How to Remove Your Personal Data from the Internet

Removing personal information from the internet is not one action. An old profile, a page published by someone else, a Google result, a people-search listing, and a government record are held by different organizations. Each one needs a different removal route.

You can often reduce how much information is exposed and make it harder to find. But no responsible process can promise that every copy will be deleted or that removed information will never reappear. The practical goal is to remove what you control, request deletion at the source, reduce search visibility where eligible, opt out of data brokers, and check the results over time.

This guide starts with urgent risks, then walks through the removal process from source to search result.

What removing personal data can—and cannot—do

Successful removal can mean several different things:

• Deleted at the source: the website or account holding the information removes it.
• Removed from a search result: a search engine stops showing an eligible URL, even though the source page may still exist.
• Suppressed by a data broker: a people-search or broker site stops displaying or selling a matched listing under its process.
• Corrected or restricted: an organization changes inaccurate information or limits how it uses it.

These outcomes are not interchangeable. Removing a Google result does not remove the page that published the information. Opting out of a people-search site does not delete the public record from which the site may have collected it. Deleting an account you control does not automatically remove screenshots, archives, or copies held by other people.

Set a realistic target for each exposure: remove the source when possible, reduce visibility when source removal is unavailable, and document what remains.

Act first if the exposure is urgent

Some exposures need security or safety action before—or at the same time as—a removal request.

If passwords or login details were exposed

• Change the affected password immediately.
• Change it anywhere else you reused it.
• Use a unique password for each account.
• Turn on multi-factor authentication where available.
• Review active sessions, recovery details, and recent account activity.

A takedown request cannot make a leaked password safe again. The FTC’s data-breach guidance recommends changing exposed or reused passwords, enabling multi-factor authentication, and responding according to the type of information exposed.

If financial or government identifiers were exposed

Contact the relevant bank, card issuer, government agency, or identity-recovery service through its official channel. Check for activity you do not recognize. If someone is already using your identity, follow the official recovery process for your country; US readers can also consult IdentityTheft.gov.

For a broader prevention and recovery plan, see the identity theft protection guide.

If the exposure includes threats, doxxing, stalking, or immediate danger

Use the platform’s safety or abuse process and seek appropriate local help. Google has a specific policy route for qualifying doxxing content, but search removal is not a substitute for action by the host platform or relevant safety authorities. Do not redistribute illegal or abusive material while collecting evidence.

Start removal work once urgent protective steps are underway. Do not wait for a website or search engine to respond before securing exposed accounts or financial information.

Map where your personal information appears

Before submitting requests, identify who controls each copy. This prevents you from sending the right request to the wrong organization.

People-search sites are a type of data broker. According to the FTC, they may compile information from public social profiles, other brokers, and government public records. Our data brokers list can help you identify common sites, but it is a starting point rather than a claim that every broker has your information.

Build a safe removal inventory

Create one working list so you do not repeat requests or lose track of replies.

For each exposure, record:

1. The exact page URL.
2. The information shown, such as an address, phone number, email, profile, or identifier.
3. Who controls the source.
4. The official removal, privacy, correction, or opt-out route.
5. The date you submitted the request.
6. Any confirmation or request number.
7. The current status and the date you last checked it.

Prioritize the list by risk:

1. Exposed passwords, financial details, government identifiers, active threats, and information connected to current abuse.
2. Content and accounts you directly control.
3. Source pages that expose sensitive contact or identity details.
4. Search results and broker listings that make the source easier to find.
5. Lower-risk historical references that may have legal or public-interest limits.

Use only official request pages or contact channels. Some organizations need enough information to match you to a record, but provide only what the process reasonably requires. Be cautious if an unsolicited message asks for identity documents, payment, remote access, or more information than seems necessary for the request.

Google may ask for exact URLs and screenshots so it can identify the result. Crop or redact unrelated information where the process permits, and never capture or share illegal imagery as part of an ordinary removal request.

Remove accounts, profiles, and content you control

Start with content you can remove directly. This is usually clearer than asking a search engine to hide a page that you still control.

1. Decide what should be removed

You may need to delete an individual post, remove profile fields, make an account private, deactivate a profile, delete one service, or delete the entire account. These actions can have different effects.

2. Check what you could lose

Before deleting an account:

• Export photos, messages, files, or records you need.
• Check purchases, subscriptions, and services tied to the login.
• Replace an email address used for banking, recovery, or other accounts.
• Review whether deactivation merely hides the profile instead of deleting it.

Google’s account-deletion guidance illustrates why this check matters: deleting an account can remove access to data, services, purchases, and recovery options. Other providers have different controls, so use the provider’s current official instructions.

3. Delete or restrict the information

Use the platform’s privacy and account settings. Afterward, sign out and check the public page from a separate browser session where practical. Remember that a platform action does not automatically remove copies published elsewhere.

Ask the source website to remove or correct information

If someone else controls the page, contact the source before treating search removal as the whole solution.

Submit a source-level request

1. Find the website’s official privacy, removal, correction, abuse, or contact process.
2. Identify the exact URL and the specific information at issue.
3. State the action you are requesting: deletion, correction, restriction, or removal from public view.
4. Give only the information reasonably needed to verify that the record is yours.
5. Save the request, confirmation, and response.

If a data-protection law applies, use the organization’s official rights-request channel. Rights and exceptions vary. European Commission guidance explains that GDPR erasure rights are not absolute: expression, legal obligations, legal claims, and public-interest purposes can affect the outcome.

If the source refuses or denies the request

Do not assume that a refusal is final, but do not assume escalation guarantees removal either.

• Retain the operator’s response and stated reason.
• Check whether the website offers an official appeal, reconsideration, privacy-complaint, or correction process.
• If an applicable law gives you a complaint route, use the regulator’s official guidance. For example, covered GDPR requests should receive a reasoned response, and the person may have a right to complain to a data-protection authority.
• Evaluate Google removal eligibility separately. A source may refuse to delete a page while Google may still remove an eligible result from searches, or Google may decline because the result has public-interest value.
• If the information is a public record, contact the record custodian rather than treating the publisher, broker, or search engine as able to erase the underlying record.

There is no universal appeal process. Follow the mechanism offered by the operator or the law that actually applies to the request.

Remove eligible personal information from Google Search

Google can remove some personal information from its search results. It cannot delete content from the website that hosts it.

Google’s personal-information removal guidance covers categories such as contact details, confidential government identifiers, bank or card numbers, images of signatures or IDs, private medical records, confidential login credentials, and qualifying doxxing content.

Request removal of a result

1. Copy the exact URL of each page showing the information.
2. Use Google’s personal-information removal request or the removal option shown with an eligible result.
3. Supply the requested details and evidence.
4. Keep the confirmation and monitor the request status.

Google may fully remove an eligible URL from Search or restrict it for searches containing your name or identifier. Public-interest considerations can affect the decision, including some results from government institutions, educational sites, or news organizations.

Use Results about you where available

Google’s Results about you feature can look for supported contact details or identifiers and notify eligible users about new results. Availability varies by market and account eligibility, so use the detailed request form if the feature is unavailable.

Refresh a result after the source changes

If the source page has already removed or changed the information but Google still shows an old snippet or cached description, use Google’s outdated-content refresh route. This is different from asking Google to remove a result whose source still contains the information.

If Google denies a request, review the reason. Correct an incomplete request if appropriate, continue the source-level route, or use an applicable legal process. A denial does not create a universal right to another outcome.

Opt out of people-search sites and data brokers

You can opt out of many people-search sites manually. The FTC describes two routes: submit requests yourself, one site at a time, or pay a service to do some of that work for you.

Manual opt-out workflow

1. Search the people-search site for your name, phone number, or address.
2. Confirm that the listing is actually yours; avoid acting on a record belonging to someone with a similar name.
3. Find the site’s official opt-out or “remove my information” page.
4. Submit the listing URL and the minimum matching information required.
5. Complete the site’s confirmation step, which may involve email or another identity check.
6. Record the request and confirm whether the listing stops appearing.
7. Repeat the process on other relevant sites.
8. Check again later for new or relisted information.

The FTC’s people-search guidance warns that an opt-out may not resolve every exposure. Your information can still appear in a relative’s or associate’s report, and changes in public records can cause a listing to reappear. The opt-out also does not delete the source public record.

If your phone number is the main concern, the focused phone-number removal guide can help you narrow the process.

Understand public-record and legal limits

Some information is difficult or impossible to remove through an ordinary website request because the source has a legal duty or public-interest reason to keep it.

Examples can include property records, professional licenses, court records, voter information, and other government-held material, depending on the jurisdiction. A broker may suppress its copy while the original record remains available from the public authority.

Contact the record custodian if the information is inaccurate, restricted by law, or eligible for a jurisdiction-specific protection program. Use that authority’s official correction or restriction process. Do not assume a broker, publisher, or search engine can alter the original record.

Legal rights are jurisdiction-specific

Under the GDPR, a person can request erasure in covered circumstances, but the right has exceptions. European Commission guidance says organizations generally must respond to covered rights requests without undue delay and in principle within one month. That is a response framework, not a promise that the data will be deleted within one month.

California offers the Delete Request and Opt-out Platform (DROP) for eligible California residents. As of August 2026, registered data brokers are processing requests through the system on the schedule defined by the California Privacy Protection Agency. The tool has eligibility, matching, and data-category limits; it does not erase first-party, exempt, or publicly available information outside its scope.

Use these as labelled examples, not as universal processes. Check the current rules where you live.

Decide whether a paid removal service is worth it

Paid services can submit opt-out requests within their disclosed coverage and check covered sites again. They do not replace every account, source-site, search, public-record, legal, or security step in this guide.

There is no universal number of sites at which a paid service becomes necessary. A small, known set may be practical to handle manually. A larger or recurring workload may make delegation more useful, but the decision depends on coverage, time, reporting, cost, jurisdiction, and data-handling trade-offs.

Before paying, ask:

• Which sites and jurisdictions are covered?
• Will the service show which requests it submitted and their status?
• How often does it check for new or reappearing listings?
• What information must you provide, and how is it stored or shared?
• What happens when a broker cannot match you or refuses a request?
• How do cancellation, renewals, and post-cancellation monitoring work?
• Does the provider clearly disclose exclusions and avoid guaranteed-removal claims?

The FTC has taken action against deceptive claims about the effectiveness of a paid data-broker removal feature. Treat promises of complete or guaranteed removal as a warning sign.

If you decide to compare providers after reviewing these criteria, use the data removal services comparison as a secondary decision aid. A comparison page should not replace the manual steps or evidence boundaries above.

Verify removals and check for reappearance

There is no universal removal timeline. Different parts of the process run on different clocks.

Verify each layer separately:

1. Open the original source URL and check whether the information was removed or corrected.
2. Search for the relevant result and check the Google request status where applicable.
3. Search the people-search or broker site again after its stated processing period.
4. Record the result, including any denial, partial removal, or information that remains.
5. Resubmit or use an official follow-up route when the process supports it.

Information can reappear when a broker refreshes its data, a public record changes, a related-person profile exposes it, or a new source publishes it. Reappearance does not always mean the original request failed; it may be a new or rematched record.

Choose a rechecking schedule based on the sensitivity of the information, the likelihood of recurrence, and any known risk. Someone facing active harassment may need to check more often than someone cleaning up an old low-risk profile. No single cadence fits everyone, and monitoring cannot guarantee that information stays suppressed.

For broader prevention after the removal work, see how to reduce your digital footprint.

Frequently asked questions

Can I remove personal information for free?

Often, yes. You can delete content you control, contact source websites, use eligible search-removal tools, and submit many broker opt-outs yourself. The trade-off is the time needed to find, document, verify, and repeat requests. Some records may not be eligible for removal.

Is removing a result from Google enough?

No. Google can remove an eligible result from its search index, but the source page may still be available through its direct URL, links, social media, other search engines, or other copies. Request source removal separately where possible.

Can I remove everything permanently?

No process can responsibly promise that outcome. Some sources may delete information, while public records, lawful publications, unknown copies, or newly collected data may remain or reappear.

How long does removal take?

It depends on the mechanism. Your own deletion, a website response, a Google review, a broker opt-out, and a legal request have different timelines. Treat jurisdiction-specific deadlines as applying only to the covered process, not as a universal deletion promise.

Why did a people-search listing reappear?

The site may have refreshed its data, matched a changed public record, or found information connected to a relative or associate. Check whether it is a new listing and submit another official opt-out when appropriate.

Does a broker opt-out delete public records?

No. It can affect the broker’s matched listing, but the underlying government record may remain available. Contact the record custodian if you need correction or a jurisdiction-specific restriction.

Is it safe to give identity information during an opt-out?

Some processes need information to match you to a record. Use the official site, provide only what is reasonably required, and review how the organization says it will use the information. Be cautious about unsolicited requests or unexplained demands for sensitive documents.

When is a paid removal service useful?

It may be useful when broader covered-site checks, repeated monitoring, and consolidated reporting save enough time to justify the cost and additional data-sharing trade-off. Manual removal may be sufficient when you can reasonably manage the known sites and recurring checks yourself.

What if a password, ID number, or financial detail was exposed?

Do not rely on removal alone. Change exposed passwords, enable multi-factor authentication, contact the relevant financial or government organization, and use the appropriate identity-recovery route for the information involved.

Your personal-data removal checklist

1. Handle urgent risk first: secure exposed accounts, financial details, identifiers, or safety threats.
2. Map each exposure: owned account, source page, Google result, broker listing, public record, or breach-derived copy.
3. Build a request log: record exact URLs, data shown, owner, request route, date, and status.
4. Remove what you control: delete or restrict your own content and accounts after preserving anything you need.
5. Contact the source: request removal, correction, or restriction from the site that hosts the information.
6. Address search visibility separately: use Google’s eligible-removal or outdated-content process without confusing it with source deletion.
7. Opt out of brokers: submit official requests manually or use optional paid delegation after weighing its coverage and trade-offs.
8. Recognize limits: public records, lawful publications, unknown copies, and jurisdictional exceptions may remain.
9. Verify every layer: check the source, search result, and broker listing separately.
10. Check again based on risk: resubmit when appropriate and treat removal as maintenance, not a guaranteed one-time result.

A practical plan is one you can verify: remove at the source where possible, reduce visibility where eligible, secure anything exposed in a breach, and keep a record of what needs another check.

Sources

• Google Search Help — Remove my private info from Google Search
• Google Search Help — Find and remove personal info in Search results
• Google Account Help — Delete your Google Account
• FTC Consumer Advice — What to know about people-search sites
• FTC Consumer Advice — Responding to a data breach
• FTC — Enforcement involving deceptive removal-effectiveness claims
• European Commission — When personal data does not always have to be deleted
• European Commission — Dealing with data-protection rights requests
• California Privacy Protection Agency — DROP
• California Privacy Protection Agency — How DROP works