Yes and no, but mostly no.
Once again, there’s no black-and-white, yes-or-no answer.
These services do remove some of your information from the internet. But it’s impossible to remove everything, no matter what their marketing materials imply.
Troy Hunt, of Have I Been Pwned fame, recently published Swimming Pools, Pee, and Trying to Delete Your Data From the Internet. I want to share some of his insights.
Data removal services: yes or no?
You can pay someone to remove some of your personal data from the internet, but not all of it. Legitimate data brokers might listen, but hackers and shady sites won’t. Once your data leaks, you can’t undo it. Vigilance and skepticism are the only solutions.
The core issue
It’s an attention-grabbing, if somewhat icky, metaphor: putting information anywhere on the internet is kinda like peeing in a swimming pool. You know it’s in there, but removing it isn’t realistic.
The complication (which the metaphor doesn’t really address) is that some of your information can be removed from certain corners of the internet.
The question is, is that enough? The answer, much like pee in a pool, is: probably not. Certainly not enough to be comfortable.
Data removal services tend to underemphasize that and focus on the things they claim they can remove.
Help keep it going by becoming a Patron.
Related
How Do You Delete Things from the Internet?
Realistically, it's impossible to delete things from the internet. Yet in an apparent contradiction in terms, if you happen to delete something in your control, you also can't get it back.#27274
How data removal works
The premise is simple.
- A variety of data brokers have your data. This is quite true, and there are many, ranging from legitimate companies like credit reporting services to less-than-legitimate companies that will take and sell data to and from anyone.
- Data removal companies have a long list of data brokers that they ask to remove your data.
This is where things break down in two ways:
- This relies on the cooperation of the data brokers. Some might remove your data, but many ignore the request.
- The list of data brokers is, by definition, incomplete.
While #1 is annoying, #2 is more concerning. Data removal services ask all the “legitimate” data brokers to remove your data, but they have no way to ask all the various shady information brokers to do so. There are just too many, and they’re constantly changing. In many cases, the data is “out there” for the taking without a record of who has a copy.
Related
What Should I Do About the Latest Breach?
Yet. Another. Breach. Don’t panic, I'll walk you through what you really need to do next. From checking if you’ve been exposed to strengthening your account security, it’s all here in simple terms.#70298
There’s no undoing a breach
Legitimate data brokers get data in legitimate ways.1 These are the services that are most likely to respond to requests to remove your data.
Hackers? Not so much.
If your data is exposed in a breach:
- Most of the time, there’s no way to contact the parties responsible.
- Even if you can, they’re likely to ignore requests to remove your data from what they’ve stolen.
- Even then, your data has likely already been copied to multiple places, many of which are outside anyone’s direct knowledge or control.
To quote Hunt discussing his wife’s data being part of the “ShinyHunters” leak,
Because we’re talking about digitised data posted publicly, it replicates like crazy. There will be tens of thousands of copies of my wife’s personal info floating around between personal stashes, Telegram channels and public hacking forums. That genie is never going back in the bottle…
So, are data removal services lying?
For the most part, no. I’m sure some lie, but the majority are legitimate. If you read what they promise carefully, you’ll see they don’t promise everything their marketing might imply.
So what we’re left with is data removal services being effective for legally operating brokers who honour legitimate requests, whilst being completely useless against the worst kinds of sites that replicate and abuse your data. In other words, you may be able to opt out of some marketing material or content that’s way too specifically targeted to you, but you can’t stop the bad guys trying to steal your identity or extort you…
Honest people will be honest and play by the rules, but bad actors will always be out of your grasp or the grasp of data removal services, no matter what they promise or imply.
These paid removal services aren’t a scam, but they can’t really do what people want or think they’re paying for: they can’t undo a data breach.
Do this
My take is that data removal services are ineffective at removing the data we really want removed, and thus not worth it. If you feel that removing your data from legitimate data brokers is worth it, then it might be. It’s not something I would personally prioritize.
The real takeaway here is that you have to assume your data is “in the wild” and act accordingly. What does that mean? More than anything else, it means being skeptical. Your data can be used to create amazingly realistic phishing attempts. And of course, watch your bank and credit card statements. Ideally, get notifications on all transactions, but if you can’t, check regularly for transactions you don’t recognize.
Yes, it’s very unfortunate and frustrating that we’re in this situation, but all we can do is be aware and take control of what we can.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Footnotes & References
1: You might not agree with or like the data collection, but technically, it’s all part of the terms of service that you agreed to when using an online service.
Always interesting to get your take, Leo.
Have you any thoughts yet about the new California state-run Delete Request and Opt-out Platform (DROP) that will start removing CA residents’ data starting August 1, 2026?
I should have noted CA residents have to request their data be removed.
The infamous* GDPR in the EU has a policy which mandates the removal of news stories and search results about criminals who have “paid their debt to society”. There was a famous murder case which was scrubbed from search engines in Europe. I was struck by the Streisand Effect and wanted to see what was being hidden. I fired up my VPN and googled the name and it came up. And don’t forget The Wayback Machine from The Internet Archive. I once reconstructed a website using the Wyback Machine.
*GDPR is actually a series of important prvacy protections, but most people see them as the morons that gave us those annoying idiotic cookie warnings.