Online Privacy: How to Actually Do It

You don’t have to clear the whole internet in one sitting. Start with the information that exposes the most about you, then work through the rest.

Plan for several sessions. A first search and a few requests might fit into 30 minutes. A broader cleanup can take hours, with waiting time between confirmations. A check every 60 days is a useful routine, not a guarantee that everything stays removed.

This guide covers public exposure and removal requests. It cannot make you anonymous or replace account security. Use the current instructions on each official service; menus, eligibility, and verification requirements change.

Read this first

Start at the official website. Use the government and company links below. Check the address bar before entering information. Search ads and lookalike domains can lead to paid intermediaries instead of the organization you intended to contact.

Paying is optional. California DROP and the National Do Not Call Registry are free. People-search companies commonly offer free suppression tools. Paid removal services sell assistance, with varying coverage and permissions; they are not necessary to use the official tools. A payment screen may be selling a report or subscription rather than processing a privacy request.

Match the request to the right process. Hiding a public listing, deleting personal information, and opting out of sale or sharing are different actions. Legal rights depend on where you live, the business, and the data. A deletion request can require identity verification; a California sale/sharing opt-out does not use the same verification standard. California also limits the use of information collected for verification. See the California Attorney General’s CCPA guidance.

Provide only what the process reasonably needs. A profile link and confirmation email may be enough for suppression. Other requests may need additional matching information. If asked for an ID or Social Security number, pause: check the official instructions, why it is needed, and whether a less sensitive alternative is available. Don’t send documents in response to an unsolicited message.

Treat unexpected calls and emails cautiously. Don’t disclose passwords or read back account sign-in codes to an unexpected caller. Return to the official website yourself. Some legitimate processes use a call, text, or email that you initiate; the fact that a message arrived is not proof that it is genuine.

Check confirmation messages against your tracker. Open links only when the request, sender, and destination match what you started. If you are unsure, use the company’s published help route.

Keep your tracker private. It can become a map of your addresses and accounts. Share an empty template, never a completed sheet. Keep government identifiers, passwords, and identity documents out of it.

1. Before you start

Choose a confirmation email

An email alias or a separate inbox can make removal confirmations easier to manage. Use one you control and will keep checking. A temporary inbox you lose access to can make follow-up difficult.

Keep the email for correspondence separate in your mind from email addresses used to match records. For example, giving DROP only a brand-new alias won’t help it match records associated with an older address. You choose which matching details to provide.

Open a tracking sheet

Use a private notes file or download the blank privacy tracker. Record the company, the exact listing URL, the request date, any confirmation, the stated processing window, and the result. The sheet includes starting links, with personal fields left blank.

Set a repeat check

Pick a manageable schedule, such as every 60 days. Listings can reappear, but there is no reliable universal timetable. Keep individual follow-up dates as well: a company may ask for confirmation sooner, or give a longer response window.

Gather details selectively

Have the name variations and older contact details relevant to your listings available. Don’t send every address, phone number, or date of birth to every site. Read each form first. If you keep a separate list of sensitive details, store it securely and avoid adding it to a shared document.

2. Open a private window

A private window is useful for a search while signed out. It doesn’t show a universal “stranger’s view”: location and other factors can still affect results.

Private browsing separates the session from your usual cookies and logins. Close all private windows or tabs to end it. Downloads and saved bookmarks can remain. Websites, an employer or school network, and your internet provider may still observe activity. It is not anonymity. See Chrome’s explanation of Incognito.

On a computer

Browser	Windows / Linux	Mac
Chrome, Edge, Brave, Opera	Ctrl + Shift + N	Command + Shift + N
Firefox	Ctrl + Shift + P	Command + Shift + P
Safari	Not available	Command + Shift + N

You can also use the browser’s menu and choose New Incognito window, New InPrivate window, or New Private Window. Safari’s option is under File.

On a phone or tablet

Open the browser’s tab switcher or main menu and look for Incognito, InPrivate, Private, or Samsung Internet’s Secret mode. Select that mode, then open a new tab. The button position varies with the app and version.

Check that the search site itself is signed out. If you sign into a website inside a private window, that website knows which account you are using.

3. Submit a California DROP request

California residents: start at privacy.ca.gov/drop. Other readers can skip to the next section.

DROP is the state’s free way to send one request to participating registered data brokers. It is not a request to every website. See CalPrivacy’s explanation of DROP and the Delete Act.

Verify residency

Follow the options offered through the official California Identity Gateway flow. Read the requirements before choosing. Don’t assume that creating an account is the same as completing identity verification.

If you are offered Login.gov, use its official instructions. An existing account may still need verification; that process can require an accepted ID, Social Security number, and a phone or mailing-address check. See Login.gov’s verification requirements. If residency verification fails, start with CalPrivacy’s DROP help.

Build the request and save the confirmation

Enter the required name, date of birth, and ZIP code.
Add relevant older names, ZIP codes, email addresses, or phone numbers if you want to improve matching. Use the fields and limits the form actually provides; street-address history is not listed as a DROP profile field.
Review and submit. Save your eight-digit DROP ID privately.
Set a follow-up for about 90 days later. Check the status through the official site.

Brokers began processing requests on August 1, 2026. They must check at least every 45 days; reporting a result can take up to 90 days. The request remains active for future matching data. An “Opted-out” result is different from “Deleted”; “Record not found” does not prove no data exists. Read the status explanation and update your profile if needed. How DROP works.

Understand the limits

DROP does not erase underlying public records, your own public posts, or every company’s customer records. Exemptions can apply to particular information; a company calling itself a background-check service is not, by itself, an explanation of an exemption. Check the broker’s response and the official DROP guidance.

Device advertising IDs, connected-TV IDs, and vehicle identifiers are optional matching details. Don’t install an unfamiliar app just to find one. CalPrivacy provides identifier instructions and says third-party ID-finding apps are not required or advised.

4. Find what a stranger can see

Start with a signed-out search. Replace the example text with your own details:

"Your Name" "Your City"
"Your Name" "Your Employer"
"Your phone number"
"[email protected]"
"Your Name" site:whitepages.com

Quotation marks ask for an exact phrase. The site: operator narrows a search to a domain; put no space after the colon. Try name variations and more than one phone-number format. Search results are a starting point, not a complete inventory of data held about you.

Save the exact listing URLs

Copy each profile’s full address into your tracker. Record duplicate profiles separately, especially those with different name spellings or old locations. Start with listings that expose a home address, phone number, family connections, or other details you particularly want hidden.

Don’t buy a background report simply to begin an opt-out. Use the company’s privacy or suppression route.

Ask Google to remove eligible results too

Google’s Results about you can help find exposed contact information and request removal from Search, subject to its eligibility and public-interest rules. Open the result’s options and look for Remove result, or follow Google’s linked request process.

Removing a search result does not delete the source page. Request removal from the original website as well. After the original changes, Google’s help also explains how to request an outdated-result refresh.

5. Remove listings by hand

Follow the company’s own route

Find your listing and save its exact URL.
Open the company’s official website. Look in the footer or privacy policy for Opt Out, Suppression, Remove My Information, or Do Not Sell or Share.
Read what the request does. A sale/sharing opt-out may leave the public listing visible; suppression may leave other records intact.
Supply the information required for that request, after checking the verification guidance above.
Complete any confirmation you initiated. Record its deadline and the company’s stated processing time.
Revisit the original listing after that period. Mark it verified only after checking, and follow up if it remains.

There is no two-day removal guarantee across these companies. A site’s voluntary suppression process and a statutory privacy request can have different deadlines.

Starting points

Some removal forms require JavaScript, a challenge, or a signed-in session. The company links below are starting points; follow the current privacy link on each official site if the flow differs. Their full submission flows have not been tested for this guide.

Site	Where to start	What to check
Whitepages	Official website → privacy / suppression	Check free and premium listings separately. Follow any phone verification you initiate; don’t assume every listing uses the same method.
Spokeo	Official website → opt out	Have the profile URL and a confirmation inbox ready.
BeenVerified	Official website → opt out	Confirm the record matches you; follow the current email instructions.
Intelius, TruthFinder, Instant Checkmate, US Search	PeopleConnect Suppression Center	One tool covers this group’s name-search reports, with limits described below.
Radaris	Official website → privacy controls	Follow the current route. Don’t assume that opening an account is always required.
TruePeopleSearch	Official website → removal	Check each matching listing and the confirmation requirements.
FastPeopleSearch	Official website → removal	Save each record URL and the stated processing period.
PeopleFinders	Official website → opt out	Keep the full profile link available.
PeopleLooker / PeopleSmart	PeopleLooker / PeopleSmart → privacy	Check the current handling company and whether your other requests cover these records.
MyLife / Nuwber / ThatsThem	MyLife / Nuwber / ThatsThem → privacy	Check for duplicates and record the response.

PeopleConnect’s tool starts with email verification. It suppresses the group’s background reports from name searches. Its own explanation says some information may remain in phone, address, or email-search results, and that suppression does not remove information from its original sources. If a listing survives, use the support route in the Suppression Center.

You can consider a paid service if the manual work is too much. Review coverage, renewal cost, permissions, retention, and cancellation before deciding. This guide does not endorse or independently verify a removal provider.

You don’t have to make a professional presence disappear. Decide what should be public, then review the settings that affect it. Menu labels vary by account, region, age, and app version.

Across your accounts, check:

Audience: who can see new posts, older posts, and your existing followers.
Discovery: suggestions based on your contact details, uploaded contacts, and public search visibility.
Location: location permissions, tags, and recognizable details in photos.
Tags and mentions: who can use them and whether tags need approval on your profile.
Connected apps: remove access you no longer need. Revoking access may not delete data already copied.
Profile details: limit personal contact details, birthday, hometown, and other information that does not need to be public.

Facebook

Open Settings & privacy → Settings and look for audience controls or Privacy Checkup.

Choose the audience for future posts.
Review Limit Past Posts before confirming it. It changes eligible older Public and Friends-of-friends posts to Friends; it is not a complete privacy reset. Check custom audiences, tags, and posts on other people’s profiles separately. Restoring a wider audience can require individual changes.
Review how Facebook suggests your profile using email or phone details, and the search-engine linking setting.
Review tagged posts before they appear on your profile, and remove unused app connections.

Turning off search-engine linking doesn’t erase every mention or public interaction. See Facebook’s privacy troubleshooting and Meta’s explanation of past-post audience controls.

Instagram

Open your profile menu and look for Account privacy and Tags and mentions.

If a private account fits your purpose and is available for your account type, enable it. Review existing followers too.
Turn on manual tag approval where offered. Separately choose who can mention you; mentions do not have the same approval control as tagged posts.
Review contact syncing, uploaded contacts, connected apps, and contact details displayed on your profile.

Meta explains tag and mention audience controls. Its Instagram privacy guidance describes what private accounts restrict. Private settings do not recall screenshots or material copied elsewhere.

X

In Settings and privacy → Privacy and safety, review protected posts, photo tagging, discoverability, and location information. Also review connected apps and sessions.

Protecting posts limits their audience to approved followers; existing followers still matter. Turn off discovery by email and phone if you don’t want those connections. See X’s protected-post limits and discoverability instructions.

In Settings & Privacy → Visibility, review discovery by email and phone. Separately edit your public profile to control what is eligible to appear outside LinkedIn. Those are different controls. Keep professional details you want clients to find; remove unnecessary personal contact information. See LinkedIn’s visibility guide.

TikTok

Open Settings and privacy → Privacy. Review private-account status, per-post audiences, downloads, and content reuse such as Duet and Stitch. Turning an account private doesn’t recall previous downloads.

Review Suggest your account to others and contact syncing separately, including removal of previously synced contacts. TikTok says suggestions can still occur through follows, interactions, or mutual connections even with the suggestion settings off. See TikTok’s account-suggestion guidance, private-account controls, and download settings.

7. Change what you post

Settings help control access. A quick review before posting helps you avoid disclosing details in the first place.

Check photo backgrounds. House numbers, street signs, vehicle plates, delivery labels, work badges, and open screens can expose more than the intended subject.

Post trips after you return. Avoid publishing a running account of when your home is empty. Review location tags as well as the words in the post.

Be selective with quizzes. Some questions overlap with account-recovery information: a first pet, school, or childhood street. Avoid publishing answers you rely on for account security.

Review children’s photos carefully. Uniforms, school signs, schedules, and name boards can identify a child and their routine. Consider the child’s privacy and who can see or copy the image.

Keep credentials and travel documents out of posts. Boarding passes, IDs, badges, and access codes can expose identifiers or usable credentials. Barcodes and QR codes vary in what they contain; don’t assume the surrounding printed text tells you everything a code reveals.

8. Use the Do Not Call Registry

For U.S. personal phone numbers, visit DoNotCall.gov or call 1-888-382-1222 from the number you want to register. Registration is free. For an online registration, confirm the email within 72 hours.

Allow up to 31 days for covered sales calls to stop. Registration does not expire, though a number can be removed when disconnected and reassigned or at your request.

The registry does not block calls. Scammers can ignore it; political calls, certain charity calls, and genuine surveys have different rules. Some live sales calls can be permitted after a transaction within 18 months or an inquiry within three months. You can still tell that business to stop calling. Consent and automated-call rules also matter.

Use your phone’s blocking tools and your carrier’s spam options as additional measures. The FTC’s Do Not Call FAQ explains eligibility, exceptions, and how to report unwanted calls.

9. Set a repeating reminder

Create a private reminder called Privacy check. Every 60 days is a suggested routine; choose a frequency you can sustain. Keep personal addresses, DROP IDs, and listing details out of a shared calendar.

Google Calendar: create an event, open Does not repeat → Custom, and choose an interval of 60 days. Check the next date before saving. Google’s repeat-event help.
Outlook: create an appointment or event and open Recurrence, Repeat, or Recurring. Choose the available custom daily interval. Microsoft’s calendar instructions.
Apple Calendar: open the event’s date/time settings, then Repeat → Custom. Choose a daily interval of 60 where available. Apple’s Mac instructions.

If your mobile app doesn’t offer that interval, use the desktop version or another recurring reminder you can maintain.

When it fires, repeat your searches, review overdue requests, and check any reappearing listings. Review your DROP status after its initial processing period and when your identifying details change. You do not need to resubmit an unchanged DROP request every 60 days.

10. Keep a private tracker

Download privacy-tracker.csv. It opens in spreadsheet apps and contains company starting links, plus blank columns for your own work. It does not submit requests or upload your information.

Use these fields:

Site and starting URL: the company and its official entry point.
Your profile link: the exact listing you found.
Date requested and confirmation: when you started and whether you completed the required step.
Stated processing window: copy the deadline the company actually gave you.
Date verified gone and next check: distinguish a request from a confirmed result.
Status and notes: record rejection reasons or follow-up, without adding identity documents.

Store your DROP ID separately in a secure private note. Keep completed trackers out of public links and shared team folders.

Use it in Google Sheets

Open a new, blank spreadsheet and use File → Import → Upload to import the CSV. Choose a new sheet or spreadsheet; don’t replace an existing file that contains work you need.

Check Share → General access → Restricted, along with any named collaborators and the folder’s access. A file in an organizational account may also be subject to workplace policies. Google’s sharing controls explain how to restrict access.

For a team, share this guide’s download link or a separate, untouched template. If you distribute a Google Sheet, keep that template empty of personal details and give viewers read-only access. Have each person make a copy and check their own sharing settings before filling it in. A “make a copy” URL is a convenience, not an access-control guarantee. See Google’s spreadsheet sharing guidance.

11. Common problems

I submitted a request and nothing happened

Check for an uncompleted confirmation, an expired link, a response in spam, or a processing deadline that has not arrived. Follow up through the official privacy channel and keep the reference number.

The site says no record was found, but I can see a profile

Check the name variation and exact URL. It might be a duplicate or a different kind of record. Send the public listing link through the company’s designated support route. A “not found” response is not proof that the listing is gone.

A removed listing reappeared

Record the URL and date, and follow up using the company’s stated policy. It could be a duplicate, new data, or a failed suppression. Reappearance is possible, but it is not automatically permitted under every applicable privacy rule. DROP includes ongoing obligations for matching data.

A site asks for more personal information

Don’t assume every request is necessary or every identity check is a scam. Revisit the distinction between suppression, deletion, and sale/sharing opt-outs. Ask what the additional information is needed for and whether a less sensitive method is available.

DROP says a record is exempt

Read the explanation and save it. If it seems inconsistent with the information involved, use CalPrivacy’s help and contact route. An exemption result is not a reason to ignore a possible error.

I don’t live in California

Skip DROP. You can still review public exposure and social settings, use eligible company opt-out tools, and check your own jurisdiction’s privacy rights. The availability and legal effect of a request vary; don’t assume California’s rules apply everywhere.

This is too much work

Start with one exposed home-address listing, or a DROP request if you qualify. Save your progress and set a reminder. A smaller routine that you keep up is more useful than an ambitious checklist you abandon.

Prepared by Code For Broke. Sources are linked beside the relevant instructions. Reviewed September 17, 2026. This is general educational guidance; eligibility, laws, menus, and company processes can change. Check the official instructions before sharing sensitive information.