Getting Yourself Removed from Data Brokers and People-Search Sites

Where the people-search sites get you from

If you have ever typed your own name into a search engine and found a website listing your address, age, and the names of people you live with, you have already met the data broker economy. It can feel unsettling. But it helps to understand the mechanics, because once you see where these sites get their information, the fixes become obvious.

UK people-search sites and data brokers draw from a surprisingly small number of sources. The open electoral register is the biggest single feed, and we will come to that in a moment. Beyond it, the common sources are: the edited version of the phone book (BT's Directory Enquiries data, now licensed widely), public records including the Companies House register and the Gazette, social media profiles set to public, historical news archives, county court judgments, and data purchased from other brokers who have already aggregated all of the above. Some brokers also buy data from retailers, loyalty card schemes, and lead-generation forms, though that kind of commercial data tends to be less visible on people-search sites and more relevant to direct marketing.

The result is that your record on any given site is usually a composite, stitched together from several of those sources rather than one. That matters because removing one source does not always delete the record; the site may simply re-build it from what remains. Which is why the approach in this guide works in layers rather than as a single action.

For a fuller picture of how the data broker economy actually works, including the difference between people-search sites and the less visible B2B brokers, that piece goes into more depth.

Today's action: Search your full name plus your town in a private browsing window. Note which sites appear on the first two pages. That is your working list.

The biggest single fix: the open electoral register opt-out

Every household in the UK receives an annual canvass form from their local council. Most people fill it in and think nothing more of it. What the form does not always make obvious is that it produces two versions of the electoral register: the full register, which is restricted by law to specific uses like elections and credit checks, and the open register (sometimes called the edited register), which anyone can buy. Councils, marketing companies, and people-search sites buy it routinely.

Opting out of the open register does not affect your right to vote. It does not affect your credit file. It simply removes your name and address from the version that can be sold commercially. The gov.uk page on opting out explains the process, but in practice you do it either on your household's annual canvass form or by contacting your local Electoral Registration Office directly. Most councils accept a phone call, an email, or a letter.

The opt-out applies going forward. Copies of the open register that were sold before your opt-out are already out there, so people-search sites that bought a previous edition may still hold your record. That is why the erasure requests in the next section matter. But stopping the flow at source is the right first move, and it costs nothing.

Opting out of the open electoral register is free, takes ten minutes, does not affect your right to vote or your credit file, and cuts off the single biggest data feed to UK people-search sites.

• Find your local Electoral Registration Office via gov.uk and ask to opt out of the open register.
• If your annual canvass form arrives soon, tick the opt-out box before returning it.
• Note the date you opted out so you can reference it in any later erasure requests.

Erasure requests that work: what to send, what to expect

Under UK GDPR, you have a right to request that an organisation erase your personal data. The ICO's guidance on the right to erasure sets out the grounds clearly. For data brokers and people-search sites, the most relevant ground is usually that they have no legitimate purpose that overrides your interests, particularly when the data is being used to profile you for commercial or marketing purposes without your knowledge.

You do not need a lawyer. You do not need a template service. A clear, direct email works. Here is what a good erasure request contains:

• Your full name as it appears on the site.
• The URL of the specific page or profile listing your information.
• A statement that you are making a request under Article 17 of UK GDPR (the right to erasure).
• A brief, factual reason: for example, that you did not consent to your data being processed and you do not believe the organisation has a legitimate interest that outweighs your rights.
• A request for confirmation of deletion within the statutory one-month period.

You do not need to explain yourself at length or justify your request emotionally. Keep it factual and short. Organisations have one calendar month to respond. If they refuse, they must give you a reason. If they do not respond at all, or if the refusal seems unjustified, you can escalate to the ICO's complaints service. The ICO does take action against organisations that ignore erasure requests, though it prioritises cases with broader public impact.

One practical point: send requests to the data controller's privacy or legal contact, not a general enquiries inbox. Most sites are required to publish a privacy contact under UK GDPR. If you cannot find one, their privacy policy should list it. If the site has no UK or EU presence at all and ignores you, your options narrow, but many of the main UK-relevant sites do comply when approached correctly.

For a fuller grounding in how UK GDPR rights work in practice, including what happens when a company pushes back, that piece covers the process in detail.

Today's action: Draft a short erasure request email and save it as a template. You will send variations of it several times.

The main UK people-search sites, one by one

The landscape shifts as sites come and go, but a consistent set of names appears in UK search results. Here is how removal actually works at each of the main ones.

192.com

192.com is one of the longest-established UK directory and people-search sites. It draws heavily from the edited electoral register and BT directory data. They provide a suppression request form on their site. Submitting it should remove your listing from their public-facing search. They describe this as a suppression rather than a deletion, meaning the record may still exist in their database but will not appear in searches. For most people's purposes, that is sufficient. Allow a few weeks for it to take effect.

BT Phone Book and directory listings

If you are a BT customer and your number was listed in the phone book, you can ask BT to make it ex-directory. This removes it from the printed and online directory and, over time, from the data BT licenses to third parties. Contact BT directly through your account or their customer service. If you are with another provider, check with them; most allow ex-directory requests.

Truecaller

Truecaller is a caller-ID service that holds a large database of phone numbers and associated names. It is popular globally and its data surfaces in search results. They offer an unlisting page where you can remove your number. The process is straightforward but you will need to verify ownership of the number via SMS. Once removed, it can take a few days to propagate across their systems.

Spokeo, Whitepages, and US-based aggregators

Some US-based people-search sites hold UK records, particularly if you have ever had any US connection or if your data appeared in a breach that was indexed globally. These sites vary in how well they honour UK GDPR requests. Whitepages has an opt-out process; Spokeo has a removal page. Both are findable via a search for the site name plus "opt out" or "remove my information". Because these are US companies, enforcement of UK GDPR is harder, but many do comply, partly because they also face US state privacy laws that have similar requirements.

Pipl and similar B2B data aggregators

Pipl is less consumer-facing but its data surfaces through other sites and services. It serves businesses doing background checks and due diligence. They have a data removal process, but it is less prominently advertised. A UK GDPR erasure request sent to their privacy contact is the right route. Response times vary.

Local and regional directory sites

A long tail of smaller UK directory sites, often running on licensed data, also appear in search results. The same erasure request template works for these. If a site has no obvious privacy contact and no removal process, check their WHOIS registration for a contact, or look up the company at Companies House to find their registered address and send a written request.

Today's action: Work through your list from the first section. Send erasure requests to any site where your details appear. Log the date sent and the response received.

Credit agencies: opting out of the marketing side

The three main UK credit reference agencies, Experian, Equifax, and TransUnion, are best known for holding your credit history. But each of them also operates a marketing services arm that holds and licenses personal data for direct marketing purposes. These are legally separate functions, and opting out of the marketing side has no effect on your credit file or your ability to get credit.

Experian's marketing services arm is called Experian Marketing Services. They maintain a consumer opt-out. Equifax licenses data through its consumer and commercial data division. TransUnion similarly has a marketing data function separate from its credit reporting. Each has a privacy contact and, under UK GDPR, must honour an erasure or opt-out request for data held for marketing purposes.

The practical step is to write to each agency's data protection or privacy team, clearly distinguishing that your request relates to their marketing data activities, not your credit file. The ICO's guidance confirms that credit reference agencies must treat these as separate data sets and cannot refuse a marketing data erasure request on the grounds that they need the data for credit purposes.

There is also the Cifas protective registration scheme, which is separate and relates to fraud prevention rather than marketing. It is worth knowing about but it is a different tool for a different purpose.

Today's action: Write to each of the three credit reference agencies' privacy teams, requesting erasure of any data they hold about you for marketing or data licensing purposes. Keep your credit file request separate if you want to check that too.

Telephone Preference Service and Mail Preference Service

Two opt-out registers are worth knowing about, even though they work differently from erasure requests.

The Telephone Preference Service (TPS) is the UK's official do-not-call register. Registering your number means that organisations subject to UK law are prohibited from making unsolicited direct marketing calls to it. It does not stop all nuisance calls, particularly those from overseas or from fraudulent callers who ignore the law, but it is a legal requirement that legitimate UK businesses must respect. Registration is free and takes effect within 28 days.

The Mail Preference Service (MPS) does the equivalent for addressed direct mail. If you register, companies using reputable mailing lists are required to suppress your address. It reduces addressed marketing post, though it does not cover mail addressed to "the occupier" or mail from organisations you have an existing relationship with.

Neither the TPS nor the MPS removes your data from broker databases. They add your details to suppression lists that responsible mailers and callers check against. Think of them as a filter rather than a deletion. Still worth doing, and both are free.

What you cannot remove, and why that is okay

Honesty matters here. Some records are public by design, and no erasure request will shift them.

Companies House. If you are or have been a company director, your name, date of birth (month and year), and registered address are public on the Companies House register. This is a deliberate feature of UK company law: transparency about who runs companies is considered a public interest. You can apply to suppress your residential address if you used a home address (and you should use a registered office address instead going forward), but your name and directorship remain public.

The London Gazette and other official publications. Insolvencies, court orders, and certain regulatory notices are published in the Gazette as a matter of public record. These cannot be removed.

Court records. County court judgments (CCJs) appear on the Register of Judgments, Orders and Fines and are visible to credit reference agencies and, in some cases, publicly searchable. They can be removed if you pay the debt within a month of judgment, or they drop off after six years.

Historical news coverage. If you appeared in a news article, the right to erasure does not automatically apply to journalistic content. The journalism exemption under UK GDPR is real, and the ICO's guidance acknowledges it. There is a separate, complex area of law around requesting de-indexing from search engines for outdated or irrelevant coverage, but that is a different process and beyond the scope of this guide.

None of this should be cause for alarm. Most people's public record is limited to a Companies House entry if they run a business, and that is entirely normal. The goal of this guide is not to make you invisible. It is to reduce the casual, commercially-motivated aggregation of your details that serves no legitimate public purpose.

Today's action: Check your Companies House entries at the Companies House register. If you used a home address, look into appointing a registered office address for future filings.

Paid removal services: what they really do

Several commercial services will offer to remove your data from brokers and people-search sites for a monthly or annual fee. Some are marketed quite aggressively. It is worth understanding what they actually do, because the answer is: exactly what this guide describes, on your behalf.

These services maintain lists of known data broker opt-out pages and erasure request contacts. They submit requests on your behalf, monitor for re-appearance, and re-submit when records come back. That is the entire service. There is no special legal power, no privileged relationship with data brokers, and no technology that individuals cannot access themselves. The opt-out pages and privacy contacts they use are the same ones listed in this guide and findable via a search.

The one genuine convenience they offer is time. If you genuinely cannot spare two hours now and an hour twice a year, paying someone to do the legwork is a rational choice. But you should make that choice with clear eyes. You are paying for convenience, not for access to anything you could not do yourself.

There is also a privacy irony worth flagging: to use these services, you hand over your personal details to yet another third party, including sometimes payment information and identity documents. Whether that trade-off makes sense is a question only you can answer.

This guide gives you everything you need to do it yourself, at no cost.

The maintenance schedule: whack-a-mole, on your terms

Here is the honest reality that most privacy guides skip over. Data broker records come back. Sites re-publish from new editions of the open register. Aggregators re-index from other aggregators. A record you successfully removed in March may reappear in October when a site refreshes its database. This is not a failure of your initial effort; it is simply how the ecosystem works.

The answer is not to do nothing because it feels futile, and it is not to obsess over it weekly. The answer is a light, regular maintenance routine that keeps the situation manageable without consuming your life.

A twice-yearly check, roughly every six months, is the right cadence for most people. Here is what that looks like in practice:

• Set two calendar reminders per year, six months apart, labelled something like "privacy check-in".
• At each check-in, search your name plus town in a private browsing window and note any new listings.
• Re-send erasure requests to any site where your details have reappeared, referencing your original request if you have a record of it.
• Confirm your open register opt-out is still active, particularly if you have moved house and re-registered to vote.
• Check that your TPS and MPS registrations are current (TPS registrations do not expire, but it is worth verifying if you have changed numbers).

Moving house is the moment to be most vigilant. Your new address will appear on the open register unless you opt out again at your new council. The opt-out does not transfer automatically. Many people who did the initial work find their details resurface after a move precisely because of this.

Similarly, if you start a new company, open a new business, or appear in any new public record, that is a prompt to check what has surfaced and act accordingly.

The broader point is that this is not a problem you solve once and forget. But it is also not a problem that requires constant vigilance. Two hours now, one hour twice a year. That is a reasonable price for meaningful control over how easily your personal details can be found by anyone with a search engine.

You have the legal tools. The opt-out mechanisms exist. The ICO backs your rights. The process is slower and less satisfying than a single magic fix, but it works, and it costs nothing but a little time.