You’ve Never Heard Of These Sites, But They Know A Lot About You

My friend Jane heard of mylife.com when her friend’s father died. They did a Google search of his name and in the results was mylife.com; his picture and a list of his prior home addresses. With one visit to the site, they had access to his date of birth, location of death, siblings, children, spouse, net worth, and finally, a big red reputation score, a 3.6 out of 5.

Jane was creeped out. Her friend was offended. Really, a reputation score?

Jane looked up herself. She looked up her parents. She scrolled through similar details pausing at ‘marital status: divorced’ listed under her father’s name. Her parents had been together since she was born and still lived in her childhood home. She wasn’t surprised that a shady site like mylife.com would have some errors.

Then she showed her mom. And when Jane pointed out the divorce error, her mom hesitated then said they needed to talk. Jane’s parents were indeed divorced. They’d been since she was in middle school. They didn’t tell the family and continued to live together to avoid disruptions. But after waiting years, the timing never felt right to share the news. From mylife.com, Jane learned that her parents had been divorced for 5 years.

Jane told me this story when I let her know about Kanary, the project I started to track down and stop sites collecting and selling personal information without consent. After years of working in political analytics, I saw how the sausage was made and wanted to restore the privacy we'd lost. She immediately understood why the project was important and why more people needed to find out what was going on with their personal information.

MyLife is a class of website called a data broker. The definition of a broker is, “a person who buys and sells goods or assets for others.” Real estate brokers sell real estate that’s not theirs. Stock brokers sell stock that’s not theirs. A data broker sells data that’s not theirs.

In the data broker taxonomy, MyLife is in a subclass called people search sites. They don’t just sell information, they post it publicly. Anyone can look up someone by name, email, phone number, or address and purchase their full profile including reputation score. 

There are thousands of data brokers like mylife.com. Their only purpose is to compile social and behavioral data about as many people as possible. They’re creating hireability scores, reputation scores, social scores, and persuadability scores. They call these scores data enhancements and tell brands that they’ll save a lot of money if they use them to target the right people with ads. “Find out who doesn’t like you, then don’t waste money sending advertisements to them,” they claim. For companies, it makes sense. Why would an engagement ring company send an ad to someone who isn’t interested in buying an engagement ring? 

On an individual level, it feels pretty harmless. You might not care if an engagement ring company knows you’re not interested in buying an engagement ring. You might be grateful to not get ads about stuff you don’t want. 

But you should care about who knows this information about you and how they know it.

If you had to make your best prediction about whether someone was going to get engaged in the next 6-12 months, what would you want to know? You might want to know how old they are, their gender, their sexual orientation, their relationship status, the length of their current relationship, how many relationships they’ve had in the past, if their parents or siblings are married, if they’ve ever been divorced, how much of The Bachelor they’ve watched... feeling invasive yet?

Data brokers keep digging to make the perfect prediction. They find out where you live, the marriage rate in your zip code, the marriage rate across your social network, if you’ve recently been laid off, your criminal record, your alcohol and drug consumption, how much money you make, how much debt you have, if you have children, if you still have accounts on dating apps, your political affiliation, your credit score, and maybe even your workout schedule.

Data brokers acquire this information through data partnerships, contracts, and website scraping. They pay state governments for voter records. They pay the DMV for your age and driving records. They purchase census data to understand marriage rates and income levels in your zip code. They find your family information through online phone books and ancestry lists. They pay court houses to pull marriage and divorce records. They pay streaming services to find out what shows you watch. In a couple lines of python, they scrape the relationship statuses of you and your friends from Facebook or Instagram. They purchase your stock buying history from Robinhood and your debt levels from the credit bureaus. They buy leaked databases of employment records or simply scrape your LinkedIn profile. They partner with mobile apps to scan your phone for active Tinder or Grindr or Feeld accounts. They partner with free VPNs to collect every website you visit. The most advanced brokers will mine photos of your face to determine your agreeability, likability, or attractiveness.

With this raw information, why would they stop at engagement predictions? They can predict other valuable outcomes like who you’ll vote for, how you’ll respond to a payday loan offer, or what price you’ll be willing to pay for your next rideshare. All these predictions become profiles and scores sold to advertisers, employers, or random people looking you up on the internet.

I started working on tracking down these sites and removing information from them about a year ago. Since starting I've built a small team and a software platform that tracks over 2,500 websites that share and sell personal information without consent. You could manually go through and remove yourself from each one. But 2,500 sites x 5 minutes per site to find and remove your info = 208 hours. Doing this at least 2 times a year as data pops up and recirculates would take 408 hours or 51 eight-hour work days. Keeping up is an inhumane task. This is why we’re automating the removal processes so all it takes to remove yourself is one click.

But if this is your first introduction to who these companies are, what they know about you, and why this puts your privacy, security, and safety at risk, you might want to see it for yourself. I recommend starting with the following 8 sites that have fairly straight forward opt outs and track a lot of information about you. It takes about 30 minutes to submit the removal requests and opt outs across these sites, and 2-3 weeks to receive confirmation they’ve removed you from their systems.

Why: They boast having 11,000 attributes about over 2.5 billion people. This means you’re likely in their database and they’ve collected or predicted 11,000 things about you. They also make ~$900,000,000 each year selling personal information and predictions.

How To Opt Out: Go to https://isapps.acxiom.com/optout/optout.aspx, fill out the information you’d like to remove from their databases, enter an email you can use to confirm the request (ideally use an alias email, not your primary email), complete a captcha, submit the request, then click the confirmation link they send to your email, and complete another captcha. They claim they will not use any new information used to submit the opt out in their terms and conditions.

Why: On their site they highlight offering scores that show the best way to collect debt from people. They also claim their socioeconomic health attributes help insurance companies forecast potential risks (aka high costs associated with certain patients).

How To Opt Out: Note: this one requires a California address* and proof of ID like drivers license # or SSN. Go to https://consumer.risk.lexisnexis.com/request#california, fill out the form, (share your driver’s license, not SSN, if possible), select both the ‘do not sell’ and ‘delete my information’ options. Complete the captcha and submit the request. In about 2 weeks they will send a letter to the address you entered confirming they’ve removed you from their database. If they can’t confirm your identity from the info you submit, you won’t receive anything. 

If you don’t have a California address, you can still bug them to remove your information by emailing a removal request to [email protected] or calling them at 1-888-497-0011, but no guarantee they'll respond.

*This is why we need comprehensive Federal Data Privacy Regulation in the United States.

Why: They aggregate information across social media sites and make it publicly searchable by name, address, phone number, and email. One of their testimonials is from someone who claims BeenVerified helped them snoop on their significant other to find out they were a liar. Great relationship goals.

How To Opt Out: Go to https://www.beenverified.com/app/optout/search, fill out your name and state, click submit. Go through the results to find the records that look like you or family. Click one, fill out the captcha, submit a unique email or email alias, go to your email and click the confirmation link. They’ll require a unique email for each request you submit. They’ll email you again once the request has been received and once the information has been taken off their site.

Why: Their information is publicly searchable by name, email, phone number, or address. They sell premium subscriptions to access additional information like criminal records and reputation scores. They’ve been sued by the FTC for misleading practices and false claims.

How To Opt Out: Go to www.mylife.com, search for your information. Click the results that match and you want removed. Email the links to your information to [email protected] with a subject and message saying “delete my information and remove me from your site immediately”. They’ll respond within 2-3 weeks and confirm the removal.

Why: They’ve also been sued by the FTC. They claim to have 6,000,000,000 consumer records publicly searchable so your information is likely on their site. They have the ‘Forbes’ logo listed but immediately have a disclaimer saying that Forbes hasn’t endorsed or sponsored them for anything.

How To Opt Out: Go to www.spokeo.com, search for your information, copy each link to your results individually and paste them on this page https://www.spokeo.com/optout. Add an alias email to the form, solve the captcha, and press submit. Go to your email and click the confirmation link they send you. They’ll email you in 2 weeks confirming the removal. 

Note: They don’t remove address information, but they will remove your name from an address listing.

Why: They are one of the source systems for many little data brokers and people search sites. Removing your information from Radaris is like pulling a weed out by the roots.

How To Opt Out: Go to https://radaris.com/, search for your information, copy each link to your results individually and paste them on this page https://radaris.com/control/privacy; make up a username, don’t use your real name. Add an alias email to the form, solve the captcha, and press submit. Go to your email and click the confirmation link they send you. They’ll email you in 2 weeks confirming the removal or telling you they can’t find your information. Another alternative is to email them directly at [email protected] with the links and personal information you want removed. Again, use an alias where possible.

Why: They are owned by a personal data broker monolith called People Connect. They’ve been recently hit with a class action lawsuit for charging people without letting them know. Unfortunately, People Connect is unresponsive to removal requests, so removing yourself from Intelius is the next best thing. (Feel free to try bugging [email protected], but it's unlikely they'll respond)

How To Opt Out: Go to https://www.intelius.com/opt-out/submit/, search your name and state. Enter an alias email. Review the results and click to remove a result that matches your information. Complete the captcha and click on the confirmation link they send to the email you first entered. You can submit multiple removal requests with multiple unique alias emails. They will send you an email once your information has been opted out successfully.

Why: They make hundreds of thousands of personal records searchable by name, email, phone number, residential address, vehicle id number, and ip address. They post this information for free and do not offer any paid subscriptions. In addition to contact information, they’ve created wealth, travel, tech, shopping, and green scores.

How To Opt Out: They offer an opt out form, but it’s easiest if you go to https://thatsthem.com/people-search, search for your information, copy the links to the pages about you, and send an email to [email protected] listing the page links you want removed. Once again, send the email from an alias if possible.

Blocking these sites from selling and sharing your information and limiting the information you share to begin with can have both personal and societal impacts. On the personal level, it can reduce the amount of spam you get, your risk of harassment or stalking, the specificity of a targeted phishing attempt or hack. It can help you keep personal information private (even if it’s technically public), like marital status, sexual preference, religion, or divorce. It can also protect your family members from being targeted by someone using your information.

On the larger scale, it can impact the progression and acceptance of surveillance across our society. We can accept the terms and conditions offered by governments and corporations in exchange for ultimate convenience. Or we can actively demand rights to be forgotten, rights to privacy, and rights to control our information.

To learn more about Kanary and try it for free, check out our website.

I’d love to hear from you if you have questions, suggestions, or feedback. Send me a note - [email protected].