Last year, we published an article examining the unusual economics of consumer data removal:
You give a company more of your personal information so it can ask other companies to remove your personal information.
There are obvious problems with that model.
But there has always been a harder question to answer.
Does it actually work?
Now we have some data.
What the Study Found
A new peer-reviewed study, Measuring the Accuracy and Effectiveness of PII Removal Services, took a serious look at the industry. The researchers surveyed 10 major PII removal services and the 2,024 data brokers they claim to cover. They then recruited 71 people to test four commercial services.
The results should get the attention of anyone paying a company to make them less visible online.
Only 41.1% of the records identified by the services were confirmed by participants as actually belonging to them.
And only 48.2% of identified records were successfully removed.
Read the first number again.
The fundamental job of a data removal company is to find you.
According to this study, across the services researchers tested, most of the records they surfaced weren't confirmed as belonging to the person paying them.
That isn't a minor product issue.
It's an identity problem.
And if you can't reliably establish whose information you've found, everything downstream becomes questionable.
What Gets Called Into Question
How meaningful is a dashboard showing 200 discoveries if half of them aren't yours?
How meaningful is a "removal" if the information being removed belonged to somebody else?
How should we think about a service claiming coverage of hundreds or thousands of brokers when researchers found surprisingly little overlap in the brokers different services actually cover?
Those are uncomfortable questions.
But they're questions this industry needs to answer.
Because privacy isn't measured by how many removal requests you send.
It's measured by what remains exposed when you're done.