If you’ve worked through The Tripwire article, you should, by now, have done the audit. You know what comes back when someone Googles your name, which data broker sites have built a profile on you, and roughly what your digital footprint looks like from the outside. That awareness is useful. But awareness without action only gets you so far.

Today, we are going to look at the other half of the equation: actually doing something about it. The first pass through this process does the most heavy lifting with regard to the work. Maintenance after that is lighter than most people expect.

Why Removal Matters

The case for actively reducing your footprint isn’t going to be motivated by paranoia. It’s motivated by a clear understanding of the fact underpinning many other Radio Hackers or cybersecurity articles: individual data points are weak. But when combined, you get a powerful dataset that tells you far more than any single data point could.

A name alone is almost meaningless. A name combined with a home address, employer, phone number and a photo starts to build a picture that can be acted on. Data brokers exist to assemble and sell exactly that combination, and most of the time, they do it without our knowledge or consent.

The concept of “signal to noise” ratio is something that comes up regularly here, and it’s worth mentioning that this is exactly what is happening. It’s very hard to disappear in the modern world, however, one thing that can be done is a natural degradation of that signal-to-noise ratio. Here, the aim isn’t to eliminate the data. The goal is to degrade it, make it outdated and less relevant to linked datasets. With a bit of time and effort, this is an easily achievable goal.

One honest caveat before we get started. This isn’t a one-time fix. Data reappears. Opt-outs expire. The difference between doing this once and maintaining it as a light habit is significant.

Data Brokers: The Big Targets

Data brokers will pull information from public records, voter registrations, property databases, social media and purchased datasets to build profiles that typically include your name, current and historical addresses, phone numbers, employer and relatives.

It’s worth mentioning that most likely, you didn’t sign up for this. Their entire model depends on the passive collection of public domain and available information.

The major ones worth targeting first are Spokeo, WhitePages, BeenVerified, Intelius and PeopleFinder. Each holds a variation of your data, and each has an opt-out process. The processes are deliberately tedious, including email confirmations, identity verification steps, and waiting periods, because friction reduces the number of people who complete them. You should do it anyway.

The manual process is free but time-consuming. If you’d prefer to automate it, services like DeleteMe and Kanary handle opt-out submissions on an ongoing basis. They cost money (typically around $100 per year), but they resubmit regularly as data reappears, which is the part most people don’t follow through on manually.

It’s important to set a realistic expectation going in, as data broker listings rarely disappear permanently. They tend to reappear within a few months as databases refresh. The value of the opt-out process is attrition, not elimination. Each round should always leave less than the last.

Google Removal Requests

There’s an important distinction between search results about you and content you actually control. You can’t force Google to remove a news article or public record listing simply because you’d prefer it didn’t exist. What you can request removal of is more specific and much more useful.

Google’s Results About You tool, accessible via your Google account, allows you to flag search results containing personal contact information (home addresses, phone numbers, email addresses) as well as explicit images shared without consent and content that constitutes doxxing. Google reviews these requests and, where they meet the criteria, removes the index entry.

The key nuance here is that while removing the index entry removes it from Google’s results, it doesn’t remove the content from the source page. If a data broker listing appears in search results, opting out of the broker and submitting a Google removal request handles both ends of the same problem. One without the other leaves half the job unfinished.

Work through your audit results systematically. Any result containing your home address, phone number or email address in direct combination with your name is a reasonable removal candidate. Submit in batches, track what you’ve submitted, and check back. Google’s tool shows the status of pending requests.

Social Cleanup & Closing Old Accounts

This section often tends to uncover more than people expect, particularly for accounts that have been active for several years. The target isn’t just what’s publicly visible today, it’s the accumulated history of posts, tagged photos, check-ins and location data sitting across platforms you use regularly and ones you’ve long forgotten.

You should have the previous results of your privacy audit on each active platform. Now, check who can see your posts, your friends or followers list, and your tagged photos. This is particularly important as it’s content other people have posted, which places you somewhere at a specific time. Most platforms allow you to remove tags without deleting the original post.

For accounts you’ve abandoned rather than deleted, the resource justdeleteme.com maintains a directory of deletion instructions for a wide range of services, rated by difficulty. A dormant early-era forum account might feel irrelevant, but it still holds data, may still be indexed, and has little value in the way of monitoring, so it’s worth getting rid of it anyway.

The distinction between deactivation and deletion matters here. Deactivating an account typically preserves your data on the platform’s servers and can be reversed. Deletion requests permanent removal. Always choose deletion where the option exists, and allow the platform’s stated deletion period (usually 30 days) before assuming the job is done.

It is helpful to prioritise by data sensitivity when working through your list. Email accounts, financial services and health platforms first. Then, forums, subscription services and anything that required identity verification.

Consider keeping a simple record of what you close in a spreadsheet with the service name, email address used and date of deletion. It takes minutes to maintain and becomes useful when breach notifications arrive for services you thought you’d already dealt with. If it’s too much effort, give some consideration to automating it so you get most of the perks without the work.

One new addition worth making now is email aliases. Services like Proton let you generate a unique forwarding address for each new service you sign up for. Providers like Apple also have these features baked in by default.

This means your real address never gets shared. Better still, when a breach notification arrives, the alias tells you exactly which service was compromised. When spam starts arriving, it tells you which service sold your address. This changes the way the whole monitoring stack works and takes about five minutes to set up.

Maintaining The Gains

Your first session with this might be a slow, cumbersome start, as most likely, the heavy lifting will have to be done at this point. It’s worth mentioning that overall, this problem should reduce with time. Once we are through the initial recon and enumeration phase, things should get much easier to manage. Beyond that, a few regular checks should help to keep us ahead of the game.

A reasonable schedule might look like this:

• Monthly: Check that data broker opt-outs have been honoured. Resubmit for any listings that have reappeared.

• Quarterly: Repeat the Google Results About You audit for new index entries.

• Annually: Full account audit, close anything new that’s gone dormant, review alias health, update the deletion record.

While you will have diminishing returns as time progresses, this is actually a good thing, as it means we are meeting the brief of removing information rather than simply leaving it there. All in all, a reasonable win.

The Aggregation Point, In Reverse

Time for some real talk. Removing your address from one data broker isn’t going to change much. But, systematically removing it from twelve brokers, delinking your employer from your name in search results, closing accounts that associate old usernames with your current identity, and replacing your real email with aliases across new services starts to meaningfully degrade the picture someone can assemble about you from open sources.

You won’t disappear. But the picture becomes incomplete, outdated and harder to act on. For most people, that’s an entirely achievable and meaningful outcome.

The last piece in the series looks at the other side of this. We’ll run some OSINT tools against your own identity to see what the combination of remaining data points actually reveals.

What remains after this process is very useful to know. Not because it’s alarming, but because it shows you exactly what you’re working with.

More importantly, at that point, things stop being reactive. Now, you have a more active role in understanding what data you are sharing.

Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.

Follow for new content weekly

Bluesky • X • Substack

You might also like,

- OSINT Investigators Guide to Self Care & Resilience

- Spies In The Mud: The RF-111 Aardvark

- What The Tech?! Space Shuttles