrals to local victim services, VictimConnect is at 1-855-484-2846 (call or text).

Local domestic violence programs often know things national guides can't, such as how your county handles court records or which landlords have worked with survivors before.

#Step 1: Ask about your state's Address Confidentiality Program (ACP)

This is the most important tool most people haven't heard of.

What it is. Most states run an ACP, sometimes called "Safe at Home." It gives eligible survivors a substitute address, usually a post office box run by the state, that you can use on public records instead of your real address. The program then forwards your mail to you (NNEDV Safety Net; NASS).

Who's eligible. It varies by state. Programs commonly cover survivors of domestic violence, and many also cover sexual assault, stalking and sometimes human trafficking (NASS). Some states require you to enroll through an approved advocate.

What it usually covers. State and local government agencies generally must accept the substitute address. Many programs also let participants register to vote confidentially (NASS). Private businesses, like your bank or employer, may not be required to accept it, though many will.

How to find yours. The National Association of Confidentiality Programs keeps a state-by-state list with contacts (nacap.org). The National Association of Secretaries of State publishes a brief on which agency runs each state's program (NASS, Jan. 2026). Many programs are run by the Secretary of State or Attorney General. An advocate can help you apply.

Timing matters. If you can, ask about the ACP before you move or update records. It's much easier to keep a new address out of records than to remove it later.

#Step 2: Be careful with mail forwarding

This is a common way addresses leak, and it's not obvious.

• When you file a USPS change of address, USPS sends a move validation letter to your old address and a notification to the new one (USPS). If the person you're leaving still has access to the old address, that letter is a risk.
• Businesses that send bulk mail can update their lists from USPS change-of-address data through licensed services (NCOALink), so a filed forward can spread your new address to mailers' lists (USPS PostalPro).

Before filing a change of address, talk to an advocate or your ACP. ACP participants generally have mail routed through the program instead. Other options people use include updating accounts one by one with a PO box or ACP address, rather than relying on a forward.

#Step 3: Decide which address goes where

Make a quiet list of everyone who might need an address. Then decide for each one: substitute address, PO box, or real address?

#Step 4: Remove your information from people-search sites

People-search sites compile addresses from public records and purchased data and publish them to anyone (FTC). For survivors, these sites are a serious risk.

• Search your name first, privately, to see what's out there. Use a device the other person can't access.
• Opt out of each listing. Our Whitepages removal guide shows how one major site works; the pillar guide, how to remove your personal information from the internet, covers 15 sites.
• Use a separate email address for opt-outs, one the other person doesn't know.
• Give forms only what they require. Never enter your new address on a site that doesn't already show it. If a listing only shows your old address, you can opt it out using the old address.
• Remove Google results that show your contact details using Google's Results about you (our Google guide). Google also accepts removal requests for content that shares personal information to cause harm (Google Search Help).
• If you live in California, a single DROP request goes to 600+ registered data brokers (our DROP guide).
• Check relatives' listings. Your name and city can show up on a parent's or sibling's page. If it's safe to involve them, ask them to opt out too.

Re-check regularly. New addresses can show up in records within months, and listings can return after opting out. Put reminders on your calendar for every 1 to 3 months for the first year. If doing this yourself feels like too much, a trusted friend can do the searches for you, or a removal service like UndoLeak can take over the repeat checks; the opt-outs themselves are free either way.

#Step 5: Check your devices and accounts

Technology can reveal a location even when records don't.

• Location sharing: review Find My, Google Maps location sharing, family-sharing plans and fitness apps.
• Shared accounts: cloud photo libraries, streaming and shopping accounts, and phone plans can show addresses or locations. Change passwords and turn on two-factor authentication.
• Photos: turn off location tagging in your camera, and watch for house numbers or street signs in the background of posts.
• Unknown devices: if you suspect a tracking device or monitoring software, contact an advocate before removing it, since removing it can alert the person. NNEDV's Safety Net Project (techsafety.org) has guides for survivors on technology safety.

#Step 6: Tell people carefully

Decide who needs your new address and who only needs a way to reach you. Friends and family can unintentionally share it, and so can kids' schools and activity groups. Give people a clear, specific ask: "Please don't share my address with anyone, even people you trust, and don't post photos tagged at my place."

Schools and employers can often flag records as confidential when asked. An advocate can help with that conversation.

#A fictional example

Dana moved two hours away after leaving an abusive partner. An advocate from her local program helped her apply to her state's ACP before she signed her lease. She used the ACP address for her driver's license and voter registration, didn't file a USPS forward, and updated her bank and phone bill one at a time. She then searched her name on a library computer, found her old address on four people-search sites, and opted out using a new email account. Three months later she checked again and found one new listing with her new city, and opted out of that too. Her safety plan wasn't perfect, and it didn't need to be. Each step made her harder to find.

#Sources

1. National Domestic Violence Hotline. https://www.thehotline.org/ · Stalking safety planning: https://www.thehotline.org/resources/stalking-safety-planning/
2. SPARC, Stalking Prevention, Awareness, and Resource Center. https://www.stalkingawareness.org/
3. VictimConnect Resource Center. https://victimconnect.org/get-help/
4. NNEDV Safety Net Project, Address Confidentiality Programs and tech safety guides. https://www.techsafety.org/address-confidentiality-programs
5. NASS, "Voting and State Address Confidentiality Programs" (Jan. 2026). https://www.nass.org/sites/default/files/2025-12/Voting%20and%20State%20Address%20Confidentiality%20Programs%20January%202026%20Update.pdf
6. NACAP, Address Confidentiality Programs by State (June 2025). https://nacap.org/uploads/8/8/9/9/88992652/acp_list_for_website_6.2025.pdf
7. USPS, "Standard Forward Mail & Change of Address." https://www.usps.com/manage/forward.htm
8. USPS PostalPro, NCOALink. https://postalpro.usps.com/mailing-and-shipping-services/NCOALink
9. FTC, "What To Know About People Search Sites That Sell Your Information." https://consumer.ftc.gov/articles/what-know-about-people-search-sites-sell-your-information
10. Google Search Help, "Remove my private info from Google Search." https://support.google.com/websearch/answer/9673730

"Dana" is a fictional example. This guide is general information, not legal advice.