Data Brokers
What Are People-Search Sites and Why They Have Your Data
The short version
People-search sites are data brokers that assemble a public profile of you - name, age, addresses, phone numbers, relatives - from government records they did not need your permission to read and from data they bought from other companies. Publishing it is legal because the US has no general law against selling personal information, and these sites carefully avoid the one law that would bind them. You can get removed from each site for free, but the profile tends to rebuild itself within months.
What a people-search site actually is
A people-search site is a data broker with a search box. It collects personal information about people it has no relationship with, assembles that information into per-person profiles, and sells access to those profiles - usually by subscription. Spokeo, Whitepages, BeenVerified, TruePeopleSearch, and Radaris are the names most people run into first.
Vermont's data-broker law captures the category precisely: a data broker is a business that knowingly collects and sells or licenses the personal information of a consumer "with whom the business does not have a direct relationship." That missing relationship is the whole point. You never signed up, so you were never asked.
What is in a typical profile
Most people-search profiles follow the same template: full name and any aliases, age or date of birth, current address, a history of past addresses, phone numbers including mobile, email addresses, and a list of relatives and known associates. Many add property records, court records, and links to social accounts.
The scope can go wider than that. In its 2012 case against Spokeo, the FTC described profiles built from hundreds of online and offline sources that could include not just name, address, age range, and email, but hobbies, ethnicity, religion, social network participation, and photos.
Where the data comes from
Three streams feed a people-search profile, and none of them involves you.
- Public records: property deeds, voter registrations, court filings, marriage and divorce records, business licenses, professional licenses.
- Purchased data: marketing lists, phone and email append services, and feeds bought from other brokers.
- Scraped web data: public social profiles, forum posts, old directory listings, and other people-search sites.
That third stream is why removal feels like whack-a-mole. Sites re-scrape each other, so a profile you deleted on one can be reconstituted from a sibling site next quarter.
Why publishing all of this is legal
Two things make it legal. First, the United States has no comprehensive federal privacy law banning the collection and sale of personal information, so the default is that it is allowed unless a specific statute says otherwise. Second, most of the raw material is genuinely public - records governments are required to keep open.
Once a record is public, republishing it is largely protected activity. What people-search sites added was scale and matching: the courthouse index that used to require a trip and a name you already knew is now one free search, cross-referenced with fifty other sources into a single dossier.
The one law that would bind them, and why it usually does not
The Fair Credit Reporting Act is the law with real teeth here. It governs companies that supply reports used to decide on employment, housing, credit, or insurance, and it requires accuracy procedures, permissible-purpose checks, and a dispute process. People-search sites avoid it by disclaiming that use, which is why nearly every one carries a notice telling you not to use its data for screening.
The disclaimer is not automatic protection - the FTC has repeatedly held that what you actually market determines what you are. We break down the distinction in background check sites vs people-search sites, including what rights you get in each case.
What regulators have actually caught them doing
The enforcement record is the clearest evidence of where the line sits. Both major FTC actions against people-search companies turned on the same thing: the company crossed into consumer-reporting territory while skipping the obligations that come with it.
| Case | What the FTC alleged | Outcome |
|---|---|---|
| Spokeo (2012) | Marketed consumer profiles to recruiters and background screeners without FCRA safeguards; posted employee-written endorsements as if independent | $800,000 civil penalty |
| TruthFinder and Instant Checkmate (2023) | Operated as consumer reporting agencies without ensuring maximum possible accuracy; sent alerts implying a criminal record when the record was a traffic ticket | $5.8 million |
Source: Federal Trade Commission press releases, June 2012 and September 2023.
The 2023 complaint is worth reading if you assume these profiles are checked. The FTC said the underlying data came from third parties that expressly disclaimed its accuracy, that the companies took no steps to verify it, and that items customers flagged as inaccurate were never investigated. A "Remove" button hid the disputed item only from the customer who clicked it - everyone else still saw it.
How the business model works
People-search sites make money on subscriptions, and the product being sold is curiosity. A free search returns a teaser: your name, your age, a partial address, a blurred count of relatives or records. Unlocking the rest requires a monthly plan, often auto-renewing, sometimes sold through a low-priced trial.
Your profile is inventory. The more complete and more searchable it is, the better it converts a curious visitor into a subscriber - which is precisely why these sites work so hard to rank for your name in Google.
Why this matters even if you have nothing to hide
The risk is targeting, not embarrassment. A public profile hands a stranger your home address, your phone number, and your family tree in one place, and that is the raw material for the most common attacks on ordinary people.
Phone numbers feed robocalls, smishing, and SIM-swap attempts. Address and relative data is what makes stalking and doxxing possible, and full profiles make social engineering trivial - security questions about your street, your relatives, or your first car are worthless when the answers are on a free page. Relatives get pulled in too, which we cover in why your relatives appear in people-search results.
What the law does require of them
State data-broker laws mostly regulate registration and deletion rather than the underlying trade. Vermont built the first registry in 2018. California went further with the Delete Act, which created a single deletion request that reaches every registered broker at once.
| Vermont | California | |
|---|---|---|
| What it created | Public broker registry (9 V.S.A. ch. 62, effective Jan 1, 2019) | Broker registry plus DROP deletion platform (Delete Act, SB 362) |
| Broker obligation | Register by January 31 each year; pay a $100 fee | Register with the CPPA; process DROP deletion requests |
| What brokers must disclose | Opt-out method, activities you cannot opt out of, and the number of breaches in the prior year | Categories collected, including minors' data and precise geolocation |
| Penalty for not registering | $50 per day, up to $10,000 per year | Administrative fines under the Delete Act |
| What you get | A list of who to opt out from | One request reaching 575+ registered brokers |
Sources: Vermont Secretary of State and 9 V.S.A. 2446; California Privacy Protection Agency.
Notice what neither law does: neither stops a broker from collecting your data in the first place. Vermont's regime is a $100 annual form. California's is the strongest consumer tool in the country, and registered brokers must begin processing DROP requests on August 1, 2026 - but only for California residents. See our California DROP guide if you qualify.
How to get your listing removed
Every major people-search site has a free opt-out, and the flow is nearly always the same: search your own name, find the listing that is really you, copy its URL into the site's removal form, then confirm by clicking a link the site emails you. Whitepages adds phone verification. Budget five to ten minutes per site.
We publish dated, step-by-step opt-out guides for 57 major brokers, including Spokeo, Whitepages, and TruthFinder. One shortcut worth knowing: Intelius, TruthFinder, Instant Checkmate, and US Search all run through a single shared suppression portal, so one request covers all four.
Start with the sites that rank for your name in a plain Google search. Those are the ones doing the actual damage.
Why the listing comes back
An opt-out suppresses the profile that exists today. It does not tell the county clerk to stop filing deeds, or stop one broker from buying a refreshed feed from another. So listings commonly reappear within three to six months, rebuilt from new inputs.
This is the part that makes people give up, and it is worth naming plainly: outside California's DROP, removal is maintenance, not a permanent delete. Re-search your name every few months and re-file where you have reappeared. Our full guide to removing yourself from data brokers covers the ongoing routine.
See which sites list you
Run a free exposure scan to see the data brokers likely to list you, plus any breaches tied to your email. No account, nothing stored.
Frequently asked questions
What is a people-search site?
A people-search site is a website that assembles a public profile of an ordinary person from public records and purchased data, then lets anyone look it up by name. A typical profile lists age, current and past addresses, phone numbers, email addresses, and relatives.
Are people-search sites legal?
Generally yes. The United States has no broad federal law banning the sale of personal data, and most of what these sites publish started as a public record. State data-broker laws regulate registration and deletion requests rather than prohibiting the business itself.
How do people-search sites get my information?
Three streams: government public records such as property deeds, voter files, and court filings; commercial data bought from marketing firms and other brokers; and public web sources including social profiles. The FTC found that Spokeo drew on hundreds of online and offline data sources.
Is the information on people-search sites accurate?
Often not. In its 2023 case against TruthFinder and Instant Checkmate, the FTC said the underlying data came from third parties that expressly disclaimed its accuracy and that the companies took no steps to verify it. Wrong ages, old addresses, and unrelated people listed as relatives are common.
Is it free to remove myself from a people-search site?
Yes. Every major US people-search site has a free opt-out form. Paid removal services file those same free requests for you, so you are paying for time and coverage rather than for access to the process.
Why does my listing come back after I remove it?
Because the inputs never stop. Brokers keep ingesting new public records and buying refreshed data from each other, so a removed profile is often rebuilt within three to six months. Removal is maintenance, not a one-time fix.
Are people-search sites the same as background check companies?
No. A regulated consumer reporting agency runs screening reports for employment, housing, or credit decisions and owes you accuracy duties and dispute rights under the FCRA. People-search sites disclaim that role, which is exactly why they owe you far less.
Can I make a people-search site delete my data permanently?
Only in some states. California residents can use the state-run DROP platform to send one deletion request to every registered broker, and brokers must begin processing those requests on August 1, 2026. Elsewhere an opt-out suppresses the listing but does not stop future re-collection.
Sources: Federal Trade Commission, "Spokeo to Pay $800,000 to Settle FTC Charges" (June 2012) and "FTC Says TruthFinder, Instant Checkmate Deceived Users About Background Report Accuracy" (September 2023); Vermont Secretary of State data broker filing guidance and 9 V.S.A. 2430 and 2446; California Privacy Protection Agency (the Delete Act, the data broker registry, and DROP). Opt-out flows reflect the brokers' own published removal pages.