Poisoning the Well: How Decoys and Misdirection Protect Privacy When Opting Out Isn’t Enough
Have you ever asked a site to opt you out or remove your personal information, only to hear back “No”? Since founding Kanary in 2020, we’ve sent over 5 million removal requests. Across those requests, we’ve started to see a concerning trend. Not just more “Nos” when you ask to be removed, but data collectors re-classifying themselves as identity verification or fraud detection companies to get around changing regulations that were supposed to increase our ability to protect our sensitive information online. More money than ever is pouring into our industry, but to what end?
What started out as a human process that respected an individual’s right to ask for privacy and be respected, has scaled into a series of automated loops and rejection patterns, even for some of the most at-risk people. People for whom protecting where they live is a matter of life and death.
How Do Misdirection and Decoys Work Within the Context of Kanary?
With these trends in mind, we began researching alternative ways to stay ahead of your attackers. And how useful they are when paired with removal strategy. We call this human attack surface management, an emerging category security practitioners are embracing to support their teams and quantify/mitigate human risk. When opting out or disappearing isn’t enough, what can you do? Decoys, masking, misdirection, and honeypots are all fairly common practices in cybersecurity. We decided to start experimenting and researching how they might benefit people who come to Kanary looking to be less targetable.
NOTE: We started this research in March 2026, then picked back up in July, then presented on our progress at HOPE 26. HOPE stands for Hackers on Planet Earth. It’s highly experimental so please reach out if you have an alternative view, suggestion, or feedback.
Seven Techniques + a Bonus
If you have 30-45 minutes, watch the full talk:
You’ll learn about a brief history of data broker removal and where we stand today. And most importantly, seven techniques we’ve tested and what we found.
Map visible systems, assuming permanence
Use masks when probing for weakness
Befriend your county assessor
Create noise with profiles on trusted platforms
Leverage protected identities
Create a new identity
Qualify for address confidentiality
Cat & Mouse: Continuing to Adapt
This was the first time our team had run and presented experimental research publicly. It felt vulnerable but illuminating. The team and attendees at HOPE were overwhelmingly supportive. And we hope it helps people.
If our research is relevant to what you're working on, please share what you think in an email or book some time.
