What to Expect When You’re Accessing: An Exploration of User Privacy Rights in People Search Websites
Authors: Kejsi Take (New York University), Jordyn Young (University of Michigan), Rasika Bhalerao (Northeastern University), Kevin Gallagher (NOVA LINCS, NOVA School of Science and Technology), Andrea Forte (University of Michigan), Damon McCoy (New York University), Rachel Greenstadt (New York University)
Volume: 2024
Issue: 4
Pages: 311–326
DOI: https://doi.org/10.56553/popets-2024-0118
Abstract: People Search Websites, a category of data brokers, collect, catalog, monetize and often publicly display individuals' personally identifiable information (PII). We present a study of user privacy rights in 20 such websites assessing the usability of data access and data removal mechanisms. We combine insights from these two processes to determine connections between sites, such as shared access mechanisms or removal effects. We find that data access requests are mostly unsuccessful. Instead, sites cite a variety of legal exceptions or misinterpret the nature of the requests. By purchasing reports, we find that only one set of connected sites provided access to the same report they sell to customers. We leverage a multiple step removal process to investigate removal effects between suspected connected sites. In general, data removal is more streamlined than data access, but not very transparent; questions about the scope of removal and reappearance of information remain. Confirming and expanding the connections observed in prior phases, we find that four main groups are behind 14 of the sites studied, indicating the need to further catalog these connections to simplify removal.
Keywords: privacy rights, access, removal, data brokers, people search
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
