How to Remove Your Personal Information From the Internet

Go to Google and type your own name in and you will most likely find more than you were hoping to find: an old address, a phone number you haven’t used in years, a people-search listing with your family’s names on it, perhaps a photo you did not remember. None of that happened by accident. Your data is gathered, bundled up and sold by an industry no one ever considers until they’re face-to-face with it in a search result.

That industry is enormous. By the end of the decade, the data broker industry has been estimated by market analysts to be between $500 and $600 billion and is virtually 100 percent built on information no one voluntarily gave away, such as public records compiled with purchase history, app permissions, and data from breaches you may not have been notified about. Until now, getting your name out of that system meant going to the opt-out form of each broker and filling it out hundreds of times. But that’s beginning to change now. Beginning on August 1, 2026, data brokers registered in California must comply with the state’s new one-stop deletion system the first of its kind in the country, and in several other states, a system is in the works.

This guide will discuss what works now: how to get information out of Google search results, how to respond to data brokers and people-search sites, including that new California tool, how to clean up old accounts and social media, when it’s worth hiring a paid removal service, and when a website just won’t cooperate, what are your legal options. None of it will make you invisible. Nothing does. However, it will make you a much tougher target than you are now.

How your information ends up scattered across the internet

The majority of it comes from totally normal activity. When you sign up for a newsletter, join a pharmacy’s loyalty program, register to vote, purchase a property, take a picture, you’re leaving a tidbit of personal information somewhere, and not much of it remains where it was originally.

There’s also some information that’s automatically collected from websites and apps, such as cookies and analytics, which create a profile of what you’re searching for, where you’re shopping and what kind of device you’re using. Data-brokers operate from another perspective: They cull from public records, such as property deeds and marriage licenses, voter registration lists and court filings, and often most importantly they combine all these with information purchased from retailers, apps, and other brokers to create a remarkably detailed profile that includes your name, where you’ve lived, who your relatives are, your phone numbers, and sometimes an estimate of your income, packaged for sale to marketers, background-check companies, and anyone else willing to pay for it.

There’s also information that you didn’t pick to make public. In the last several years, billions of records have been leaked from businesses you trusted banks, retailers, health care providers, even background-check companies. The data can stay on forums and markets forever, once it’s out, it’s out.

Throw in some professional networking pages, such as LinkedIn, old forum posts, court records, or local news articles, and it’s not hard to see that an otherwise uninteresting, normal life can create a significant online profile without any one event.

Why it’s worth the effort

It is easy to dismiss this as it is information that is widely available, why is it a problem to take it away? The honest answer is that exposure compounds. A name and address by itself is not particularly harmful. A name, address, phone number, employer, and names of your kids together are such a valuable tool kit for a scammer, a stalker or a person conducting a targeted phishing attack.

The most prevalent one is financial. Scattered pieces of personal information can be enough to trick a criminal into convincing them to open credit cards, redirect deliveries or fool a call-center employee seeking to verify identity. Scam callers and text fraudsters know that they are going to contact people by name and that people are more apt to respond if they receive calls or texts with their real name in the pitch.

It’s got a safety aspect as well. People-search websites regularly list home addresses, and that is the information that makes it possible to stalk or make an unwanted visit to an ex-partner. Access to public space is no casual annoyance for journalists, healthcare employees, teachers, judges and people who have suffered abuse.

Then there’s the subtler expense: a long-forgotten post, an antiquated address, an arrest that was dropped, or an embarrassing comment from more than 10 years ago that can come to light during a background check or a first date’s inevitable Google search of your name, affecting how you are perceived by people who never heard your side of the story. This is NOT a feel-good exercise to clean up. It’s a quantifiable decrease in risk, and the amount you decrease is approximately proportional to the amount of effort you put in.

Start with Google: getting yourself out of search results

Google doesn’t generate the information that’s out there about you, it just makes it accessible. That’s exactly why it’s the best place to start. While this won’t have any effect on the actual site, it will significantly decrease its visibility to the general public, as they rarely will go past the first page of results.

Google’s primary tool for this is called Results About You, and you can find it either through your Google Account settings or by typing “Google Results About You” into Google. Install it, and provide the system with your name and identifying information: phone number, email, home address, and Google scans Search for pages that match. The tool can now also detect pages that contain government identification numbers such as Social Security numbers, driver’s licenses or passport numbers, which used to be part of a separate, more cumbersome request, beginning in early 2026. When it is active, enable notifications so new exposures will be pushed to you instead of having to re-search your name every few months.

You don’t need to wait for the tool to catch something. Do a quick search for your name in an incognito window, and now that you have a less personalized result, if the result doesn’t belong to you, click on the three dots to the right of it, and then select remove. It’s a good idea to do a reverse image search of your own photos at the same time, as you may find images of you sitting on websites that a simple text search could never find. Google reworked this flow in 2026 to reduce the number of steps you need to take, and it will ask what kind of information the page shares about you, and why you should remove the page.

Two types receive more expedient, more benign treatment: doxxing information that correlates personal information with threats or incitations to harass you, or imagery occurring without your consent, or for exploitation, such as deepfakes. If either of these scenarios applies to you, be sure to use Google’s forms for those categories instead of the general removal request, these are handled on a different track, and you don’t need to have already written to the site about the issue.

An important constraint: Google doesn’t tend to pull pages it deems to be in the public interest, so pages about news, government sites, and official records are unlikely to move no matter how forcefully you may wish it. The same thing with removal from Search: it does not remove the page from the internet, it merely makes it less visible via Google search. If your house appears in Google Maps street view with a house number, a license plate, or a face you don’t want to be visible mid-walk, you can click the link under the image to flag it for blurring, Google will usually blur it within a few weeks, or the owner of the image for user-submitted images.

Opting out of data broker and people-search sites

This is where a lot of time is wasted and this is where it is the most important because these are the sites that people visit when they search a name out of curiosity, suspicion, or worse. Names like Whitepages, Spokeo, BeenVerified, MyLife, Radaris, Intelius and PeopleFinders are a few of the better-known names, however, there are a large number of smaller websites as well, and they build profiles with your age, relatives, old addresses, phone numbers, and even estimated income.

Look for your name and other keywords such as “phone number” or “address” in search engines to find out if there is already a search page for you, and visit Privacy Rights Clearinghouse’s data broker registry to find most U.S. data brokers, and a link to their individual opt-out process. Some sites allow you to opt out with a simple form, some sites require you to find the opt-out in a very hidden privacy policy and ask you to present a photo ID before taking any action on it. Make note of what you send when you send it: these postings tend to resurface months later, in which case you have to send the request again.

Now there’s a faster route in California! With the state’s Delete Act, the state has implemented the Delete Request and Opt-Out Platform DROP to submit a single verified request to all brokers registered with the state at once, rather than individually. Requests from consumers can be made since January 2026, and registered brokers are legally obliged to respond to requests by checking their platform at least every 45 days and deleting them within 90 days of the request as of August 1, 2026. Over 300,000 Californians have already submitted requests before enforcement started. Even if you don’t live in that area, it’s good to understand what DROP does because it is a good indication of the direction of broker regulation nationally, and a universal opt-out signal, which is simpler, has already been implemented in several states, as described further down.

If you’re willing to sacrifice a couple of weekends and repeat the exercise every so often, you can do it, broker by broker, by hand. If this is too much to handle, then a data removal service will be there to do it on a continuous basis. They are services such as Incogni, DeleteMe, Onerep, and Aura that scan hundreds of broker sites for your listings, file opt-out requests, and here’s the one thing that is really difficult to do manually…they follow up with brokers who are constantly re-listing people who opted out. The price can range from approximately $7 to $10 per month, and coverage varies significantly by service, some have access to 400 or more broker sites, while others have access to 150 to 200 broker sites, so you should find out which brokers a service covers before purchasing one. That isn’t to say that none can guarantee complete removal of public records, and even records that are not picked up by their services require attention, but it saves a ton of time in the repetitive aspect of the tasks.

Some brokers simply do not remove requests, especially smaller and outside-of-country brokers. If someone continues to relist your information after repeated requests, document the pattern, as it will come in handy if you need to call your state attorney general or, in California, CalPrivacy’s enforcement arm, which has issued fines to brokers for not registering or complying.

Contacting the sites that truly host it

Data brokers aren’t the only culprits. There is lots of personal information on ordinary websites: an old blog comment, a forum posting from 10 years ago, a local news article you were mentioned in, a personal site you created in college and haven’t looked at in years. Google’s removal tools only delete the search listing, not the source page, so if you’re looking for information to be removed from Google’s search listings, you’ll need to contact the website owner.

Begin with the “Contact” or “About” page there are still many small sites with a real webmaster’s e-mail address. When nothing is immediately obvious, look at the privacy policy, as GDPR/CCPA contact details must be legally present there, or perform a WHOIS domain search on the domain using a WHOIS search tool to look up the email address of the domain registrar. Some site owners are more responsive via a social media message than an email that may go straight to spam.

Be specific when writing: provide the exact URL (link), describe what personal information is on the page, and explain simply why you would like it removed or anonymized. There is no need to provide a legal basis for a straightforward request, however, if the initial request is not addressed, then listing an applicable law may be beneficial. Keep a copy of your original message and any responses you receive, to use if you need to escalate later.

But not all site owners respond and there are sites that are just left alone with no one to ask. For pages which have been deleted, but for which a snapshot is still available on the Wayback Machine or a similar archive, it seems only fair that most archiving services have their own removal request process after the live version has truly disappeared.

Locking down social media instead of walking away from it

But it’s not necessary to remove all social accounts to get a bit more control over your life, and if there are accounts that you no longer use, it’s probably best to delete them, though it’s possible to log back in and bring them back to life. On your accounts you’re keeping, the privacy settings are more important than you think.

Locking your profile, which is found on the three-dot menu at the top of your Facebook profile and not under the settings in the main menu, hides your posts, photos, and full-sized profile picture from anyone who isn’t connected to you. Instagram and TikTok both have a simple setting to switch to private accounts that only allow content to be viewed by followers you approve, and TikTok additionally offers a feature to limit who can comment or message you an excellent idea even if you’re on a private account. X does have a way to protect your posts so that they are only visible to followers, which will not affect what search engines have already indexed prior to switching the protection on. There are other exceptions, like LinkedIn, where visibility with recruiters and connections is important, but it’s not a bad idea to check out who can access your list of connections, your activity, and contact information, given that a full name, current employer and city are enough to craft a believable fake profile.

If there is any platform that you have stopped using, actually delete it, don’t just set the account to dormant. Because nobody’s monitoring it for suspicious logins, you might still be receiving email from it and not know it, and it’s just sitting there with years of posts and pictures which anyone can access. A forgotten profile is a soft target. Most sites allow a couple of weeks to a month before permanent deletion occurs, so make sure to download a copy of anything you wish to keep before you begin the deletion process.

Retiring the accounts you’ve forgotten about

In addition to their social media accounts, most people have dozens of accounts that haven’t been touched in years on an old shopping site, a forum, a fitness app, a food delivery account from a city they no longer live in, etc. They’re all minor risks, like a password that may be used at other sites, contact and card information that’s stored on a server you don’t control, and one more place your data could find its way out if the company gets hacked.

A simple first step is to see if your email address is one of those compromised in a data breach you’re aware of, such as with a free tool like Have I Been Pwned. It won’t be comprehensive, but it will allow you to quickly filter out any accounts associated with a password that has already been compromised and prioritize that login and their subsequent deletion once you’re logged in to them.

Sift through your Inbox and remember all the old sign-up confirmations, shipping receipts, and “we miss you” marketing emails, it makes a pretty solid list of accounts to which you might not remember to check. Log in to each and check for a delete-account option, typically within account settings and not on the dashboard. Removing the app from your phone will not delete the account or data associated with it.

From now on, purchase items with your secondary email address and sign up for newsletters, etc., so you don’t end up with your primary email address on as many broker email lists as possible. Most large email companies will now give you an email alias to send and receive emails that also go to your real address, but that can be deleted separately once it begins receiving junk email.

Mugshots, court documents, public listings of background checks

In the U.S., arrest records are open to the public and there’s an entire niche of websites dedicated to doing nothing more than taking photos from county jails and putting them up somewhere where people can search for them, sometimes when they were never convicted, sometimes long after charges were dropped. Many mugshot websites duplicate each other’s information, leading to a single arrest being posted on five or 10 sites.

If your case was dismissed, sealed, or expunged, obtain the court records first. It makes a good removal request a lot stronger, and is frequently needed by the sites themselves before they will do something. Typically, these sites will have a removal or record update process, which may be coupled with a customer-support form instead of a readily visible opt-out link, so provide any case number or pertinent documents when you submit. One thing to know beforehand: In several states, it is illegal to charge a fee to remove a mugshot, so be wary of any site that asks for money for a quick mugshot removal. That’s a pattern that occurs more frequently on sites owned by the same company that originally posted the photo and benefits from both sides of the same issue.

After source sites have removed it, file a Google image removal request to get rid of any thumbnails that may show up in Google’s search even after the page has been pulled down, as this may take some time.

There are background-check and tenant-screening sites, which is a separate but related issue, as landlords and hiring managers utilize them as needed, but not curious searchers. These are generally governed by the Fair Credit Reporting Act, and not the data broker laws discussed elsewhere here, and you generally will have the ability to dispute inaccurate information with the company doing the data collection, just as you would with a credit file.

The legal avenues for a takedown

Frequently, asking politely is more effective than you think, but sometimes it isn’t, and when a site does not accede to your request, or restores the content it previously removed, it is good to understand the legal recourse.

In the European Union and the UK, there is a true Right to Erasure: the GDPR gives you the right to have your data erased from the company’s records with limited exceptions, such as for the retention of legal records. A similar concept is known as the Right to be Forgotten, which allows you to request that search engines remove certain results from their search results, but not from the web.

There is no one statewide equivalent in the U.S., but the state-by-state picture has been filled in significantly. The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) empower consumers to request that a business disclose the information it holds, to request deletion of their information, and to opt out of the sale of their information, and California has even more, with the Delete Act and its DROP platform targeting data brokers. Nearly two decades ago, Virginia, Colorado, Connecticut, Texas, and Oregon began to pass laws with similar consumer privacy provisions, but the specifics of what can be requested vary by state.

Many of these states also have a law mandating that companies respect Global Privacy Control, which is an automatic signal sent by your browser to all sites you visit, notifying them not to sell or share your information. Unlike some other tools in this guide, it’s built directly into Firefox and a few privacy-focused browsers and available as a free extension for Chrome, so you set it up once and it continues to run in the background.
When someone has posted unauthorized photos, writing, or video that you actually own, they typically go through a DMCA takedown notice process, and most web platforms, Google included, have a specific place to submit these kinds of complaints. If the problem is more of bad and damaging claims rather than stolen content, that’s more in the realm of defamation, which can progress more slowly, and an attorney can help, but it is still an option if a website won’t correct an obviously false statement.

COPPA applies to children under 13 and limits the collection of data about them, and Google separately provides a parent or guardian with a more expansive ability to request the removal of a child’s personal information from search results, including images, than is offered to adults.

When a stalker/abuser is involved

All of this is privacy hygiene, but if you are a victim of domestic violence, stalking or sexual assault, having your home address exposed is not a background risk. It’s an active threat and requires greater protection than an opt-out form can provide.

Most U.S. states operate a free Address Confidentiality Program (ACP) which, usually through the Secretary of State’s or Attorney General’s office, provides a substitute legal address to eligible survivors who have recently moved. They will forward mail you send there to your real address, and it will be used for voter registration, driver’s license records and other public records of someone’s address in lieu of your actual address, thus depriving an abuser of one of the most common ways to find out where someone lives. It’s free, and you usually apply through some kind of paperwork through a certified advocate at a domestic violence or victim services organization.

In the filings and records associated with a protective order, a court may be able to seal or redact your address and contact information as well, though this is not necessarily something that will happen automatically, it should be requested by the victim advocate or an attorney. The Address Confidentiality Program also addresses a set of issues that otherwise would remain public even if all broker listings were removed, namely the address associated with voting, vehicle registration and other government records.

The National Domestic Violence Hotline (1-800-799-7233) can provide you with information about the resources available in your area, including how to apply for your state’s program.

Whether a paid removal service is worth it

In this case, the trade-off is between time and money. It’s a complimentary service and takes only a few evenings to complete repetitive forms, which will keep coming back as listings appear and reappear, to do all this yourself. The ongoing task of re-checking each broker every few weeks to look for relisted data is handled by a subscription service, which costs roughly $80-$120 per year.

The service makes the most sense if you value your time more than the subscription fee, you want to go through the process of finding a broker manually as well and got tired around the 30th broker, or if you’re looking to cover multiple family members with a single plan. It doesn’t make as much sense if your exposure is, say, a few websites you can realistically monitor, or if you’re just trying to address a specific website, maybe a defamatory post, or a mugshot, which typically these services aren’t designed to address, but rather breadth among data brokers.

No matter which one you decide to follow, be wary of any company that guarantees to remove everything completely and permanently, as well as any company that requests payment just to remove what it or an affiliated website published in the first place. That pattern is far more prevalent with mugshot and reputation-repair companies, and it’s a business model that is based around the very issue it is attempting to resolve. A legitimate service will be honest about areas they cannot reach, will make you aware of what remains to be done for the job, and will not pressure you for payment.

How long this actually takes, and keeping it from creeping back

Don’t expect to finish this project on a clean finish line, set realistic expectations from the beginning. Google will generally respond to a removal request within a few days. Typically, it takes one to four weeks for an individual broker opt-out to go through, although some take longer, sometimes months, especially if the broker requires ID verification by mail. A full first pass manually on all the brokers with your information takes most people a couple of weekends or more over a month or two, not an afternoon.

Not to mention it’s never really over, since the same information and public records that led to your listing in the first place are also used by the brokers to rebuild their databases. Be sure that at least some of what you have taken will come back in six months to a year. That’s why it makes more sense to set a reminder to look for yourself every couple of months, rather than clean up just one time with Google notifications on or sign up for a removal service that monitors the results for you continuously.

This cycle is less likely to recur in the future due to a few habits. If you enable Global Privacy Control, as explained above, you will opt out of data sales on all of the sites you visit without having to do anything else. Disabling cross-site tracking in your browser reduces the amount of new information being fed to ad networks and analytics services in the first place, and using a VPN is always advisable when you’re using a public Wi-Fi network to prevent your traffic from being exposed on a shared network. Guest checkout for one-off purchases and a different alias email for signups prevent your main account from getting your new identity into new broker source lists. But it promotes the idea of thinking twice before using any location tags, workplace, kids school, etc. That’s one thing you can never completely erase once it has been viewed and screenshot by others.

The honest limit of how far this can go

It’s impossible to be 100% incognito when online, and it’s wise to stay away from anyone who claims to be 100% incognito for a price. Search engine caches, the Wayback Machine, screenshots, breached data that’s already out there, on forums, and public records that will always remain public will leave some sort of trace. AI systems that have been trained with information from the public web introduce an extra level that’s actually tough to relax as soon as information has actually been scraped and integrated right into a model.

What you are really trying to achieve with this is not total removal, but a reduction in the obvious, easy routes to your information and making it harder to find you than to get to the information. Even if there are a few older records that are still technically accessible somewhere else, that’s enough to significantly decrease your risk of scams, identity theft, and unsolicited contacts.

Think of this as a quarterly check-in, not a single weekend you never have to repeat, an idea that might be better thought of as an always-clean-up. Address whatever seems most pressing: if it is a Google removal tool to get rid of a home address and/or phone number that keeps appearing, or if spam and scam calls are the primary headache, or if safety is truly an issue, then go with the Address Confidentiality Program first. Everything else can come on board once the most pressing exposure is dealt with.