Skip to content
Datalogia

← All guides

OPSEC: protecting yourselfUpdated · 7 min read

Cleaning up what a search engine knows about you

My name comes up in the results with my address. What can I actually get removed?

In briefTwo levers, and only one really erases. Removal at source and de-indexing do different jobs, and the order you pull them in changes the outcome.

Your address did not come from nowhere. It was collected by a company whose business that is, a data broker, which matched it to your name and your number, then published it on a profile page. The search engine merely found it. That distinction governs everything below: the engine displays, the broker holds.

Hence two levers, doing different jobs. Removal at source asks the broker to erase the profile: the page goes away, and the engine stops finding it because it no longer exists. De-indexing asks the engine to stop showing the page: it stays online, reachable by its direct address, just no longer offered on your name.

De-indexing erases nothingThis is the most common misunderstanding, and the most expensive. Obtaining de-indexing removes a signpost; it does not demolish the house. The page is still served, anyone with the address reaches it, another engine may keep offering it, and re-indexing stays possible. De-indexing without removal at source leaves the data untouched at the company selling it.

The order of operations

  1. 01

    1. Find who publishes, not just what shows

    Search your name, then your name with your town, then your phone number in quotes. For each result, note the site hosting the profile, not the wording of the result. That domain name is what you will contact. The same data often appears on several brokers: they resell each other's databases.

  2. 02

    2. Ask for erasure at source

    This is Article 17 of the GDPR, the right to erasure. The broker has one month to answer (30 days). In practice, expect 30 to 90 days: most comply within a few weeks. Keep a dated record of every request; you will need it if you have to press.

  3. 03

    3. Wait for the engine to come back round

    Once the profile is gone, the result does not vanish the same day: the engine has to revisit the page, see that it is gone, and drop the entry from its index. That step is free and automatic. Only ask for de-indexing if the result persists after removal, or if the source refuses.

  4. 04

    4. De-index what resists

    De-indexing is requested from the engine, and it is arbitrated: an engine may refuse if the information carries a public interest, which happens for someone holding public office. Expect 30 to 90 days, and a case-by-case review. It is the slowest and least certain lever, hence its place last.

  5. 05

    5. Come back in six months

    A removed profile comes back. Brokers rebuild their databases from the same public sources, and a re-listing often goes unnoticed. Redo the step 1 search twice a year. That is precisely what monitoring automates, but nothing stops you doing it by hand.

Where the requests are made

The brokers this service already handles. The list is not exhaustive and does not claim to be: it gives the most frequent entry points. A broker missing here is contacted the same way, through its privacy form.

French directories

  • PagesJaunes / PagesBlanches (Solocal) : erasure is requested through a form, under the right to erasure. Solocal itself warns that this is not the same as being unlisted and that the data may reappear, because it is the telecom operators that supply subscriber lists to directory publishers. So the request that lasts is also the one made to your operator.
  • 118 712 : a directory fed by the same subscriber lists. The site publishes no removal form, only a privacy policy: no address is given here, and once again the request that lasts is the one made to your operator.

Profile aggregators

Advertising brokers

  • Acxiom : publishes no browsable profile, but resells the record. The request goes through its privacy department.
  • Oracle Advertising
  • Epsilon
  • Experian Marketing Services
If the broker does not answerSilence is an answer, and it is a breach. Once the legal month has passed, a formal notice gives 8 days to comply before a complaint to the data protection authority. That is the step this service takes for you when a request goes unanswered, and it is also one you can take alone: the GDPR requires neither a lawyer nor any particular formality.
What these two levers cannot doData that came out in a breach cannot be pulled back. It has been copied onto archives and forums nobody administers, with no counterpart to address a request to. Removal at source and de-indexing deal with what is published by someone identifiable: that is their domain, and their limit. For the rest, only monitoring remains, and knowing the data is out there.

Now practise

Knowing which tool to pick isn't enough: reflexes are built in context. The course covers the topic as exercises.

Digital footprint →Digital discretion →

Where do you stand?

Good tools protect what comes next. What's already circulating about you (addresses, passwords, exposed accounts) needs a different answer.

Run my scan