Hacker News new | past | comments | ask | show | jobs | submit login
You can now ask Google to remove your phone number, email or address from search (krebsonsecurity.com)
615 points by todsacerdoti on April 29, 2022 | hide | past | favorite | 173 comments



It took me about 10 minutes to figure out that the link provided from the Google article really just leads to a workflow where i have to answer just the right questions to get to the actual form (https://support.google.com/legal/troubleshooter/1114905?rd=1...). And, then go through a second workflow, which puts you to... the first workflow.

I have yet to reach a page where I can submit the URLs to be removed. I consider myself a neophyte technologist, since I just started a few decades ago with punch cards. I doubt most of the general public will figure out how to perform this process.

I will give some grace, and come back in a month.


I work from Google Search. Hope this helps clarify...

There's a lot of personal info we'll remove such as images of minors, involuntary fake pornography and other issues as outlined here: https://support.google.com/websearch/troubleshooter/3111061

Our announcement this week was about an expansion of removing personally identifying information -- PII -- (such as email addresses, physical addresses, phone numbers, etc),. This is the page that explains in more detail and where people should begin the removal process: https://support.google.com/websearch/answer/9673730

The removal process will lead you to a troubleshooter. That's designed to help people more quickly get things resolved. For example, if a web page no longer exists on the web, or the site owner removed info, there are faster options you can use rather than going down the formal removal request option.

But let's say you want something removed that has PII from a page that's live on the web and where you for whatever reason don't want to contact the site owner. The troubleshooter from that page I mentioned will lead you here: https://support.google.com/websearch/troubleshooter/9685456#...

Say No to contacting the site owner, select Personal Info from the next option, pick the type of info and you'll get to the form (such as here if it involves contact info): https://support.google.com/websearch/troubleshooter/9685456#...

That's where you enter the info. Appreciate the feedback that we should look at how to improve this more -- that said, the troubleshooter itself isn't new, and people have used it to successfully remove information beyond our recent expansion. But we'll see how to make it better.


But you do get that that’s not particularly user friendly right?

Like why not offer tools to make it easy to submit “here’s my phone number - delist it” or “here’s my name and all addresses I’ve lived - delist”and then you use Google’s awesome search and AI capabilities to figure that out. Then facilitate disputes between site owners and individuals. But forcing me to scan the internet looking for things that other malicious crawlers are finding. That’s not user friendly I think (in addition that finding this needs someone on the team to explain it on HN, one of the most technical sites on the world).

It’s like the Douglas Adam’s joke from Hitchhikers (going from memory so I’m sure I’m butchering it): “but we published the plans to destroy the Earth in the center of the next galaxy in the 100th underground floor of the administrative building in the filing cabinet in the locked room guarded by man eating lions.”


The full quote from The Hitchhiker's Guide to the Galaxy:

> “But the plans were on display…”

> “On display? I eventually had to go down to the cellar to find them.”

> “That’s the display department.”

> “With a flashlight.”

> “Ah, well, the lights had probably gone.”

> “So had the stairs.”

> “But look, you found the notice, didn’t you?”

> “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”


Your quote is about the local department's plans to demolish Arthur Dent's house.

The quote about the destruction of Earth is:

>‘There’s no point acting all surprised about it. All the planning charts and demolition orders have been on display in your local planning department in Alpha Centauri for fifty of your Earth years, so you’ve had plenty of time to lodge any formal complaint and it’s far too late to start making a fuss about it now.’

> ‘What do you mean you’ve never been to Alpha Centauri? For heaven’s sake mankind, it’s only four light years away you know. I’m sorry, but if you can’t be bothered to take an interest in local affairs that’s your own lookout.

> ‘I don’t know’ said the voice on the PA, ‘apathetic bloody planet, I’ve no sympathy at all.’


To be fair, they correctly picked out the quote that is actually relevant and also the one that their parent comment had been thinking of.


Actually clearly with time I’d merged the two.


I searched for a number that's similar to mine (not my own).

I found google hits listing it as a german number, italian number, swedish number and more. Clearly not all of these are "my number" even if it's the same number. It's not reasonable that those pages are all delisted, is it?


Because that's not Google's business. At least this is a step in the right direction. That IS the business of privacy removal services like DeleteMe which i am a cofounder of. Like in many things in life the advice "follow the $" can be helpful here ;)


People who end comments/messages with ";)" or the like always seem so condescending.


What's follow the money mean here? Like Google won't do work cause there is too much cost? This usage of the phrase don't match my understanding (which is the Lester Fremon (The Wire) usage) - in that it leads to corruption.


I think the notion they're trying to convey is Google doesn't have much motivation to make this feature good / humane as it has little immediate impact to their bottom line, compared to a company whose revenue derives directly from how well said feature performs.


i think to parent comment it means "use my service, if google makes one i cant compete"


But what if Googles model is to make personal data useless the root cause businesses and therefore kill off your business.

To kill off the root cause, Google could feed peoples privacy data into the SSO ranking. Websites with a lot of privacy data get a lower SSO. This cripples the business and with it, your business.

Just a hypothetical, I wish all the best for DeleteMe. I'm checking out optery.com right now and will check DeleteMe next.

"Don't be evil" I think may still be true and may actionably translate to "Don't sell user data _directly_"


If you have an AI, it'll likely have false positives. Then website owners might end up wondering why a lot of their pages aren't showing up in the results.

Disclosure, I work at Google, but not on anything related to this, so I'm just speculating.


Plus what about people trying to remove the details of someone else. It's not something you want automated.


Every x days I need to revalidate my phone number for Google voice. I would think Google has the mechanisms to validate phone number. In fact they also have the ability to validate addresses which they use for maps business listings.


Which is why I said make the process more like DMCA where the page owner can contest.


DMCA is a pretty bad thing to model after if you want to prevent abuse.


Because they want to make it as difficult as possible on purpose.


Thanks for the help! What can Google do about property search records on the internet? I understand this is technically "public" information, but having my full address searchable on the internet via just my name is kind of scary. Can those sites be removed entirely from the index? (i.e. realtyhop, blockshopper, clustrmaps, etc)


Our new policy allows you the ability to remove these types of listings for your name, if they are not official government sites.


Ah good 'ole customer diversion, intentionally making it as difficult as possible for the customer to do what they want to do by making them jump through hoops on the pretence that you know better. Saves google money as it takes humans out the loop. Lovely dark pattern.


Very much appreciate the quick response and explanation!

I found that a usability expert can come handy.


Hi, a bit of late feedback: at this point, I would expect to be able to prevent at least the contact information pertaining to my own Google account from being searchable. My phone number is already known and verified to be mine by Google, it should be trivial for me (prominently displayed in account privacy settings) to delist this pre-verified information from search.


For the form field "List the query terms", shouldn't it be a multi-line field?

The instruction is: "Please enter one query term per line (max 10000 lines)"


Thank you for your clarification. A small portal under an URL, say removal.google.com or google.com/removal featuring this content and links there - that would be a great start.


Cool thanks for the details!

How do you protect someone filing fake requests to hide another person or personal business from being findable, to damage them? How do you prevent abuse?


The policy doesn't allow for removal of business info but rather personal info. And there is a review process. If someone tried to, I suppose, remove a page for someone's name who ran their own business and submitted the business URL, the review process would ideally catch that in multiple ways, request more information and so on. That's why we do use a review process.


It's almost like Google doesn't want anyone to use this 'feature'... Great company.


It really shouldn't be this complicated. Google knows my name, email and phone number. Provide a dummy version that hides my stuff, and potentially deprioritizes results with similar first name last name combination from known sites that share people's personal information, hell why even show those sights at all... If a company wants to know about a prospective hire, they can and do pay for background checks.


> I have yet to reach a page where I can submit the URLs to be removed. I consider myself a neophyte technologist, since I just started a few decades ago with punch cards.

Internet literacy is probably unrelated to punch card literacy.

I followed the link in the article (from kreb) to the google blog post announcing it:

https://blog.google/products/search/new-options-for-removing...

That linked to this form:

https://support.google.com/websearch/troubleshooter/9685456?...

First you tell them what the info it (eg address Pcture SSN etc). Assuming it matches what is in the announcements as a supported type, you get an inline form asking for your name/email, then a URL to the offending site(s), query terms on google search that yield the site(s), and then optionally screenshots of the content.

After, you click a button saying you’re legally the person you’re saying you are. I don’t have data to submit in the form so i don’t know what happens next but it looks like the end. Are you sure you didn’t just submit a successful request and they redirected you to the landing page?

Disclosure: I work at G but didn’t know this existed until I heard from Kreb.


> Internet literacy is probably unrelated to punch card literacy.

The parent commenter was using self-deprecating "humor", which I understand can be confusing for Lumon Industries innies. Your outie will appreciate it!


This is great, but removing the info from Google does nothing to remove it from the source. People search data brokers are one of the most common sources of unwanted posting of home address, phone number and email. If that's the info you want to remove, you can use Google as a tool for discovery to figure out who is posting the info, and then opt out at the source to have it removed. For more coverage you can use Optery's free crawl / scrape / scan of the people search data broker sites for you, and use that to have the listings removed from the source. Wherever possible, removing the info from the source is much better than just removing it from Google.


It's good form to disclose that you own the tool you're recommending.


So you would recommend Optery? Some of the paid opt-out services seem to me to be essentially extortion schemes, want to make sure any service I use wouldn’t be like that.


Just FYI, the parent commenter is the Founder of Optery! So I think they’d recommend it, though I appreciate their light touch. It does seem like Optery is the only legit offering in a sea of scammy opt-out services/schemes.


how do you know which service to trust? honest question


Extensive analysis of Optery and the topic of removing your personal info from the web on HN here:

https://news.ycombinator.com/item?id=30605010


Are you still using those misleading scam tactics? And what's the purpose of the monthly membership if it works?!


The monthly subscription only make sense if you consider that new data brokers are popping up all the time and opting out is a constant process. That said, it seems like 90% of the value you get from a one-time usage, but of course they insist on a subscription.

But my solution to that is to use a burner credit card number! Specifically from privacy.com. I just make a new card with a limit of $20 to ensure it can't be billed again next month. I should of course just cancel the subscription, but if I forget they can't charge me next month anyway. I highly recommend privacy.com or other burner card services.


Thanks, will have to read up on it.


a shoutout to https://yourdigitalrights.org/ which is a nonprofit which tries to tackle this.

I haven’t used it yet, and it feels rough around the edges. I donated however and talked to their founder and I think this model fits better than a commercial one. The way it’s built you don’t actually share any data with them. They essentially provide templates to make erasure requests and follow-ups easier.


I love the idea, but they're horrible in practice. Provide very little help for most data brokers. And the opt out links are out of data for many sites.


Hi Varenc, I'm the founder of YourDigitalRights.org and I'd love to hear your specific feedback either here or via email (address is on the website). That would be greatly appreciated.


I've used DeleteMe:https://joindeleteme.com/ and OneRep:https://onerep.com/. Both have worked effectively - neither were extortion schemes


Recently I'm interested in Optery. What do you think the most differentiator to Atlas? https://www.atlas.net/


Those sites are low quality and it's often easy to get much better free data. SF recorder's publicly posted property records, searchable by name, for example. There are also numerous private databases with high quality data which certainly don't want to be indexed. Your info being on those public sites (which isn't very meaningful due to how many errors they have) is mostly a symptom of how easily available it is, rather than a source to be plugged. Suppressing it may make it slightly harder for an uncommitted nutcase to track you down, but won't make much of a difference overall. Going from a name to much more info is very easy in the general case, and if it isn't, there won't be valid info on those sites.


Personally its always been out there these people search sites just make it easy to figure it out who your dealing with especially when it comes to dating.

Was just with someone for the past few months who said all their relatives passed due to a horrific car accident and they would talk a lot about saying how much they missed them and are alone; have no one. Ummm they are all alive and well.. there was no horrific accident and she is just a crazy manipulator... gain sympathy to get whatever she wanted (toxic ... gross.. go away) ... Amber Heard type.

thanks SearchPeopleFree.com for letting me learn and move on quickly!


Meh… If some data about me is listed on a website nobody ever sees, I don’t care what sound a tree falling in the wood makes.

This isn’t a binary issue. Removing data from Google will usually have 90 % of the effect of removing it everywhere.


Data brokers aren't "websites no one uses".


They're not websites no one ever sees, they're websites who will sell your personal data to anyone. They'll sell it in bulk to advertisers, or just to any individual.

I had to deal with a stalker at one point and found over 100 of such sites, it took me a few days to opt out of all of them (and some ignored my requests).

Data brokers are total scum.

Not to mention that this Google effort requires an explicit threat to be made on the page in question. They won't remove data broker pages, you have to contact each on individually and hope they'll actually fulfill your request.


That all changes if you have a stalker / bad actor going after you online. Once your address hits one of these sites, it's on every one of them. And you'll be playing a constant game of whac-a-mole if you want them removed.

The amount of hoops you need to jump through to protect your privacy / shield your address in the US is quite incredible. And if you don't do it correctly from the start (use an anonymous land trust, etc), you're hosed.

Privacy should be the default. People's home addresses shouldn't be public info


> hoops you need to jump through to protect your privacy / shield your address in the US is quite incredible

The U.S. has a decentralized land registration system. The downside is it usually cannot provide indefeasible title [1]. The upside is it's tremendously robust. That robustness comes, in part, from publicly-verifiable records.

> People's home addresses shouldn't be public info

Confidential property ownership has its own issues.

It's less stable. In the event of a dispute you only have the registrar's and disputing owners' records to consult. It's also associated with embezzlement, money laundering and tax fraud. (The set of societies where a public home address puts one at risk and the set that have problems with embezzlement and laundering overlap in their institutional weakness.)

(For tenants, on the other hand, there are fewer compelling reasons to publish residence.)

[1] https://en.wikipedia.org/wiki/Torrens_title#Indefeasibility_...


Name -> address lookup being secret doesn't really make sense. Once it's out, you can't undo it, but you share it with all your friends and lots of organizations. I'd say something else in society needs to be fixed if that's become a problem. We used to have phone books, afterall.


That's if you define privacy as you knowing something and others not knowing.

My post-lobotomy view of privacy is all my secrets are known to the people I hate the absolute most ("I hate them with perfect hatred // I call them mine enemies" PSALMS KJV), and while I thank them as enemies (Matthew KJV) I do not forgive them, the intention is someday they thank me in return, as the Christians they claim to be, for acting against them as an enemy.

So then, what is privacy? If you're lobotomized, privacy is divulgation. I cannot erase my lobotomist's memory, and I cannot recollect all my own selfsame memories, so instead I divulge, and divulging is privacy.

Understand this: privacy is about who knows what. Who do you want to know what? Some options are out of the question for me. After all, there is a condition right on the box of all cryptographic products, in this case especially 1Password which I used before, during, and after my lobotomy, which is this: cryptography is about forcing the government to torture you. Not just the government though! If you get tortured? Forget it! Warranty void!

Well so then what? Nobody asks, OK so I get tortured, THEN WHAT? ANSWER ME! And I think I'm supposed to not be able to see the answer, I've been conditioned to avert my attention to the answer, not see the ads for the answer like fucking literal pathological banner blindness. So many ads I wanted so badly to see, I just couldn't see. The most targeted advertising, missing completely. Like it's invisible to me, I read the statute in the Federal Codes about torture, how it was defined, and I simply couldn't read the lawyer's advertising with a phone number to call them.

So privacy? Before torture, divulging works against privacy. After torture, it works in its favor.


> Google says a removal request will be considered if the search result in question includes the presence of “explicit or implicit threats” or “explicit or implicit calls to action for others to harm or harass.”

Apparently they've always had a process for bank account info and other related things, but I can't get some of the newly included items, like login credentials, removed unless I can show actual or implicit threats of harm?


I work for Google Search. We're working to clear this up. Threat is not required to remove the listed PII. I'll repeat what I shared in another comment here:

There is NO requirement of threat to remove anything listed as personally identifiable information on this page (such as personal contact info, medical records, login credentials, etc): https://support.google.com/websearch/answer/9673730

Beyond those things listed, in some cases someone who is being threatened might feel there's additional information that someone might feel is somehow personally identifying. This is where the doxxing/threat option can be used, for something not on the list where no threat is required.

Appreciate this is confusing to some; we'll be looking at how to clarify that.


Thanks I really appreciate the clarification, this is a great addition.


"We generally aim to preserve information access if the content is determined to be of public interest. This includes but isn't limited to:

Content on or from government and other official sources Newsworthy content Professionally-relevant content"

1. This removal process does not remove those public information aggregator sites, like "Who lives here.whatever", "Didthispersoneverappearincourt.com". The problem with the court aggregator sites is they are wrong some times. I imagine Google makes a ton of money off them though?

2. Google should remove all personal details, unless a person was in the news.

3. I'm on the fence whether you should even index sites like Yelp.com?


Third-party sites that republish public information are not exempt from this. IE: say a government site publishes personal info as public record. Our policy doesn't allow removal of the government pages. But if a third-party republishes, our policy does allow removal of those.


So the takeaway I get here is that it's perfectly fine for someone to dox you as long as they leave phone number, email address, and physical address out of it. Got it.


No. Again, we'll work to better clarify this page. But there are two things:

1) Remove personal info, which includes things like email address, phone number, physical address. You can ask those be remove; no proof of threat is required.

2) Remove doxxing content, where there's anything you might consider to be contact info that's not covered in the policy above and which is linked to a threat.


I wonder what the standards are to verify this. Can I just sockpuppet a twitter account calling for my harassment and then use that as proof of targeting?

IMO there should be as few barriers to entry as possible with something like this.


Cool new business model, harassment as a service. We‘ll get your info off google for the low low price of $1.99 per fake death threat


I hear ads on the radio for "reputation management" companies that, in part, use similar methods.


I'm implicitly threatened by a multi-billion dollar corporation making my personal information available publicly and refusing to remove it unless I have evidence of explicit or implicit threats.


Technically they haven't made your personal information available publicly. It was already public if Google managed to get their hands on it. They've just made it easier to find.


There isn't a material difference between those two things. What precisely is private information - outside of information stored solely inside your head. Even medical records can be made public through certain actions so pretty much everything is potentially public information.

Making things easier to find can be a threat - it's why there's a lot of compelling discussion around websites that take rosters of arrest records and post them on big scary websites along with pictures and lurid descriptions of the person's crime - offering to remove the information for a fee.


Making things easier to find can be a threat, yes. I guess that's why they're moving towards allowing things like this to be removed.


Fascinating, isn't it, that linking to a movie or cracked software is something they have to stop linking to upon request no questions asked by law, but if your personal information or financial information or login credentials are posted somewhere, you gotta prove you'd be harassed...

The US needs a GDPR-equivalent law.


Google buys 90% of credit card transactions. That's not public information.

And the only way to opt out of it is to not use credit cards.


Do they publicly index this information tho?


Does it matter?

Is it somehow OK for someone to build a dossier on another person as long as they use that information for their own purposes?


Well, yes. Because you're talking about a different scenario than what is going on here.


Yes? Are you telling me I can't know things about people?


You won't get your mitts on their video rental records. We need another embarrassing data breach to get more protections.


Is this still true? Nobody goes to Blockbuster to rent videos. Videos are streamed to you on a plethora of devices. Does the video rental regulations apply to YouTube sharing your video selections? PornHub? Netflix?


It is not free as in gratis, but it is publivally available, just as tomatoes are publicly available at stores.


> Google buys 90% of credit card transactions.

Source, please.


Bloomberg reported (paywall) and the web plagiarized:

https://www.google.com/search?q=Google%20buys%2090%25%20of%2...

The "90%" might not be easily sourced, but also not the crux.


> "...unless I have evidence of explicit or implicit threats."

It seems you're misreading the policy. See my comment above [1].

[1] https://news.ycombinator.com/item?id=31210455


Why is this dependant on receiving threats? By that point people already have your info. Why can't I remove it without jumping through hoops?


> Why is this dependant on receiving threats?

It is not.

From the form [1]: "...that has POTENTIAL to create significant risks of identity theft, financial fraud, harmful direct contact, or other specific harms..." (emphasis mine).

The requirements section states that you may request removal due to the page having "personally identifiable info" OR doxxing content "used in implicit or explicit threats".

Now, there's exceptions to this (e.g. public records, newsworthy content), but nowhere it says you have to receive threats first before requesting removal.

disclaimer: Googler, but no relationship with the team, and have no other knowledge of this policy other reading the public blog post.

[1] https://support.google.com/websearch/answer/9673730


>It is not.

>... nowhere it says you have to receive threats first before requesting removal.

Oh come on now, this is taken directly from your link:

>Requirements to remove doxxing content

>For us to consider the content for removal, it must meet both of these requirements:

>1. Your contact info is present.

>2. There’s the presence of:

>- Explicit or implicit threats, or

>- Explicit or implicit calls to action for others to harm or harass.

So, yes. To remove doxxing content, you are required to show proof of explicit or implicit threats.

If you think about it, the way the requirements are set up are pretty damn backwards. Are you just requesting your personal info to be removed just for the sake of having it removed? Sure, as long as it's your CC/bank account/SSN/whatever else on that list, they'll remove it. But if you tell them you're being doxxed? Well fuck you, they won't just up and remove the data like they would've before, now you have to prove you're being targeted, too. It's like it'd be easier to have the doxxing content removed if you didn't tell them you're being doxxed.


Isn't it a tautology? When you're doxxed, your personal identifiable information was revealed to threat or shame you, so yes, you were explicitly or implicitly threatened.

The other part of the form allows you to require removal just by stating that it has your "personally identifiable information". For example, the many sites offering background checks, your address history, etc.

I agree the form is confusing and should be simplified (i.e., the whole doxxing section seems redundant to me, and should be sub-bullets of the PII section), but OP's comment that you can only request removal after receiving threats is factually incorrect.


It's confusing. The policy document lists contact info twice, and to the form is missing the "other doxxing content" option.

It looks like the form has design errors that don't match the policy.


"Is your contact information being shared with malicious, threatening, or harassing intent, which is known as doxxing?

- Yes, the contact info is being shared with doxxing intent - No, the contact info is not being shared with doxxing intent"

The headline is extremely misleading.


The policy document is slightly inconsistent with itself and inconsistent with the form options.

This was not well reviewed.


I work for Google Search. There is NO requirement of threat to remove anything listed as personally identifiable information on this page (such as personal contact info, medical records, login credentials, etc): https://support.google.com/websearch/answer/9673730

Beyond those things listed, in some cases someone who is being threatened might feel there's additional information that someone might feel is somehow personally identifying. This is where the doxxing/threat option can be used, for something not on the list where no threat is required.

Appreciate this is confusing to some; we'll be looking at how to clarify that.


>Why can't I remove it without jumping through hoops?

Because the biggest hoop is that the data is not located in just one place. It's the internet, so the data is shared/duplicated as fast as it becomes available. You have no idea how many places it lives because not all places are available for public browsing. Some one buys it, then resells it ad nauseam.


Let's all collectively cut this 1.7 trillion dollar market cap company some slack. They only made all their money indexing and storing data for the last 20 years, they can't be expected to know how to not return results. They've never had to do that before, they just return everything you can type in right away.

Give me a break, especially the "googler" in this thread.


>Give me a break, especially the "googler" in this thread.

No. Just no. This is a 1.7 trillion dollar company. They can spend some of that money fixing the broken system they created, but they chose no. So no slack will be cut/granted from me to them.

>they just return everything you can type in right away.

No they don't. They return something that is most monetarily beneficial to them whether that is relevant to you or not.


Here's a direct link to the removal process: https://support.google.com/websearch/answer/9673730

Really neat.


Ha the other day I found this site truepeoplesearch has all my addresses/phone numbers, relatives... like cool

It probably came from resumes or something but still


Assuming you're in the US, it is probably from financial data. The whole market for data brokering has deep roots in financial services like credit reporting.


Do you mind if I send your application to a few jobs? :-)


The data that they have is crazy, goes back at least 2 decades (places I lived in life).


Awesome, because no sites use prior addresses to confirm your identity or anything.


No access to this site here. It's probably GDPR-blocked for me, which is fair.


I remember the good old days when Google offered a reverse phone lookup. Now trying to do that just leads to pages and pages of spam.


I did this a few months back, and i was very happy with how easy it was to remove my information from Google. At that time though I had to get the content removed from each site, and then i had to notify google that the excerpts had changed due to my requests for the websites to remove my personal information. Its really nice to see that Google is now moving towards supporting a request to remove PII from results, without having to deal with individual websites, who almost always are scam sites who will try to get you to 'subscribe for premium profile control to hide specific content'. Never give these people a dime. Google processed my requests very quickly and the content just can't be found using their search engine anymore.

Bing, on the other hand, was an absolute nightmare. After emailing for around a month with MSoft support, they claimed they removed content that was still showing up, and still is showing up to this day. This content doesn't even exist on the pages that Bing is showing excerpts from, and hasn't for around a year now. It became very clear to me that Bing had no effective process in place to carry out content removal requests, so I eventually gave up. Unfortunate, because alternative search engines like Ddgo and Brave show results from Bing, IIRC.

I guess you can't place all the blame on these sites. I also found out my state releases the entire registered voter database for anyone to download online, without any reason or identification required. So if you're a registered voter, it is possible that the information you provided to register is public and available online anyways. This includes full name, email, address, and phone number - if I remember correctly. It's been some time since I looked through the database though. I found my entire family within it, and it receives quarterly updates. I would not be surprised if the government was at least one primary source of information for PII scam sites in the first place.


I am not advocating for or against this practice; but in the United States the voter record has always been part of the public domain [1].

The National Conference of State Legislatures breaks out a by-state view of what info is available and how it can be used [2]. There's another good article [3] doing a state-by-state analysis of voter file privacy. The public file should only contain: Name, address, year of birth. The following should be kept confidential: DL number, last 4 of SSN, month and day of birth, phone number, information that a person declined to register to vote, the office that received a registered voter's application, digitized signature.

[1] https://www.nbcnews.com/tech/security/u-s-voter-info-has-alw...

[2] https://www.ncsl.org/research/elections-and-campaigns/access...

[3] https://www.comparitech.com/blog/vpn-privacy/personal-voter-...


>the voter record has always been part of the public domain

I think you should make it clearer that "the voter record" does not include who you voted for.

Joe Schmoe is a Democrat and voted in the last election is presumably public information.

A record of who he voted for would be unprecedented and explosive news.


Cool information and links. Thanks for sharing!


Two theories.

1. Google already does a good job of filtering out email addresses. I remember searching email addresses I was curious about 5ish years ago and getting results. Today, I get far fewer hits. So my theory is that google is already attempting to sort of scrub peoples email addresses from their searches. Us filling out the form is feedback to the machine learning.

2. Google wants to corner the market on this information and this is how they bleed the companies out. (I don't they have _actually_ devoted enough resources to this to bleed the other companies out) The business motive? There isn't a particular offering this data is good for besides selling to 3rd parties besides the business Google is already in. This data could enhance other data sets for other offerings. As simple as "auto-complete" for phone number after you have entered your name or address fill after entering your phone number.


once a month I google my PII and then either opt out through the hosting website or go through the google removal request process.

After I saw this news article about phone # removal I went to look for the search results that I had previously found on Google but apparently Google had already delisted them. Good stuff.


Well I filled it out. Let's see what happens. A lot of these websites have no way to remove personal info or make it very difficult to do so, so this is a minor step in the right direction. For me it's a matter of safety. I used to have a best friend about 15 years ago that got busted for sex crimes with minors and he's due to be released next month. The first thing he's going to do is look me up and find where I live, I guarantee it. I have kids that are around the same age as the minors he violated, so it's a serious concern knowing he can so easily find where I live and potentially harass us or worse.


send a support ticket into DeleteMe - we'll help pro bono.


Here is the actual link to request removal : https://support.google.com/websearch/answer/9673730


The headline is extremely misleading. They will only remove the information if you are being targeted by a doxxing campaign, and they make it incredibly onerous to remove the information - you have to provide screenshots, the URLs that generate the search results, and then, bizarrely, you must also separately provide the search terms.

The whole thing feels like a /r/maliciouscompliance post.


I work for Google Search. We're working to clear this up. Threat is not required to remove the listed PII. I'll repeat what I shared in another comment here:

There is NO requirement of threat to remove anything listed as personally identifiable information on this page (such as personal contact info, medical records, login credentials, etc): https://support.google.com/websearch/answer/9673730

Beyond those things listed, in some cases someone who is being threatened might feel there's additional information that someone might feel is somehow personally identifying. This is where the doxxing/threat option can be used, for something not on the list where no threat is required.

Appreciate this is confusing to some; we'll be looking at how to clarify that.


Indeed it's complex to do the submission but I understand why Google needs some of the details to process with fidelity and consideration. Sadly, simple privacy is now complex to achieve. We have to start unraveling 25 years of unfettered data collection somewhere. Google here is no worse than the data brokers red tape processes and corporations hiding behind consent managers with ID verification etc.


Isn't this good? What's the downside?


Looks like perhaps a loophole to deindex any page from google that allows comments. Just sneak in some doxxing looking info, like a bank account number and name like "John Doe 99874848383".


Who needs such a “loophole”? It’s already very common to take down pages with fake DMCAs, fake legal process and fake court orders.

Anyone wanting to deploy dirty tricks to remove things from Google can do so very easily already


It has the advantage of being a little more stealthy than taking those kind of actions against the page itself.


This is really good, imho. The downside is that the information is of course all still out there for a sufficiently motivated person to find.


The possible downside is that it could allow scammers/fraudsters to get their details removed.


> What's the downside?

I did reconnect with someone I lost track of a long time ago via google-stalking, found their email address. I'm pretty sure they agree that it was nice to reconnect, we talk regularly again.

(Neither of us are FB users, so no, it doesn't substitute.)


For this to be a downside, you have to believe that the person expressly wants to remove their email address from your view, but nevertheless wants to reconnect with you. That's possible, but I don't think a sane thing to build around.


It's a downside, not a "build around".


Now Google knows exactly who and where you are.


Krebs’s doxing posts will get removed from Google?


This initially seems like great news, but here is the link to the article that's actually posted as a screenshot in TFA:

https://support.google.com/websearch/answer/9673730

From that article:

   > We evaluate each request based on the criteria listed below, and evaluate the content for public interest. As a result, we may...deny your request.
With the exception of email addresses below, can anyone provide a circumstance when Google might legitimately find that not removing the following would be "in the public interest"?

   * Confidential government identification (ID) numbers like U.S. Social Security Number (..) etc.

   * Bank account numbers

   * Credit card numbers

   * Images of handwritten signatures

   * Images of ID docs

   * Highly personal, restricted, and official records, like medical records

   * Personal contact info (physical addresses, phone numbers, and email addresses)

   * Confidential login credentials
It seems there's quite a bit of wiggle room in this policy to remove some search results and not others.


I can't think of a good reason to remove ID docs, mugshots, court records, and other personal information of convicted child molesters.

There's a reason we have sex offender registries, even if they go too far sometimes. You should be able to look up why a person is on the registry using a search engine, and criminals shouldn't be able to hide their past.

Some of them probably will get harassed for it, but I'm fine with that.


I tried this feature for a public record before, unfortunately they don't consider it as PII and make it so easy for people to get everything about you. I wouldn't have concerns this data appearing on gov websites, however this kind of easy reach is bit inconvenient to be in a single search.


I have gotten information removed from Google like this and found it replaced within about a month


Does this remove it from search results only or from google's databases? I'm assuming google keep all the data internally for themselves and just filters it out for the users.


You're doing data verification for them too, confirming those details. That will make the data Google have available to sell use of to other companies more valuable.


Sweet. This should finally get rid of that sex story I accidentally posted from my regular email account.


if your email, phone number or address shows up in Google search you are doing it wrong


Still can't ask them to remove a legacy YouTube account you had access to though.


Put the content on a server you control; call in a copyright strike against the account; ...; Profit!?


This is a good start. And it should be easier. And somehow by default.


Do humans really review these requests manually? How would that scale?


They do get reviewed manually. I would imagine in the grand scheme of things, not many people would ever submit it.

Scaling it wouldn't be hard regardless, this would be very basic task based work, that they would hire out to India or via companies that handle this sort of work.


That's quite the contract. Could funnel the profits to another company that targets end users offering assistance in getting scrubbed from the internet.


They tend to contract this sort of work to companies like Lionbridge who are very strict on rules etc.


> Do humans really review these requests manually? How would that scale?

A slow and frustrating process to stop displaying your private information does Google no harm, so the answer from their side is likely "who cares?"


Why wasn't this done sooner?


Removing from google doesn't go far enough, the big culprit is the data broker. Displaying your age, is the biggest worry, among your friends circle. John oliver recently made a late night show on data brokers, threatening the congress members, must watch for anyone. https://www.youtube.com/watch?v=wqn3gR1WTcA


It's great but a related question: if Google processes phone numbers how is it GDPR compliant? They definitely don't ask every person in the EU whether they can process their personal data and yet it is possible to find EU citizens' phone numbers using their search engine.


'Technically' Google only lists websites in their search engine that a website owner has authorised them to scrape/crawl. Part of Google's TOS is that if you allow them to crawl your website, you're following all legal responsibilities in the countries you serve your website to.

That in theory means that if your details are on a website, you've already given consent for it to be shared with Google.

Does that happen in reality? Most of the time I doubt it. But it pushes the liability onto the website owner.


Uh, you don't really "allow" them to visit your website. All you can do is disallow them from visiting by blocking them using robots.txt. If you don't have a robots.txt stating otherwise they will crawl and index your site.

UPDATE: I suppose if you specifically allow the Googlebot via robots.txt, then in that case they could probably argue that you gave them permission to access the site.


If you put a website on the internet, you are granting anyone or anything permission to look at it by default. The alternative seems obviously untenable.


Exactly, and this is why the TOS mentioned in the comment is absurd. Basically that means that if the TOS is legally valid, then technically Google can force any arbitary terms on you if you simply put a website on the internet. This would be the same as saying that all citizens of America are subject to this agreement, whether if they've seen it or not.

This is worse than shrinkwrap agreements and TOS banners at the bottom of a website, since for those you could at least argue that the person who opened the box/visited the site saw the agreement. But in this case, there is absolutely nothing to indicate that the person who created the website even knew that Google as an entity existed.


https://www.yahoo.com/news/missouri-governor-says-security-1...

In theory you're right. In practice, just because something responds publicly does not mean it's public.

If someone left the vault door open on an ATM it doesn't mean you can just have the money, or even take pictures of the insides.

Obviously, in IT, people should strive to prevent leaking information, but that's obviously going to be an issue for a great long while.


That article is about a tech-illiterate governor using his station to threaten prosecution of the press... for discussing a 10-yr old bug that's already well known publicly.

If anything, that's more to the discussion of giving social security numbers to inept IT departments.


When you put a website live on the internet, you're giving everyone permission to access it, including Google, unless you state otherwise. (Or put processes in place to make it non-public.)

So yes, you do allow them to visit your website.


Have you ever met a lawyer who thinks that kind of TOS is valid in any way?


Consent isn't the only basis you can use for processing data under GDPR


I have never seen a lawyer give an opinion about that. One way to read the GDPR is that it outlaws all search engines, for this reason. More likely it is a huge barrier to entry for new search engines.


Meta: The title is truncated ("Search" at the end turned to "Searc") which doesn't look very nice.

I would suggest maybe s/Remove/Drop/ or just s/from Searc//.


aka google collects your phone number, email and address


I have asked Google (repeatedly) to remove roads on my private property from their Maps. Those roads still appear there, so I find it hard to believe they will honor these types requests either.


From previous experience they will virtually never 'remove' a road as the road is there and it should appear for 'accuracy' purpose, so if you're trying to get them to do that, that will be the reason why it's staying up.

Instead you have to submit an edit and state in there that it's a private road and on private property so should not be used for navigation purposes. It will then be removed from navigation etc.


Several years back Google started naming the alley ways in my neighborhood as if they were streets. Either all of the car services use Google maps, or other map services made the same decision. This is obvious as drivers are constantly being routed through alleys in my neighborhood for rideshares/deliveries/etc. As a side benefit to this, you can tell if your driver is clueless by watching them go through the alleys to find you or make the obvious decision to not go down an alley.

Several attempts at reporting this to Gmaps has gone ignored.


I had a similar issue. Trying to resolved involved debating the matter ad infinituum with a "local specialist" and was futile with no recourse or oversight.

Google sucks so much at these countless edge cases that it drains all the benefit of anything they're actually good at.

Don't get me started.


There are plenty of reasons to map roads on private property, and presumably it is visible in satellite imagery, so I don't see that as a compelling argument by itself. If we're not counting oceans, most of what is on a map is private property.


My roads are not visible from satellite and are behind locked gates. There is zero legitimate reason for anyone to know these roads exist.


I wonder how Google does know, then.


Probably satellite.

"Not visible from an aerial shot with leaves on" doesn't really mean anything. If the roads aren't buried underground or in a tropical rainforest, they are probably visible to a satellite at the right time or wavelength.


New roads can be submitted by users. Google has a map editor where anyone can make changes and have them officially approved. They could have been submitted by a random Google Map user that was scrolling around and noticed missing roads.


Did the private roads require plan submission and building permits? The plans likely got stored in some government map database, which in turn got sucked in by Google.


Do your roads appear on any government maps? I believe the mapping agency for road is called…shucks I forget. They’re sometimes ahead or behind Google maps.


If it is a private road on private property, I don't care if it is on a gov't map or not. It should not be listed as a route on any publicly available map service. In fact, it should be required to be explicitly labeled as private property "violaters will be prosecuted" type of thing.


Where I live in semi-rural Maine, probably 90+% of the houses are on private roads on private land. If they weren't listed as routes in map services nobody would be able to find us.


Sounds great, however I am scared that when I do this, Google will flag my account, and if I need to use their other services, like Google Ads, Gmail, YouTube etc. my account is suddenly blocked because of [insert arbitrary ToS violation]


I work for Google Search. And no, we won't. Moreover, the form doesn't require anyone to be logged into to file a request.


That's a random thing to be worried of. That's not going to happen.


I am fairly sure I was banned from AdSense for saying "don't forget to subscribe if you liked this post" on blogspot, although they never told me why so I can only guess since it happened soon after I started ending my posts with it.

It was my only source of income as I had just graduated and losing it completely pivoted my life. Now I see Youtubers say it daily and it still reminds me.


What makes you think you were banned from Adsense for saying something that common?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: