Personally Identifiable Information (commonly known as PII) is any data that can be used to identify a specific individual, either directly—like a name, Social Security Number, or driver’s license—or indirectly when combined with other data—like an IP address, birth date, or home address. PII is a critical part of cybersecurity because it can be targeted for identity theft and fraud, so individuals should be careful about sharing it.  It can also potentially put one’s physical safety and peace of mind at risk. Thanks in large part to hundreds of different online data brokers—who get paid to constantly cull, gather and sell such information—the breadth and depth of PII keeps growing on the internet. While there might occasionally be benefits to easily attainable information, most people would probably prefer very little of such sharing. However, data brokers do not seem to really care about adverse or unintended consequences of their actions, and millions of affected individuals rarely stop to think about how much sensitive PII is out there being so freely shared about them. Just Google yourself sometime, you might be shocked. This situation—and its widespread related privacy concerns—is apt to only grow more pronounced with generative AI.  

Hundreds of people-search services and sites (the typical consumer-facing data brokers) exist on the internet, constantly collecting data from publicly available records such as home purchases, credit card subscriptions, traffic infractions, voting registration, and more. Add to this voluntarily provided social media data, and it can produce a treasure trove of personal information to bundle up in one place. Google itself has a way to help review searches about oneself and remove them from Google, but to do the job right, one should go directly to the data brokers. Besides, there are other search engines beyond Google that need to be considered—like Bing and even Yahoo—providing similar ease of access to data. Most data brokers will offer an opt-out process, but the data can reappear when companies refresh their databases. But who has the time to go to each and every such site… there are literally hundreds of them. Instead, for many, it might make sense to hire a firm that will help you delete your data from the internet. No service can entirely eliminate your information from the web, but they can significantly lower your profile and make it harder for bad guys to find you. A few popular and relatively low-cost PII removal service firms for hire are DeleteMe, Incogni, and Optery. They will then, on your behalf and with your permission, go directly to the data brokers and submit opt-out requests to remove your PII, and then report back to you on their progress over a period of months or longer, depending upon how you use them. 

Easily available personal data can expose you to annoying junk mail, and possibly more serious identity theft or impersonation scams. Beyond that, attackers can use people-search databases to target individuals for harassment or violence. Even non-celebrities are becoming victims of doxxing—the malicious sharing of personal information. For more serious physical safety concerns, various other types of higher-level personal security firms exist that can help with deeper dives on the web and more thorough scrubs of PII information. This might occur in conjunction with actual identity theft or other targeted action, or as part of a proactive and precautionary effort to reduce one’s online profile to avoid potential PII misuse. When you opt out of people-search sites, your data might not disappear right away. Some will act quickly, while others might require extra data to prove it’s you to enable the deletion. At least in California, removal must happen within 45 days. About a dozen other states have similarly strict privacy laws. However, many other states have almost none, and removals could take much longer—or in some cases, not happen at all. And yet, even companies that comply might collect the same data again from other freely available public sources or third parties. Hence, you’re never completely erased, so you should keep occasionally scanning the web a few times a year; or, instead, just pay for an info-removing service to keep at it on your behalf. 

Disclosure: Sand Hill Global Advisors, LLC (“SHGA”) is a registered investment adviser with the Securities and Exchange Commission. Such registration does not imply a certain level of skill or training. DeleteMe, Incogni, and Optery are separate entities and not affiliated with SHGA, and as such, SHGA neither represents nor endorses the services of these providers named in this article.