Data brokers (people-search sites)

Commercial services that aggregate public records, marketing data and purchased datasets into searchable per-person files, and sell lookups for a dollar or so. Whitepages, FastPeopleSearch, Spokeo and Radaris are the four named in self-dox-exercise; awesome-osint-list's "Public Records" and "People" sections are largely this industry, which is part of why that census found the field to be mostly hosted web services rather than repositories.

They matter to this spoke because they are where the identity branch terminates. A handle sweep produces profiles; a broker file is what converts a profile into a legal name and a street address, and it does so for a price that puts the whole chain inside anyone's budget.

The link is bought, not found

The mechanism self-dox-exercise describes for how a handle ends up in a broker file is commercial rather than technical: you gave a platform your real name for payments, the platform exposed or leaked your handle alongside it, a broker acquired that data, and the two fields are now in one record. Nothing was hacked and no inference was needed. The same paragraph asserts that brokers resell to each other, so a single successful correlation propagates — "once one broker links you, they all link you." That is stated without a named transaction or dataset, and it should be read as the author's working model rather than a documented supply chain.

Two queries that are not the obvious one

The obvious query is your own name. The two that carry more information:

Search your address, not yourself. The record returns the other people listed there — roommates, partners, family. Their files are reachable from yours and yours from theirs, which makes household exposure a joint property that no member can fix alone. This is the clearest case in the corpus of a privacy outcome an individual cannot control by their own behaviour.

Read the "last updated" field. self-dox-exercise proposes treating a cluster of refreshes — several brokers updating your file in one week when nothing about you changed — as evidence that somebody paid to pull it. If it holds, it is a detection channel for reconnaissance, which is otherwise almost absent from this spoke: username-reconnaissance notes a sweep is invisible because no single site sees anything worth logging, and ip-reconnaissance runs entirely against third-party datasets. It would be the one recon technique that leaves a mark the subject can see.

The caveat is that the whole inference rests on a timestamp the brokers publish without explaining. A refresh could equally be a scheduled re-crawl, an ingest of a new source dataset, or a display artifact. No source here tests it, and unlike a fingerprint measurement there is no published experiment to point at — this is growth-edge material, not a finding.

The removal side is unsourced here

Opt-out and removal — the brokers' own processes, the paid removal services, and the state privacy laws (CCPA/CPRA and the newer deletion-mechanism statutes) that force them — are the natural companion to everything above, and this corpus holds nothing on them. self-dox-exercise skips removal entirely: its remediation list breaks the linkability that would let a new file be built and never addresses the files that already exist. The regulatory half belongs with ai-governance-wiki's privacy thread rather than here, but the practical half — does opting out work, and does it stay done — is a gap in this spoke.

Related

self-osint · self-dox-exercise · username-reconnaissance · ip-reconnaissance · awesome-osint-list · osint · synthesis