OSINT defense

Doxxers rarely find one document with everything in it. They correlate: each small fact (a username, a photo, a phone number) is a key that opens the next source. A typical chain runs from a gaming handle, to the same handle on an old forum, to an email address in a leaked database, to a people-search profile with a home address and the names of relatives. Removing one piece helps most when it breaks a chain like that.

Automation makes correlation fast. Free programs check a username on thousands of sites in minutes, and face search engines match one photo against images from across the web. In 2024 two Harvard students combined Meta's smart glasses with the PimEyes face search engine and other tools to go automatically from a stranger's face to their name, phone number and home address (404 Media).

• California's DROP is live. Since 1 January 2026, California residents can send one deletion request to every registered data broker through the free DROP platform. Brokers had to start processing requests by 1 August 2026. By late August more than 500,000 people had signed up and 654 brokers were part of the system (CalPrivacy).
• Fines for brokers. In August 2026 California's privacy agency fined the Iowa data broker LocateSmarter $116,490, partly for demanding the last four digits of a Social Security number before letting people opt out (CalPrivacy). The agency has brought more than a dozen enforcement actions against data brokers, mostly for failing to register.
• Data brokers and political violence (June 2025). Investigators said notebooks belonging to the man who shot two Minnesota state legislators and their spouses listed 11 data broker websites that offer home addresses. He pleaded guilty to federal charges in June 2026 and was sentenced to life in prison (Wikipedia summary of the reporting).
• WHOIS gave way to RDAP (2025). Since 28 January 2025 registries and registrars for generic top-level domains no longer have to run the old WHOIS service, except for .com, .name and .post, and must answer lookups through RDAP (ICANN). ICANN's Registration Data Policy, in force since 21 August 2025, sets which registrant details are redacted and lets registrants consent to publication (ICANN).
• Face recognition. In October 2025 a UK tribunal ruled that UK data protection law applies to Clearview AI, which scrapes faces from the web for police and security clients, and sent the regulator's case back to a lower tribunal to decide on the merits (Upper Tribunal decision). In August 2026 a published Meta patent described smart glasses that use face recognition to detect who is in view (404 Media).
• Removal services. Consumer Reports' Permission Slip app now redirects to DeleteMe, which says Permission Slip "has joined DeleteMe" (DeleteMe). Incogni published a Deloitte limited-assurance report in August 2025 on how many brokers confirm its requests and how often it re-sends them (Incogni).

Do this before paying anyone. An audit shows which exposures matter most and gives you a baseline to measure removals against. Search from a private window while signed out, so results are not personalised, and keep your notes (URLs, screenshots, dates) in an encrypted file (Encryption).

1. Search your name in several search engines, in quotes and combined with your city, employer, school, phone number and past addresses. Look beyond the first page. Repeat for close relatives, because people-search profiles link family members to each other.
2. Search every username, email address and phone number you have used. Run the usernames through the tools below, and search the email addresses and numbers in quotes.
3. Check data breaches for each email address with Have I Been Pwned. A breach tells you which accounts to close, which passwords to change and what an attacker may already know.
4. Reverse-search your photos. Upload current and old profile pictures to Google Lens, Bing, Yandex and TinEye. These mostly find copies of the same picture; face search engines go further and find other photos of the same face (faces). An older Bellingcat test found Yandex far better than Google or Bing at matching faces (Bellingcat, 2019).
5. Look yourself up on people-search sites. Start with the sites marked as most important in the opt-out list below. Note every listing, including ones with old addresses or wrong details: they still connect you to relatives.
6. Check the public records that apply where you live: property records, company registrations, court records, voter data and domain registrations.
7. Map the chains. For each finding, note what it links to. Deal first with anything that ties your name or face to your home address, your workplace or a pseudonymous account.

Self-audit tools

Make a list of every account you can find: entries in your password manager, old "welcome" and "verify your email" messages in your inbox, and the hits from your username search. Then decide for each one: keep and harden, or delete. Download your data first if you want to keep anything.

Accounts you keep

• Set profiles to private or friends-only where you can, and hide friend, follower and following lists. Your contacts reveal your family, workplace and town.
• Remove birthday, hometown, school, employer, relationship status and phone number from profiles. Use an email alias for sign-ups (Email).
• Turn off settings that let people find you by phone number or email address, and stop apps from uploading your contacts.
• Require approval before tags appear on your profile, and remove old tags and location check-ins.
• Change usernames and profile pictures that match your other identities (Separate identities). Use a unique photo for each account you want kept apart, as EFF advises (EFF).
• Check apps people forget: payment apps can show who you pay (Venmo lets you set payments to Private (Venmo)); fitness apps can show where your runs start (Strava can hide the start and end of activities (Strava)); and review, wish-list and music sites often have public profiles.
• Developers: Git commits record an email address. GitHub offers a no-reply address to use instead (GitHub Docs).

Deleting old posts and accounts

Old posts are a rich source: past addresses, photos of your house, your children's school, your writing style. Bulk-deletion tools save hours. For Reddit, the free Power Delete Suite bookmarklet (public code, but no licence file) edits and deletes your comments and posts in bulk, though it has not changed since November 2024.

Data brokers collect personal information from public records, purchases, apps and other brokers and sell it. People-search sites are the public face of the industry: type in a name and get addresses, phone numbers, relatives and court records, often for a small fee. Most offer an opt-out form, but they keep buying fresh data, so listings often come back. Plan to repeat opt-outs every few months.

• Use a separate email alias for opt-outs, and do not give a broker details it does not already show, such as a new phone number (Email).
• Some sites ask for a phone call or a copy of your ID. Redact everything on an ID except what the opt-out needs, or skip that site.
• Ask the people you live with to opt out too, since their profiles list your address.
• Start with the largest sites: many smaller ones resell their data, so removals there can spread.

Your rights depend on where you live

• California: residents can use DROP (below) to reach every registered broker at once, and can send deletion requests to other companies under the CCPA.
• Other US states: a growing number of state privacy laws give residents a right to delete, for example in Virginia, Colorado and Connecticut. Most exclude information lawfully available from government records, which people-search sites rely on heavily, so voluntary opt-outs remain the main tool.
• Judges and some officials: the 2022 federal Daniel Anderl Act protects federal judges' home addresses from resale by data brokers (US Courts), and some states, such as New Jersey, protect judges and other public officials too.
• EU, EEA and UK: the GDPR gives you a right to erasure (Art. 17), with exceptions such as freedom of expression and legal obligations. Companies must answer within one month, extendable by two more, and free of charge in most cases (Art. 12). If they ignore you, complain to your national data protection authority.
• Search engines in Europe: you can ask Google to delist results for searches on your name that are inaccurate, inadequate, irrelevant or excessive. Delisting applies to EU versions of Google Search, and Google also restricts the result for people it locates in your country; it is not applied in the rest of the world (Google).

Free and official routes

Removal services find your listings and submit opt-outs for you, then repeat the process on a schedule. They save time, but they cannot do anything you could not do yourself, and they need your real name, addresses, phone numbers and often your date of birth to work. That is one more company holding a tidy profile of you, so paying privately gains little. Consumer Reports noted in 2024 that several services' privacy policies allow your data to be transferred if the company is sold.

Face search engines turn a face into a mathematical fingerprint and compare it with faces collected from public web pages. Unlike ordinary reverse image search, they find other photos of you: a conference picture, a group shot on a club website, a tagged photo on a friend's blog. Anyone with a photo of you, including one taken in the street, can use them.

• Keep clear, front-facing photos of yourself off public pages where you can, and replace old profile pictures that show your face.
• Ask friends, employers, schools and clubs not to post or tag photos of you, or to keep them behind a login.
• Consider opting out of PimEyes and FaceCheck.ID (below). It is a trade-off: opting out removes you from their results only, the photos stay on the original sites, and you must send a photo of your face (PimEyes also wants an ID with other details blacked out).
• Clearview AI, which sells access mainly to police and security agencies, offers deletion or opt-out forms to residents of some US states, including California, Virginia, Colorado and Illinois (Clearview). In the EU and UK you can use your GDPR rights.
• Do not rely on "cloaking" tools such as Fawkes or LowKey that add invisible changes to photos. Researchers showed that newer models can defeat the protection after the photos have already been collected (Radiya-Dixit et al., ICLR 2022; Data poisoning).

Your home address is usually the most dangerous piece of information to leak, and the hardest to pull back, because it flows from official records into broker databases. The best protection is to stop it entering new records in the first place. Laws differ widely between countries and US states, so check local rules before you rely on any of these.

• Mail. A PO box or a private mailbox at a commercial mail receiving agency keeps your street address off deliveries, subscriptions and some registrations. It does not hide you from the authorities: in the US, opening a private mailbox needs two forms of ID, one with a photo, and the form is uploaded to a Postal Service database (USPS Form 1583).
• Address confidentiality programs. Many US states give survivors of domestic violence, sexual assault or stalking a substitute address that state agencies must accept, and forward their mail. Washington's program also shields voter and marriage records (Washington ACP). NNEDV keeps a state-by-state chart, last updated in March 2023 (NNEDV).
• Property. Ownership records are public in many places. Some people buy a home through a trust or company so their name is not on the public record; whether this works, and what it costs, depends on local law, so take legal advice.
• Company filings. Business registers often publish an owner's or director's address. Where the law allows, use a registered agent or service address instead of your home.
• Voter registration. In many US states voter records are public or sold to campaigns. Address confidentiality programs and some state rules can shield them.
• Family. Relatives' people-search profiles list your address too, and so can wedding sites, obituaries and holiday cards posted online. Ask household members to opt out with you.

Domain names

Registering a domain used to publish your name, address, phone and email in the public WHOIS directory. Under ICANN's Registration Data Policy, registrars must redact your name, street, postal code and phone where the law requires it, must offer a contact method that does not reveal your email address when they redact it, and may publish redacted fields only with your consent (ICANN). Many registrars redact for everyone; check yours, and decline consent to publish. Country-code domains such as .de or .us follow their own national rules. Commercial "historical WHOIS" databases still hold records from before redaction became common, so a domain you registered years ago may still lead to you. See Server hosting and domains for registering domains with less personal data.

Exposure is not a one-time fix. Brokers relist people when they buy new data, new breaches happen, and friends post photos. Put a reminder in your calendar every three or four months to repeat the self-audit and the opt-outs that matter most.

• Set up Google Alerts for your name in quotes, your street address and your phone number, delivered to an email alias.
• Turn on breach alerts at Have I Been Pwned for each email address you use, or use Mozilla Monitor, which monitors up to five addresses for free.
• Re-run your username checks whenever you create a new account, and before you link an old identity to a new one.
• In the US, a credit freeze at Equifax, Experian and TransUnion is free and does not affect your credit score (FTC). It does not hide you, but it limits what someone can do with leaked identity data.

• Paying before auditing. A removal service covers a fixed list of sites. Without your own audit you will not know what it missed.
• Opting out once. Listings return. Repeat the main opt-outs every few months, or use a service or DROP that repeats them for you.
• Giving brokers more than they have. An opt-out form that asks for a new phone number or email address may add it to your profile. Use an alias and share only what the listing already shows.
• Locking one account and forgetting the rest. A private Instagram does not help if the same username and photo sit on a public forum.
• Forgetting other people. Relatives' profiles, a partner's public posts and tagged photos at a friend's party can undo your own work.
• Posting in real time. Photos from home, regular routes and live locations show where you are and when. Post later, and check the background first.
• Feeding surveillance tools to check yourself. Uploading your face or ID to a face search engine "just to see" gives it exactly what it wants.
• Trusting "we removed everything". No service or law removes data from every source. Measure results with your own searches.

• Consumer Reports: Data Defense, Evaluating People-Search Site Removal Services (2024)innovation.consumerreports.orgIndependent test of seven removal services, with methods and per-site results.
• EFF Surveillance Self-Defense: Protecting yourself on social networksssd.eff.orgPrivacy settings, separate identities and why privacy is a team effort.
• Privacy Guides: EasyOptOuts review and real-world test (2025)privacyguides.orgA small hands-on test showing what an automated service does and misses.
• Bellingcat: Guide to using reverse image search for investigations (2019)bellingcat.comHow investigators use reverse image search; useful for auditing your own photos.
• Google: EU privacy law delisting in Searchsupport.google.comHow "right to be forgotten" requests are assessed and where they apply.