Photo by Zac Freeland/Vox
The internet knows my age and home address. It knows how much I make and what I do for work. It knows when I last voted and who I voted for. Recently, I got married in a supposedly secret ceremony at city hall. The internet found out before my mother.
I didn’t willingly share this information, but I’m not at all surprised that it’s online. Personal data — the searches, photos, purchases, locations, and Facebook messages that populate digital identities and fuel the attention economy — is the internet’s favorite currency. It’s also becoming impossible to control.
That’s partly because the US lacks substantial data-privacy legislation. You’re not really protected against rampant data brokering on “background check” sites like Whitepages and BeenVerified, which scrape public records and compile information — like your home address and phone number — and make them painfully visible.
And yes, when we sign up for Instagram or order our dinners on Caviar, we might technically be voluntarily signing away our rights, but what other choice do we have? Privacy policies are tailor-made to obscure their murky contents, and few of us take the time to read the terms of service. Plus, “if you want complete control — if you want to opt-out, you’re going to lead a very limited life,” says Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation.
In 2019, data privacy landed in the spotlight when Russia-based photo-editing app Faceapp admitted that it was collecting metadata on user photos. The story resulted in Sen. Chuck Schumer (D-NY) calling for an FBI probe, but such practices are common in Silicon Valley.
Social media is, after all, just a small piece of the data puzzle. “We really have two forms of digital selves,” explains Jen King, director of privacy at the Center for Internet and Society at Stanford University. “One is basically all the data that companies collect on us — that’s what you find in the hands of data brokers. The other is the one you construct, the one we curate and spend a lot of time trying to control. The two things overlap, but one is controlled by you and the other is not.”
As New York Times tech columnist Brian X. Chen discovered, even something as innocuous as a phone number can be used to reveal where you live, who you’re related to, and whether or not you’ve ever been arrested. This information can also be used to breeze past security questions used to secure online accounts.
This is bad — very bad — for physical safety. In 2014, video game designer Zoe Quinn was forced to move out of her house when trolls began posting photos of her apartment alongside graphic death threats — part of a harassment campaign known as Gamergate. “Your typical middle-class white guy living in Santa Clara might think, ‘What’s the worst thing that could happen to me?’ But vulnerable populations,” such as women and minorities, Galperin says, “are always the canaries in the coal mine.”
“People assume privacy is about how you communicate to another individual. They forget it also involves the extent to which you’re being tracked and surveilled online,” adds King. “In the US right now, I don’t know if there’s a good way to opt out. It’s really, really tough. But I haven’t given up hope that there will be federal-level change.”
Given the scale of the problem and the difficulty of staying completely offline, digital privacy is more important than ever before. How can you get it back? I posed the question to security researchers, reputation managers, and privacy advocates. Here’s their best advice for trying to erase yourself — either a little or a lot — from the internet.
Start with a quick Google search
Before you can get a handle on digital privacy, you first have to understand what is out there. Start by Googling yourself with your browser in private or “incognito” mode — which prevents some tracking and autofilling from your own internet use — and look for social media profiles and data brokers. (Google and its popular Chrome browser hold a wealth of data, too.) This will allow you to see what a stranger would find if they began looking for your information online. For most of us, social media profiles populate the first few search results on Google.
Next, find the data brokers. These companies scrape information from public records and compile it into a database. Then, as the name might suggest, they sell it. (This is technically legal, though shady.) Oftentimes, they’ll have things like your birthday, phone number, home address, salary, as well as names of neighbors and family members. This information can be used to hack into other online accounts by giving people hints on how you might answer security questions.
This audit won’t be comprehensive. Rob Shavell, Abine’s chief executive, says that when his company was founded in 2012, employees removed about 1,000 pieces of information per customer over a two-year period. Today, that number has reached 1,900 [this article was written in 2019]. This amount of information is too much for the average person to comprehend or completely erase — but you can certainly make it harder for others to find by getting it off common websites.
Decide how private you want to be
The concept of privacy is personal — information one person leaves public might make another uneasy. “Some people are comfortable having their photos up online, but others are incredibly uncomfortable with the notion that strangers can see what they look like or know their phone number,” says Galperin. “Everybody’s threat model is a little different.”
Deciding what data you want to protect and who you want to protect it from helps to narrow down the scope of your privacy project. For me, getting my home address, high school photos, names of family members, and income off the internet felt like a good place to start.
Once you’ve decided how private you want to get ...
Here’s what to do if you’re not ready to delete your Instagram, but you still want to protect your privacy
Data brokers are legally required to delete your data if you tell them to do so. But each one has a different process, so you’ll need to go through them individually.
On WhitePages, simply enter the URL to your “profile” (i.e. dossier) here, then go through the steps as prompted. Check back in a few weeks to make sure your data is really gone. Repeat for all the data brokers that show up on the first three pages of Google. If this process sounds overly taxing and you happen to have $129 lying around, Abine has a paid service called DeleteMe.
Next, consider setting your social media profiles to private. This will make it harder for strangers (future bosses, exes, the list goes on ...) to find highly personal information. If you need a public Instagram account (because, say, you’re a photographer) think about creating a separate work account and keeping your personal one private. If that’s too complicated, just stop geo-tagging photos so people can track your every move.
If you’re worried about third parties following you around the internet and hitting you with personalized ads, you might want to install an ad blocker. Most are free — I use one creatively named Ad-Blocker (just tap “install” and it goes right to your browser). There is some debate about how well certain ad blockers work. The Electronic Frontier Foundation also has a free FireFox browser plugin that claims to be more comprehensive.
What to do if you’re ready to go dark on social media
One Facebook scandal away from moving to the woods? Considering applying to graduate school? You’re ready to delete social media. Or at least, some social media. I can’t, because I have the attention span of a bumble bee and need something to look at on the bus. But if it’s your time, here’s how to do it.
On Facebook, the process is nearly the same as deactivating your account, except after 30 days your data will permanently be expunged from the company’s servers (read the instructions here). You can also download your data ahead of time (photos, messages, etc) so you have access to it moving forward. If you’re one of those people who “has to have Facebook” because you “need to remember people’s birthdays,” there’s a tool for that. Once you sign up, it’ll download friend’s birthdays and email you on the right day (as a bonus, this service claims to be very privacy-centric). Obviously, Facebook now owns Instagram (and WhatsApp), so you’ll probably want to delete that too.
King notes that going dark isn’t possible for everyone. “In some ways, it becomes a privileged statement to say you don’t need to be online. A lot of states are providing public assistance online. If you want to apply for any job now, you don’t walk around filling out paper applications.”
What to do when your Google search results are a dumpster fire
If you’ve ever done something unfortunate on the internet (like tweeted an AIDS joke or accidentally posted a naked photo), you might want to bring in the professionals. A host of online reputation management companies like Metal Rabbit and Reputation Defender are there to help you transform your Google search results by creating more flattering content.
I thought this was a joke when I first heard it, but it’s now become common practice. After a scandal, these companies sweep in like Olivia Pope, taking real parts of your biography and expanding them into articles and personal websites to push down the negative content. “If you manage your search results, you put your best foot forward,” says Metal Rabbit founder Bryce Tom. “Humans are just naturally lazy. The more content you put in a centralized location, the easier it is that they’ll see what you want them to see and not see what you don’t.” It’s worth noting these services are pretty expensive.
And finally, what to do if you want to go fully AWOL (good luck with that!)
This is difficult — if not impossible — to do. You’ll need to permanently delete, not just deactivate, all social media. You’ll need to start checking out as a guest when shopping online so companies don’t store your email address (though some will anyway — nothing you can do about that). Next, request that data brokers delete your data, and remind them to delete it every few months so they don’t start sneakily recollecting it.
Surprisingly, there are more than a few risks associated with erasing your online presence. When you delete social media profiles, “you’re creating a void” in Google search results, “and allowing something else to pop into the top 10,” says Tom. If someone publishes information about you in the future, it’ll likely be more easily discoverable. Tom suggests deleting the content from your profiles but keeping them active instead. Less satisfying, sure, but potentially safer.
Finally, if asked for an email or phone number, don’t provide a real one unless you absolutely have to. Using services like Airbnb will become nearly impossible, since no one can verify your identity — but since you’re living in the woods anyway, does it matter?
Zoe Schiffer reports on tech policy and helps publish the Interface, a daily newsletter on social media platforms and democracy, for The Verge.