People search sites: how they work and what data they sell

Type your name into a people search site and you'll see your current address, past addresses, phone numbers, relatives, neighbors, property records, and sometimes your estimated income. You didn't give them this information. You didn't sign up. The profile exists because dozens of data sources feed these sites constantly, and the sites aggregate, cross-reference, and resell what they collect.

People search sites are data brokers specialized in personal profiles. They don't hack databases or break laws. They scrape public records, buy data from other brokers, harvest social media, and compile everything into searchable profiles. The result is a detailed dossier on millions of Americans, available to anyone who knows where to look.

Here's the underlying mechanism: how the data gets collected, how the sites build profiles, what they sell, and what you can actually control.

The data collection mechanism

People search sites don't generate data. They aggregate it from sources that already exist.

Public records are the foundation. Property deeds, court filings, voter registrations, marriage licenses, divorce records, birth records, death records, professional licenses, and business registrations are public by law. County clerks, state agencies, and federal databases publish this information, and people search sites scrape it systematically. Some states charge fees for bulk access; others provide free APIs. The sites pay the fees, download the data, and add it to their databases.

EPIC has documented how data brokers exploit public records access laws to build commercial profiles. The data is public, but the aggregation and resale create privacy harms that the original disclosure laws never anticipated.

Commercial data brokers sell the rest. Marketing databases, credit header data (the non-credit portion of credit reports), loyalty programs, warranty registrations, magazine subscriptions, and contest entries all generate data that brokers buy and resell. People search sites purchase this data in bulk. The transaction is legal because you agreed to share your information when you signed up for the service, and the terms of service allowed the company to sell it.

Social media provides behavioral data. Public Facebook profiles, LinkedIn pages, Twitter accounts, Instagram posts, and TikTok videos are scraped automatically. The sites extract names, locations, employers, schools, interests, and connections. Privacy settings reduce but don't eliminate this exposure. Even a locked-down profile leaks data through your friends' public posts, tagged photos, and group memberships.

Phone directories and business listings add contact information. Whitepages, Yellowpages, business directories, professional associations, and alumni networks publish names, phone numbers, and addresses. People search sites scrape these sources and cross-reference them with other data to build more complete profiles.

Data aggregation is the core mechanism. A single source might list your name and address. Another lists your phone number and employer. A third lists your relatives. People search sites use matching algorithms to connect these fragments. They match names, addresses, phone numbers, and dates of birth across datasets. When the algorithm finds probable matches, it merges the records into a single profile.

The algorithm isn't perfect. It makes mistakes. It merges records from people with similar names. It lists wrong relatives because two people lived at the same address decades apart. It shows outdated phone numbers because the data source hasn't been updated. But the sites don't verify the data systematically. They aggregate, cross-reference, and publish. Accuracy is secondary to completeness.

What the profiles contain

A typical people search profile includes your current address, previous addresses going back decades, phone numbers (landline and mobile), email addresses, age, date of birth, relatives, associates, neighbors, property ownership records, property values, mortgage information, vehicle registrations, professional licenses, business affiliations, social media accounts, and sometimes estimated income or net worth.

The depth varies by site and by how much data exists on you. Someone who owns property, votes regularly, and maintains public social media will have a more detailed profile than someone who rents, doesn't vote, and stays offline. But even minimal digital presence generates a profile. Your name appears in a family member's property record. You're listed as a contact on a business registration. You signed a petition. Each fragment feeds the aggregation.

Background check sites go deeper. They add criminal records, arrest records, traffic violations, bankruptcies, liens, judgments, and sex offender registries. These sites market to employers, landlords, and individuals conducting pre-employment or tenant screening. The data is public, but the aggregation makes it searchable in ways that manual courthouse research never was.

Reverse phone lookup and reverse address lookup are the same mechanism in reverse. Instead of searching by name, you search by phone number or address. The site returns the associated names, relatives, and other details. This is how robocallers verify numbers, how scammers research targets, and how stalkers locate victims.

The business model

People search sites make money by selling access to the data they aggregate.

Free profiles are marketing. The sites show partial information for free to hook you. You see your name, age, and city, but the full address, phone numbers, and relatives are hidden behind a paywall. The free preview creates urgency. You want to see what's there. You want to know who else is searching for you. You pay.

Paid reports cost $1 to $50 per search. The price depends on the site and the depth of the report. A basic report might cost $1. A comprehensive background check with criminal records costs $50. Some sites offer subscription models: unlimited searches for $20 per month. The pricing is designed to feel cheap enough to justify impulsively.

Bulk data sales are the bigger revenue stream. Background check companies, debt collectors, private investigators, marketers, and data brokers buy data in bulk. The people search site sells access to its entire database or specific subsets (all residents of a zip code, all people aged 30-40 in a city, all property owners in a county). These transactions happen behind the scenes. The public-facing search interface is marketing. The real money comes from bulk licensing.

Affiliate programs and lead generation add secondary revenue. Some sites earn commissions by referring users to background check services, credit monitoring, or identity theft protection. Others sell leads to marketers. You search for someone, and the site sells your search query to a data broker who adds it to your profile.

Why accuracy doesn't matter to the sites

People search sites don't verify the data they aggregate. They don't call you to confirm your address. They don't check whether the relatives listed are actually related. They merge records based on algorithmic matching, and the algorithm optimizes for completeness, not accuracy.

This creates persistent errors. The site lists an address you lived at 20 years ago as your current address because the data source hasn't updated. It lists someone as your relative because you both lived in the same apartment building. It shows a phone number that belonged to you in 2005 but has been reassigned to someone else.

The sites don't care. Their customers aren't paying for verified data. They're paying for aggregated data. A debt collector running a skip trace doesn't need perfect accuracy. They need leads. A marketer building a mailing list doesn't need verification. They need volume. The sites deliver volume.

When you submit a removal request, the site might remove your profile from public search results, but the data stays in their database. They continue selling it to bulk buyers. And if new data appears in their sources, your profile gets rebuilt automatically.

The legal framework is minimal

People search sites operate under data broker laws that vary by state. California's CCPA gives residents the right to request deletion. Vermont requires data brokers to register with the state. A few other states have similar laws. But most states have no specific regulation, and federal law doesn't address data brokers comprehensively.

The sites comply with state laws where required, but compliance is often superficial. They provide opt-out forms, but the process is manual and time-consuming. You have to submit a separate request to each site. You have to verify your identity by providing the same information you're trying to remove. And even after removal, new data gets added constantly because the underlying sources keep publishing.

The FTC has authority over unfair and deceptive practices, but it hasn't used that authority aggressively against people search sites. The sites argue that they're aggregating public information, which is legal. The FTC argues that the aggregation creates harms, but enforcement is limited.

What you can control

You can submit removal requests to individual people search sites. Most sites provide opt-out forms. You fill out the form, verify your identity, and wait. The site removes your profile from public search results within a few days to a few weeks. But this doesn't remove your data from their database, and it doesn't stop them from selling it to bulk buyers.

The process is manual. There are dozens of major people search sites and hundreds of smaller ones. Each requires a separate request. Each has a different opt-out process. Some require you to create an account. Some require you to upload identification. Some require you to mail a notarized form.

Automated removal services like Incogni submit requests on your behalf. They monitor sites, detect when your profile reappears, and resubmit removal requests. This saves time, but it doesn't stop the underlying data collection. New data keeps flowing in from public records, commercial brokers, and social media. The service removes what's visible; it doesn't stop what's feeding the system.

Limiting future data collection is more effective than removal. Use a P.O. box or mail forwarding service instead of your home address when filling out forms. Don't list your phone number on public-facing accounts. Lock down social media privacy settings. Opt out of marketing databases and credit header data sales. These steps reduce the amount of new data entering the aggregation pipeline.

Public records are harder to control. Property ownership, voter registration, and professional licenses create public records by law. You can't opt out of these disclosures without giving up the underlying activity. But you can be selective about what you register publicly. Use a business entity to own property instead of your personal name. Use a mail forwarding service for voter registration where allowed. Minimize the number of public-facing licenses and registrations.

The cultural reference that fits

In When Harry Met Sally, Sally demonstrates how easy it is to fake an orgasm in a crowded restaurant. The whole room believes the performance because they have no reason to doubt it. People search sites work the same way. They present profiles that look authoritative, complete, and verified. The data is formatted professionally. The interface is polished. The reports cost money, which creates the illusion of value. But the underlying data is unverified, often wrong, and assembled by algorithms that optimize for volume over accuracy. The performance looks real. The substance is a mix of truth, error, and educated guessing.

What happens when people search sites get breached

People search sites are high-value targets for attackers. They hold detailed profiles on millions of people. A breach exposes names, addresses, phone numbers, relatives, property records, and sometimes Social Security numbers or financial data.

When a people search site gets breached, the stolen data moves through criminal markets. It's used for identity theft, phishing, SIM swapping, and social engineering. Attackers use the detailed profiles to impersonate victims, answer security questions, and bypass authentication. The data is more valuable than a typical breach because it's already aggregated and cross-referenced.

The sites don't always disclose breaches promptly. Data broker breaches often go unreported because the companies aren't subject to the same notification laws as healthcare providers or financial institutions. You might not know your data was stolen until you see fraudulent activity.

The industry's trajectory

People search sites are consolidating. Larger data brokers are acquiring smaller ones. The same company owns multiple people search brands with different interfaces but the same underlying database. This consolidation makes opt-out harder because removing your profile from one site doesn't affect the parent company's other brands.

Regulation is increasing slowly. More states are passing data broker registration laws and opt-out requirements. But enforcement is weak, and the laws don't address the core mechanism: the aggregation of public records with commercial data. Until that changes, people search sites will keep operating, keep aggregating, and keep selling.