What Kanary Can (and Can't) Remove, and What We Do About the Rest

We get this email a lot: "Can you remove my info from [insert site]?" Sometimes the answer is yes. Sometimes it's no. Sometimes it's "maybe," which we know is the least satisfying answer on earth.

So we wrote this post to explain what it depends on. Who published your data, why they published it, and which laws or site rules apply all change what we can do. Below we walk through how removal actually works, what we can take down, what we usually can't, and what we do when deletion isn't on the table. (Spoiler: it can get complicated.)

How personal data removal works

For most removals, we rely on privacy laws that give you the right to delete or opt out, or a website's own rules. Nobody has a master key to the internet. Not us, not any other removal service. If no law or policy applies, all anyone can do is ask nicely.

Privacy laws. These give you rights that companies have to respect. The ones we lean on most:

• California's CCPA/CPRA and the Delete Act. As of August 1, 2026, registered data brokers have to check California's DROP platform at least every 45 days and process deletion requests from Californians.

• Other state privacy laws. More states pass these every year. Virginia, Colorado, Connecticut, Texas, Oregon and others let residents delete their data or opt out of its sale, and several make data brokers register with the state.

• Laws for specific jobs. New Jersey's Daniel's Law covers judges, law enforcement, prosecutors and their families. A Daniel's Law case [cost Radaris its domain](https://www.kanary.com/blog/rip-radaris-domain-seized-but-the-network-is-still-live.) in August 2026, which made our week.

• GDPR and UK GDPR. If you live in the EU or UK, you have a "right to erasure" that reaches a lot of companies operating there.

Site rules. Plenty of sites have no legal obligation to remove anything, but they still have opt-out forms, content policies, or terms that ban doxxing, impersonation and posting private info. Search engines, social platforms and lots of people-search sites take things down when they break their own rules. We hold them to those rules for you.

Where you live and what you do for work change which of these apply. That's why one site might honor your removal and turn down your neighbor's.

What we can remove

We've monitored and cleaned up exposures across more than 55,000 unique sites. They fall into four source types: data brokers, search engines, social media and AI models. Core covers the highest-traffic data brokers and search engines; Advanced includes social media and AI models. You can look up any site on our full coverage list.

• Data brokers and people-search sites. The usual suspects: profiles with your home address, phone number, email, relatives, age and old addresses. Privacy laws cover these best, so they make up most of our removals. When a broker rebrands or jumps to a new domain (they love doing this), we catch it and start over.

• Search results. Google links that point to your personal info, including stale links to pages that no longer exist. We often de-index a result first, so it stops showing up while we wait on the source.

• Social media. Fake accounts pretending to be you, plus posts or bios that leak your info. Advanced members get scans on X and LinkedIn, and we use each platform's rules against doxxing and impersonation to get things taken down.

• AI models. Personal data that tools like ChatGPT spit out about you. We file removal requests through the provider's privacy portal and facilitate retraining requests so the same data doesn't come back.

A few things to know up front. We can't log in to someone else's website and delete your profile ourselves. We send the request, check whether the site followed through, and send you screenshots and links so you can see for yourself. Some sites act in a day. Others drag it out for 90 days or more, which the law lets them do (we hate it too). When a site stalls, we escalate to state or federal regulators every 15, 30 or 90 days, depending on your risk. And because data has a habit of coming back, we keep scanning after the first removal.

We also keep a list of the good stuff, like press coverage and your professional profiles, so we never take down something you want people to find.

What we usually can't remove

Some information stays online because the law protects it, or because no law or policy lets anyone demand it come down. Every removal service runs into the same walls. Here are the big ones:

• Public records at the source. Government agencies publish property and tax records, court filings, business registrations, professional licenses and political donation records. Most privacy laws exempt them.

• News. The First Amendment protects articles, broadcasts and their archives. Some publishers will update or anonymize an old story if you ask, but they don't have to. However, most publications will respond favorably to requests to remove personal information like phone number, home address or other personal details that can put an individual at risk.

• Stuff other people post legally. Reviews, forum threads, blog posts and social posts that follow a platform's rules usually stay up. Section 230 also shields most platforms from liability for what their users post.

• Brokers hiding behind exemptions. More and more brokers now call themselves identity verification, fraud prevention or background check companies. Those labels can put them outside state privacy laws or under the Fair Credit Reporting Act instead. We've sent more than 5 million removal requests since 2020, and we've watched the "no" responses climb because of this.

• Offshore and shady operators. Some sites hide behind shell companies in other countries and ignore requests entirely. Taking down Radaris took [two years of litigation](https://www.kanary.com/blog/rip-radaris-domain-seized-but-the-network-is-still-live.), and a dozen of its sister sites are still up.

• Breached and leaked data. Once your info lands in a breach dump or on the dark web, copies spread faster than any one site can control.

• Arrest records and mugshots. Police departments and courts publish arrest records, and those official records usually stay public unless a court expunges or seals them. Mugshot and people-search sites that copy them are a different story. Many states restrict sites that charge people to take mugshots down, and a lot of sites will pull or update a listing once you show them an expungement or dismissal. We send those removal requests, de-index the results so your arrest doesn’t come up when someone searches your name, and keep watch for copies that pop back up.

• Private datasets. Credit bureau files, government databases and data that foreign companies hold aren't public web listings. We focus on publicly exposed data. If these matter more to you, bring them up in your assessment call with us and we'll talk it through.

If something on this list worries you, keep reading. We still have ways to make that data a lot less useful to anyone looking for you.

What we do when we can't delete it

We're not trying to wipe every trace of you off the internet. We're trying to make you harder to find, harder to profile and harder to target. When a site won't delete your data, we work through this list:

1. De-index it. A page that won't come down can often disappear from search results. Most people start with Google when they look someone up, so de-indexing cuts off the easiest route to your info. We also clear out stale links to pages that sites already took down.

2. Swap out the sensitive parts. You can update some records even when you can't delete them. Changing your home address to a work or mailing address on a business filing keeps the record accurate and a lot less dangerous.

3. Get AI to stop repeating it. We ran a test where a mainstream chatbot pieced together a teammate's city and a birth year he never published, all from one public profile. So we watch AI tools for your data, file removal requests through each provider's privacy portal, and push for retraining so the models stop surfacing it.

4. Poison the well. If your real data won't go away, you can make it unreliable. In August 2026, our founder Rachel presented our decoy research at HOPE 26 (Hackers on Planet Earth). The talk walked through seven techniques we borrowed from security teams, like mapping where your data lives and assuming it's permanent, creating noise with profiles on trusted platforms, using protected identities, and qualifying for address confidentiality. Advanced members can have us set up decoy info, so whatever an attacker finds sends them the wrong way. Read the full write-up: Poisoning the Well.

5. Escalate. Where laws exist, we file regulator complaints, back up escalations with legal justification, and team up with your lawyer if you have one.

When you need a specialist

Some problems need tools we don't have. When that happens, we'll point you to partners we trust instead of leaving you to figure it out alone.

Legal help. Some situations call for a lawyer: stalking, harassment, sextortion, someone sharing intimate images of you without consent, or a platform that won't act on abuse. For those, we refer members to C.A. Goldberg, PLLC, the national victims' rights law firm Carrie Goldberg founded in 2014. Their team handles orders of protection, cease-and-desist letters, content removal and lawsuits, including cases that hold tech companies accountable for the harm their platforms cause. We can also share documentation of your exposures with them, or another lawyer you choose, so you don't have to start from scratch.

Reputation management. Sometimes the thing bothering you is a bad article, a nasty review or a search result tied to your name, and not your address on a data broker site. That content is usually legal, so privacy requests won't touch it. Reputation Repair helps people and businesses deal with damaging search results, build a credible professional presence, and manage reviews and listings.

We handle your personal data and the risk that comes with it, our legal partners handle anything that needs a lawyer, and Reputation Repair handles how you look in search.

Quick personal data removal reference guide

Still not sure what applies to you? Book a free 20-minute assessment and we'll tell you what to expect before you sign up.