Staying safe means staying private, especially when you’re online. With this in mind, Google recently announced that it would remove contact information from people’s search results to protect them from scammers, hackers, and other bad actors.
However, there are some important caveats and limitations.
Read on to learn more about Google’s new policy, including the reasons behind it, what types of information it covers, and the steps you can take to remove your data.
What’s behind the change?
Until now, Google only responded to requests to remove highly confidential personally identifying information (PII)—like Social Security numbers, bank account and credit card numbers, images of personal signatures and ID documents, and medical records—because these items might put someone at immediate risk of identity theft or financial loss.
However, Google now acknowledges that easily accessible contact information can lead to more than just financial loss; it can also help people hack into your accounts or result in “unwanted direct contact or even physical harm,” according to Michelle Chang, Google’s global policy lead for search. You can see examples of this happening in our article 10 times someone’s online information made them unsafe in real life.
Another reason Google implemented this policy is that its users, who have become increasingly privacy aware, have been asking for measures like this for years.
“People are worried about threats, they’re worried about things like identity theft, or they’re just generally not comfortable with their personal contact information being out there. The internet has given us easy access to all sorts of information it used to be hard to get. But that’s also caused people to have concerns about privacy and how they manage their information online. This is us trying to give people some sense of having more control over that.”—Danny Sullivan, Google’s public liaison for Search.
What new information will Google remove?
Google is adding these types of personal data to the list of what it will remove from the search results:
- Personal contact information, including phone numbers, email addresses, and physical addresses
- Images of ID documents
- Login credentials
Until now, users could only request removals of the following information:
- Government identification (ID) numbers, such as a US Social Security Number, a Korea Resident Registration Number, etc.
- Credit card and bank account numbers
- Photos of handwritten signatures
- Highly sensitive, official records, like medical records
- Involuntary fake pornography, such as deepfakes
- Non-consensual intimate or explicit personal images
- Irrelevant pornography linked to your name
- Content about you on websites with exploitative removal policies
- Personal information released in a doxxing campaign
- Photos of minors
- Photos of child sexual abuse
- Content that breaks DMCA copyright laws
What Google won’t remove
However, just because you request a removal under this new policy doesn’t mean Google will take any action. The search giant won’t delete any content its moderators and algorithms deem broadly useful or of “public interest.”
For example, it won’t remove content that:
- It considers “newsworthy” or that appears in a news story
- It thinks is professionally relevant
- Exists on a government website or other official source of information
It’s also worth mentioning that even after Google removes your personal data from its search results, that doesn’t mean it’s removed from the web. Anyone, including hackers, will still be able to find it if they go to the original websites that published it. Your private data will also still be visible on social media and on search engines other than Google.
This means that to achieve true privacy, you’ll need to go to each site where your personal information exists and ask the site owner to delete your data. Of course, site owners aren’t always legally required to do so, as only California, Colorado, Virginia, and Utah have passed comprehensive consumer privacy laws.
Moreover, protecting your private information can be a challenge even with these privacy laws. In fact, Consumer Reports recently did a study that found that 62% of the time, people submitting “do-not-sell-my personal-data” requests under the California Consumer Privacy Act (CCPA) either couldn’t figure out how to submit the request or had no idea whether it had worked.
It’s especially hard to get your personal information off data broker sites (also called people-search sites), which make money scraping your data from across the web and selling it to others. These sites often intentionally hide their removal instructions or make the steps you need to complete overly complex and thus difficult to follow.
How to remove your data
Alongside its official notice about its updated removal policy, Google announced a new tool that will streamline the request process. However, this tool is still under development.
Until this tool becomes available, you can take the following steps to get Google to delete your data:
- Scroll about halfway down the page and click on the blue “Start removal request” button.
- Click “No, I prefer not to” under “Have you contacted the site’s website owner?”
- Select the first option: “Personal info, like ID numbers and private documents” under “I want to remove.”
- Then, select the best option that best describes the type of personal information you want to remove. For example, if a website is displaying your phone number, you’d select “Contact information, like address, phone number, or email address.”
- Check the box if the content in question is live on the website. If it isn’t, then you should use Google’s Outdated Content Removal tool instead of this form.
- Answer “yes” or “no” depending on whether your contact information is being shared to dox you (share your information with an intent to harass or harm you).
- Enter your name, country of residence, and email address in the “Personal Information” fields. (You can only submit takedown requests for yourself or a person you officially represent.)
- Under “Removal request,” enter the URL(s) of the site(s) hosting your content or the URL(s) of the image(s) you want to remove, as well as the URL(s) of the search results that contain the links to those site(s).
- Next, click “+ Choose file” to upload screenshot(s) of the personal information as it appears on the URL(s).
- Then, enter the query terms (like your full name, maiden name, or nickname) you used to bring up the personal information in the search results. Enter one term per line.
- Enter any additional information you think would provide more context.
- Check the box to verify that everything you’ve entered is correct.
- Click “Submit.”
Google will send you a confirmation email to let you know it has received your removal request. However, it’s still unclear how long Google will take to process submissions.
What does Google do after you submit a removal request?
A mixture of human moderators and AI (artificial intelligence) algorithms review all personal data removal requests. Depending on whether Google decides the data in your removal request is of public interest, it might do one of three things:
- Remove the offending URL(s) for all searches—Google will do this for sensitive information like credit card numbers, bank accounts, confidential IDs, etc.
- Only remove the offending URL(s) for searches of your name—Google does this when the webpage with your personal information also contains data about other individuals or information Google deems to be of public interest.
- Reject your request—If Google won’t delete your private information, you can try resubmitting your request. Google allows multiple resubmissions.
Regardless of its decision, Google will provide a brief explanation of its action or lack of action.
*****
Submitting a personal information removal request is a great first step towards taking control of your privacy, but to fully protect yourself, you need to remove your data from the sites that are publishing it in the first place. You also need to continuously monitor the internet to quickly address any new personal information as it appears.
As this can often be a time-consuming process, many people turn to automated solutions, like ReputationDefender’s suite of privacy products, which identify where your information is posted, go through each site’s opt-out process, and perform routine scans to ensure your data remains hidden.
If you have any questions about our products or just want a professional opinion about your particular privacy situation, give us a call. We are happy to provide free advice.