0%

Do data removal services actually work? An investigator's verdict

The claim versus the evidence

Every data removal service sells the same promise: sign up, and your personal data disappears from the internet. Incogni says 420+ brokers. DeleteMe headlines 976+ sites. The numbers sound reassuring. They are also misleading, and I have spent enough time verifying these claims to know exactly where they fall apart.

I have investigated digital footprints for corporate clients across more than 400 intelligence reports. That means I do not just send removal requests. I verify what actually happens afterwards. I check whether the data is genuinely gone, whether it reappears, and whether the brokers that matter most were ever contacted in the first place.

The short answer to whether data removal services actually work: they do something. But what they do and what most people assume they do are very different things.

Do data removal services actually work? What the testing shows

Consumer Reports ran the most rigorous independent test to date. Seven services, four months, real data. Optery achieved 68% removal success. EasyOptOuts hit 65%. DeleteMe managed just 27%. Notably, manual opt-outs still beat every automated service at 70%.

That 70% figure is the one worth sitting with. A person doing the work themselves, following opt-out forms one by one, outperformed every paid service in the test. The services are not useless, but they are not magic either.

Incogni commissioned a Deloitte audit (ISAE 3000 Revised, August 2025) to verify its processes. The audit confirmed that Incogni sends the requests it claims to send. What it did not confirm is whether brokers actually comply. That distinction matters enormously. A sent request is not a successful removal. I have seen brokers acknowledge requests and do nothing for months. I have seen others remove a listing only to re-scrape and re-list the same data within weeks.

When I compare these results to what I find during my own investigations, the pattern is consistent. Automated services handle the easy removals well. The US people-search sites with standardised opt-out forms get processed efficiently. But the difficult cases, the ones that actually matter for someone with genuine exposure, rarely get resolved by automation alone.

What “removed” actually means in practice

This is where the gap between marketing and reality becomes stark. Most services report a removal as complete when one of two things happens: the request was submitted, or the broker acknowledged receipt. Neither means your data is gone.

I routinely verify removals for clients by searching the broker sites directly after a service reports success. In roughly a third of cases, the data is still visible. Sometimes the profile page returns a 404 but the data remains in the broker’s search index. Sometimes the listing disappears from the main search but persists on a cached or archived version. Sometimes the broker removes one record (the one matching the exact details submitted) while leaving other records for the same person untouched.

No automated service performs this kind of post-removal verification at scale. They cannot. Verification requires searching each broker site individually, checking multiple name variations, checking associated addresses, and confirming the data is not just suppressed from the public-facing search but actually purged from the database. That is investigative work, not automation.

For someone with a single name and one address, the gap between “request sent” and “data gone” might be small. For a director with Companies House exposure, multiple properties, and family members whose data cross-references their own, the gap is enormous.

The UK-specific problem nobody automates away

Every automated service available to UK consumers was built for the American market. Incogni’s 420+ broker list is overwhelmingly US people-search sites. DeleteMe’s standard plan covers approximately 85 brokers, again mostly American.

The brokers that dominate UK exposure are 192.com (700+ million records, including 200 million from edited electoral rolls), Tracesmart (now owned by LexisNexis), PeopleTraceUK (40+ million names and addresses), and UKPhonebook. None of these appear on any automated service’s broker list.

This is not a minor gap. For a UK individual, these brokers represent the primary exposure. Someone paying $96 a year for Incogni is getting removal requests sent to US brokers that probably never held their data in the first place, while the brokers that actually list their home address, phone number, and household members remain completely untouched.

I have written about this problem in my comparison of Incogni and Barnveil and my analysis of DeleteMe’s UK coverage. The situation has not changed. No automated service has added UK-specific brokers since those pieces were published.

The 90-day re-scrape cycle

Even when a removal genuinely works, it is temporary. Data brokers re-scrape their sources on cycles ranging from 60 to 90 days. If your data remains on the open electoral register (roughly 19 million UK adults are still listed), if your directorship details are on Companies House, if your phone number sits in the BT-OSIS directory, brokers will find it again.

Services like Incogni address this by sending recurring removal requests. That sounds like a solution. In practice, it means you are paying for a service that perpetually chases a problem it cannot solve at the source. The broker removes your data, re-scrapes it two months later, the service sends another request, and the cycle continues indefinitely.

I have tracked this pattern across multiple client cases. The data comes back. It always comes back, unless you address the sources feeding the brokers. That means opting out of the open electoral register, applying for SR01 address suppression at Companies House, going ex-directory with your phone provider, and systematically closing the data supply chain that brokers rely on.

No automated removal service does any of this. They operate downstream, catching water after the tap is already running.

What services genuinely deliver

I want to be fair about this. Automated services are not a scam. They provide real value in specific situations.

For US-focused exposure, Incogni is currently the strongest option. If your data sits on Spokeo, WhitePages, BeenVerified, and the other major US people-search sites, paying $96 a year for automated removal requests is genuinely efficient. You could do it yourself, but the time cost of manually submitting to 420+ sites is real, and Incogni handles the recurring requests that prevent re-listing.

For someone with limited, straightforward exposure, automated services save time. If you have one name, one address, and your concern is general privacy rather than active threat management, Incogni at $8 a month is a sensible investment.

DeleteMe’s use of human privacy analysts can help with edge cases that pure automation misses. When a broker’s opt-out form changes or a removal requires a specific format, having a person review the submission matters. The Consumer Reports test showed weak overall results, but DeleteMe’s hybrid model has genuine advantages for complex removals within its broker coverage.

Where services fall short for high-exposure individuals

The individuals I work with typically have compound exposure. Multiple properties, directorships across several companies, family members whose data creates cross-references, media coverage, professional profiles, and sometimes active threats like stalking or harassment.

For these people, automated removal services address perhaps 15 to 20% of the problem. Here is what they miss entirely:

Court records and legal filings. Public by law. No removal service can touch them.

News articles and media coverage. Third-party editorial content is protected. The right to erasure under UK GDPR Article 17 explicitly exempts processing for journalistic purposes.

Google cached and indexed results. Even after a broker removes a listing, Google may cache the page for weeks or months. Removing the source does not remove the search result. That requires a separate process through Google’s removal tools.

Forum posts and social media mentions. Scattered across thousands of platforms. Automated services do not monitor or address these at all.

Companies House filings. Residential addresses in historical documents require individual SR01 applications at 30 pounds per document. No automated service handles this.

Electoral register data already sold. Opting out of the open register is not retrospective. Every broker who purchased previous editions retains that data legally.

Cross-referenced family data. If your spouse, children, or parents have not also removed their data, their listings often reveal your address, relationships, and other details indirectly. Automated services process one person at a time and do not account for household-level exposure.

In my experience, this last point is the one that catches people most off-guard. I have seen cases where a client’s personal removal was successful on every broker, but their partner’s listing on 192.com still showed the home address, linked to the client by surname and postcode. The removal was technically complete. The exposure was unchanged.

What an investigation-led approach looks like

The reason I built Barnveil around digital footprint investigation rather than automated removal is that removal without investigation is guesswork. You cannot know what to remove if you have not first mapped what is exposed.

An investigator-led assessment starts by finding everything. Every broker listing, every public register entry, every Companies House filing, every cached search result, every social media mention that leaks personal information. The output is a complete map of exposure, not a count of removal requests sent.

From that map, you can make informed decisions. Some data can be removed. Some requires formal GDPR erasure requests. Some requires source-level action like electoral register opt-outs or Companies House suppression. Some cannot be removed at all, and the right response is monitoring rather than removal.

This is fundamentally different from what an automated service does. An automated service sends template requests to a fixed list of brokers. It does not know what else is out there. It does not check whether the removal worked. It does not address the sources feeding the brokers. And it does not adapt to the specific exposure profile of the individual.

My honest verdict

Do data removal services actually work? They work within narrow parameters. They send requests. Many of those requests result in removals. Some of those removals stick, at least until the next re-scrape cycle.

But “working” in any meaningful sense requires more than sending requests. It requires verifying outcomes, addressing source-level exposure, covering the UK brokers that actually hold your data, and accounting for the compound exposure that comes with wealth, directorships, and public profile.

If your exposure is straightforward and primarily US-based, Incogni at $96 a year is reasonable value. If your exposure is UK-specific, complex, or involves active risk, no automated service on the market today will solve the problem.

The question should not be “do data removal services work?” It should be “do they work well enough for my specific situation?” For most of the people I work with, the answer is no. Not because the services are bad, but because the problem is bigger than any automated tool can reach.

If you are not sure where your exposure actually sits, that is the first thing to establish. Get in touch and I will tell you honestly whether an automated service is enough or whether you need something more.

Aaron Barnes-Wilding — Barnveil founder and privacy intelligence expert

Aaron Barnes-Wilding

Founder & Privacy Intelligence Expert

Former intelligence analyst and licensed investigator with over a decade of experience in OSINT, counter-fraud, and digital privacy. Advises high-net-worth individuals, solicitors, and corporates on data exposure and removal strategies.

Free Guide