People-Search Sites & Data Brokers

Learning Objectives

• Explain how the data broker ecosystem collects, combines, and sells personal information
• Distinguish consumer people-search sites, marketing data brokers, and professional investigator databases
• Evaluate people-search results critically, knowing their common accuracy problems
• Describe the legal limits on this data, especially the Fair Credit Reporting Act (FCRA), and new state data broker laws
• Use email and identity lookup tools (Hunter.io, Gravatar, Epieos) responsibly, and connect this topic to reducing your own exposure (Module 9)

What Is a Data Broker?

A data broker is a business that collects and sells, licenses, or transfers personal information about people it has no direct relationship with. You’ve probably never heard of most of the companies that have a file on you, and that’s the point: you are not their customer, you are their product.

Data brokers matter for OSINT because they have already done the aggregation work. A single people-search report can combine addresses from the last 20 years, phone numbers, relatives, and estimated age, which would take hours to assemble by hand from public records.

How the Ecosystem Works

 Sources                     Brokers                          Buyers
 -------                     -------                          ------
 Public records   ─┐
 Marketing data   ─┤    Aggregate, match, and      ┌─> Marketers / advertisers
 Web scraping     ─┼──> infer ("probably married,  ├─> People-search websites (consumers)
 Other brokers    ─┤    likely homeowner")          ├─> Investigators / law enforcement
 App & loyalty    ─┘                                └─> Risk, fraud, and identity verification

Where the data comes from:
- Public records: Property, court, voter (where allowed), business filings, professional licenses (see 5.7-public-records.md)
- Commercial sources: Loyalty programs, warranty registrations, magazine subscriptions, sweepstakes entries, and purchase histories
- Online sources: Scraped social media profiles and websites
- Other brokers: Brokers buy and resell each other’s data constantly, which is why errors spread across many sites at once

What brokers do with it: They match records to the same person (often imperfectly), fill in gaps with inferences, and package the results for different buyers.

Three Tiers of Data Brokers

GLBA = Gramm-Leach-Bliley Act (financial data). DPPA = Driver’s Privacy Protection Act (motor vehicle records).

Consumer People-Search Sites

What they typically show:
- Current and past addresses (sometimes decades of history)
- Phone numbers and email addresses
- Relatives and associates (people who share addresses or accounts)
- Approximate age and date of birth
- Sometimes property, court, and social media links

Common sites (US-focused)

• Instant Checkmate and TruthFinder are the sites in the FTC’s 2023 settlement (see Data Quality Problems below). They’re a good classroom example of how these sites market “background reports” and why the results need verifying.
• Treat all of them as lead generators. The same underlying broker data shows up on many of these sites, so five sites agreeing is not five independent sources.
• Availability changes. When checked in September 2026 the sites above were live, though several block automated visits. Some well-known people-search domains have gone offline or changed hands, so check before class.

How they make money: Free search results show a teaser (name, age, city, relatives), and the full report sits behind a subscription or one-time fee. Some sites show a lot for free, which is part of why they’re popular with both researchers and stalkers.

Attacker use: Finding a target’s home address and phone number, identifying family members for pretexting (“Hi, I’m calling for your son…”), and answering security questions.

Defender use: Measuring how exposed employees and executives are, supporting fraud investigations, and prioritizing opt-out work.

Data Quality Problems

Teach students to treat people-search results as leads, not facts. Common problems:

• Merged identities: Two people with the same name in the same city get combined into one profile.
• Stale data: Old addresses and phone numbers stay listed for years.
• Wrong relatives: A former roommate shows up as a “relative.”
• Inferred data presented as fact: Estimated income or marital status may be a guess.
• Copied errors: Because brokers resell to each other, the same mistake appears on many sites, which can look like independent confirmation when it isn’t. (This ties to the “independent sources” rule in Verifying What You Find.)

Real-world example of the accuracy problem: In September 2023 the FTC required TruthFinder and Instant Checkmate to pay $5.8 million. The FTC said the companies deceived users about background report accuracy (for example, marketing that implied someone had a criminal or arrest record when the record was only a traffic ticket) and violated the FCRA by operating as consumer reporting agencies without ensuring the maximum possible accuracy of their reports. The FTC also alleged TruthFinder made no meaningful effort to verify data from third-party vendors.

The Legal Side

Fair Credit Reporting Act (FCRA)

The FCRA regulates consumer reports used for decisions about credit, employment, insurance, and housing. Companies that provide these reports are consumer reporting agencies and must follow accuracy, dispute, and permissible-purpose rules.

• Most people-search sites say in their terms that they are not consumer reporting agencies and that their reports cannot be used for employment, tenant screening, credit, or insurance decisions.
• If a site markets its reports for those purposes anyway, it can be treated as a consumer reporting agency. That was part of the FTC’s case against TruthFinder and Instant Checkmate, which the FTC said marketed reports for employee and tenant screening. (Instant Checkmate had also settled earlier FCRA charges with the FTC in 2014.)
• Teaching point: If you ever do OSINT for a hiring or housing decision, you’re in FCRA territory and need a compliant background check provider, not a people-search site. This is another reason to read the Terms of Service.

State data broker laws

Several states now regulate data brokers directly:

Connecticut has also passed a registration requirement, reported to take effect January 1, 2027 (verify before class).

California’s DROP (Delete Request and Opt-Out Platform):
- Opened to California residents on January 1, 2026. One request goes to every data broker registered in California.
- Starting August 1, 2026, registered data brokers (reported as more than 600) must process DROP deletion requests. They have to check DROP at least every 45 days, delete the associated personal data (including inferences), and report the status.
- More than 300,000 Californians had reportedly submitted requests by spring 2026.

State registries are also an OSINT source: they list which companies admit to being data brokers, which helps when building an opt-out list (see Module 9).

Email & Identity Lookup Tools

These tools start from an email address or a company domain rather than a name.

Hunter.io

• What it does: Domain Search returns email addresses found for a company domain plus the likely email format (e.g., first.last@companyx.com). Email Finder takes a name and domain and returns the most likely address with a confidence score. Email Verifier checks whether an address is likely deliverable.
• Free tier: 25 searches and 50 verifications per month, no credit card required (per third-party reviews; verify before class). Paid plans add volume.
• Attacker use: Building phishing target lists.
• Defender use: Seeing how easily your organization’s email format and addresses can be discovered.

Gravatar

• Gravatar provides profile pictures and public profiles tied to an email address across many sites (WordPress, GitHub comments, forums).
• Profiles are addressed by a hash of the email. Current profiles use SHA-256 of the lowercased, trimmed email (older ones used MD5). Anyone who knows an email can compute the hash and check whether a public profile exists.
• OSINT value: A profile photo (which you can then reverse image search), display name, linked accounts, and location.
• Open-source tools like hashtray automate this pivot.

# Illustration only: computing the SHA-256 identifier Gravatar uses (fictional address)
echo -n "jane.doe@example.com" | tr '[:upper:]' '[:lower:]' | sha256sum

Epieos

• An OSINT search engine for email and phone reverse lookups that checks more than 140 online services.
• Best known for its Google account check: for many Gmail/Google addresses it can reveal a public Google ID, profile picture, Google Maps reviews and contributions, and whether a calendar is public.
• Pricing (per its pricing page and reviews; verify before class): a free “Member” tier with about five lookups per month and watermarked, limited output; paid “Osinter” (about €29.99/month) and “Pro” (about €49/month with API access) tiers.

A caution about “is this email registered?” tools

Some open-source tools check whether an email is registered on a site by probing that site’s signup or password reset page. That means your tool is interacting with third-party services in ways their Terms of Service may prohibit, and some sites may send the account owner a notification. Treat these as semi-active, check the ToS, and use them only on approved targets.

Ethical Use

People-search data is where OSINT most easily turns into stalking. Ground rules for this class and for professional work:

1. Purpose first: Only look up people when the investigation’s objective requires it and they’re in scope.
2. Minimize: Record what you need (e.g., “employee’s email format confirmed”), not full dossiers.
3. Verify before acting: Data broker errors have caused people to be accused, harassed, or denied housing.
4. Protect the vulnerable: Never use these sites to locate someone who may be hiding from an abuser. Many address-confidentiality programs exist for exactly this reason.
5. In class, only look up yourself (see labs.md).

Connection to Module 9 Defending Against OSINT

Looking yourself up on people-search sites is the first step to reducing your footprint:
- Most sites have an opt-out page (often requiring you to find your listing and confirm by email).
- Opting out of one site doesn’t remove you from others, and listings can reappear when data is refreshed.
- Paid removal services automate repeated opt-outs.
- California residents can use DROP to reach every registered broker at once.

Key Terms

• Data broker: A company that collects and sells personal data about people it has no direct relationship with.
• People-search site: A consumer-facing website that sells reports about individuals.
• Consumer reporting agency (CRA): A company that assembles consumer reports for credit, employment, housing, or insurance decisions and is regulated by the FCRA.
• Permissible purpose: A legally allowed reason for accessing regulated data (FCRA, GLBA, DPPA).
• DROP: California’s Delete Request and Opt-Out Platform.
• Email format: The pattern an organization uses for addresses (e.g., flast@, first.last@).
• Hash: A fixed-length fingerprint of data. The same input always produces the same hash, which is why hashed emails can still be looked up.

Key Takeaways

• Data brokers have already done the aggregation, which makes them a powerful and dangerous OSINT source
• Treat people-search results as leads, not facts: identities get merged and errors copy across sites
• People-search sites generally can’t legally be used for employment, housing, or credit decisions (FCRA)
• The FTC’s $5.8M TruthFinder/Instant Checkmate settlement (2023) shows the accuracy problem
• California’s DROP lets residents send one deletion request to every registered data broker
• Email is a powerful pivot: Hunter.io for company formats, Gravatar and Epieos for linked profiles
• In class, only look up yourself

References

• FTC: TruthFinder and Instant Checkmate settlement (Sept 2023)
• Hintze Law: FTC Orders Data Brokers to Pay $5.8 million
• California Privacy Protection Agency: Delete Request and Opt-Out Platform (DROP)
• CalPrivacy: Data brokers
• Byte Back: California’s DROP is Live
• TrustArc: California Delete Act — What Data Brokers Must Do by August 1
• California Lawyers Association: Data broker regulation in California, Texas, Vermont and Oregon
• WilmerHale: Texas and Oregon Adopt New Rules for Data Broker Laws
• Privacy Rights Clearinghouse: Why Are Hundreds of Data Brokers not Registering with States?
• Get Started with Hunter.io: Free Plan Setup Guide (2026)
• Gravatar docs: Creating identifier (hash)
• Gravatar docs: Profiles
• hashtray (GitHub)
• Epieos
• Epieos pricing
• Epieos Review (Skrapp)