Nobody hacked you. The profile a people-search site displays under your name — the address history, the phone numbers, the relatives, the "possible associates" — was assembled legally, from two supply lines: public records that anyone can pull, and a wholesale data market you have never knowingly interacted with. When the Federal Trade Commission studied nine data brokers for its 2014 report Data Brokers: A Call for Transparency and Accountability, it found they held "billions of data elements covering nearly every U.S. consumer." One broker in the study maintained 3,000 data segments on nearly every American; another was adding roughly three billion new records to its databases every month. That was more than a decade ago, before retail media networks, identity graphs, and data clean rooms industrialized the pipeline further.
But there is a second, stranger answer to the question in the title, and it is the one this article is really about: at the level of your specific profile, the question cannot be answered — by you, by a journalist, or by a regulator. No people-search site publishes its supplier list. No law requires one to. The FTC recommended in 2014 that Congress force people-search brokers to disclose their sources; Congress never acted. The asymmetry is total: the industry can trace you across four decades of addresses, but you cannot trace a single field of your own profile back one step.
What can be reconstructed — from regulator reports, court records, corporate filings, and the companies' own marketing to their business customers — is the anatomy of the supply chain as a system. That is what follows: where the industry came from, the four supply tiers feeding it, the loophole that keeps its best data flowing, the deaths that produced its only real regulations, and what an individual can actually do standing at the end of the pipe. Every factual claim is cited to a primary source, because this industry's history is strange enough that it doesn't need embellishment.
Before the internet: the mailing-list century
The data broker industry is not a child of the internet. It is a child of the mailing list, and it is old enough to collect Social Security.
Acxiom — for decades the largest consumer data company on earth — was founded in 1969 in Conway, Arkansas, as Demographics, Inc., building mailing lists for the Democratic Party before expanding into general list-processing. By the 1980s, an entire ecosystem of "list brokers" bought, sold, rented, and enhanced files of names and addresses; catalog retailers pooled their customer files into cooperative databases so that everyone's customers became everyone's prospects. The largest of these co-ops, Abacus Direct, aggregated purchase histories from thousands of catalogs into what was then the biggest proprietary database of consumer buying behavior in the country.
What happened to Abacus in 1999 is the industry's founding parable, because it marks the exact moment the offline and online data worlds tried to merge — and the last moment anyone in power flinched. That year, the online ad company DoubleClick bought Abacus for roughly a billion dollars in stock, then disclosed plans to link Abacus's real-name catalog purchase histories with DoubleClick's "anonymous" web-browsing cookies. The reaction was ferocious: an FTC investigation opened, class actions were filed, and within weeks DoubleClick retreated, its CEO publicly calling the plan "a mistake." The FTC closed its investigation in early 2001, finding no violation — there was no law to violate — but the message stuck for a few years: connecting your real identity to your behavioral data was a line.
Here is the punchline. The line did not hold; it did not even bend — it was simply repriced. Abacus itself was later sold to Alliance Data and became part of Epsilon, where the co-op still operates today: Epsilon's own page for the Abacus Alliance describes "250+ multi-channel brands" contributing transactional data every week. And the thing DoubleClick apologized for attempting in 2000 — joining real-world purchase identity to online behavioral profiles — is now the explicit, marketed function of "identity resolution" platforms, data clean rooms, and every retail media network in America. What triggered a federal investigation twenty-five years ago is today a $62 billion line item. Nothing about the underlying privacy calculus changed; only the norms did.
Keep that trajectory in mind as we walk the modern supply chain, because it explains its shape: each tier below is an old, once-bounded data practice that quietly lost its boundary.
Tier 1: Public records — individually civic, collectively a dossier
The visible layer of the supply chain is public records: property deeds, county court filings, marriage and divorce indexes, voter registration rolls, professional and business licenses, bankruptcies, liens, and judgments. Each record class is public on purpose, and the purposes are genuinely good ones — you should be able to verify who owns the house next door, whether your contractor is licensed, and what your county's courts are doing in your name. Open records are an accountability technology, and the people-search industry's most honest argument is that it did not make any of this public.
What the industry did was defeat the practical obscurity that made open records tolerable. A property deed filed in a county recorder's office in 1995 was public in theory but protected in practice by the cost of finding it: you had to know which county, drive there, and ask. Aggregation abolished that cost. People-search sites are, in the technical sense of the term, aggregators — they rarely originate anything; they bulk-acquire scattered records and merge everything matching a name into one report, sold on subscription. The product is not the records. The product is the join.
The join is far more powerful than intuition suggests, and there is a famous number that proves it. In 2000, computer scientist Latanya Sweeney demonstrated that 87 percent of the U.S. population — 216 of 248 million people, using 1990 census data — could likely be uniquely identified by just three attributes: five-digit ZIP code, gender, and date of birth. Three fields that each feel harmless, that appear in thousands of "anonymized" datasets, and that together function as a fingerprint. Sweeney's result is the theoretical foundation of the entire merging industry: it means that once a broker holds a few mundane fields about you, nearly everything else ever recorded about you can be matched in. It also means every subsequent claim you will hear about "anonymized" or "de-identified" data — and you will hear it in every tier below — deserves to be met with that number.
Still, public records alone cannot explain what your listing contains. Your cell number was never in a courthouse file. Your email address is not on a deed. Your last four addresses, in order, with move-in dates? No county holds that. For those, the supply chain runs through a different door.
Tier 2: The wholesale layer — brokers that sell to brokers
Behind the consumer-facing sites sits a business-to-business market whose largest firms most Americans have never heard of, which is remarkable given what they hold. The U.S. Senate Commerce Committee's 2013 investigation of the industry concluded that data brokers collect "a huge volume of detailed information on hundreds of millions of consumers," sort them into marketing segments — including segments explicitly built around financial vulnerability — and "operate behind a veil of secrecy." A decade later, the veil is intact; only the volumes have grown.
The marketing-data giants. Acxiom — since 2018 a unit of the advertising conglomerate IPG — describes its own reach as data on 2.5 billion addressable consumers across 62 countries, with a catalog of more than 10,000 audience attributes. (A necessary correction to a figure that circulates widely: the 10,000 attributes are the size of Acxiom's global catalog, not a per-person count — though the distinction is cold comfort.) Epsilon operates the Abacus cooperative described above, plus loyalty and email infrastructure for major retailers. And Epsilon supplies the tier's essential cautionary tale: in January 2021, Epsilon Data Management entered a deferred prosecution agreement with the Department of Justice and agreed to pay $150 million after its direct-to-consumer unit spent nearly a decade — July 2008 to July 2017, per the DOJ — knowingly selling lists of consumers, disproportionately elderly, to clients running fraud schemes. Read that carefully: the misconduct was not a leak or a hack. It was the product, sold to the wrong customers, on purpose, for years. When the supply chain's incentives point toward selling, "who's buying?" is a question that answers itself last.
One giant has already walked away. Oracle spent years assembling an advertising-data empire (its Oracle Data Cloud absorbed Datalogix, AddThis, and BlueKai, among others), then wound the entire business down in 2024 — the same year it agreed to a $115 million settlement of a class action alleging it had built "digital dossiers" on hundreds of millions of people. Oracle denied wrongdoing, but the sequence — legal exposure rising, margins thinning, exit — is worth noting as the first case of a tier-two giant deciding the data-broker business was no longer worth its risk.
The risk-and-records aggregators. CoreLogic dominates property intelligence: deeds, mortgages, valuations, hazard data — the layer that ties identities to real assets. LexisNexis Risk Solutions fuses public records with credit-derived identifiers into risk products sold to insurers, collections firms, employers, and government agencies; it is arguably the deepest single file on the average American outside the credit bureaus themselves. It also descends, in part, from the industry's first great scandal: ChoicePoint, the Georgia broker that in 2005 admitted identity thieves posing as legitimate businesses had simply opened accounts and purchased files on more than 163,000 consumers. The FTC's resulting settlement — a $10 million penalty, then the largest in the agency's history, plus $5 million in redress — established the precedent that brokers must vet their buyers. ChoicePoint was subsequently acquired by Reed Elsevier and folded into LexisNexis Risk Solutions, where its files live on.
The phone layer. Reverse-phone lookup — the feature that lets a people-search site map a number to a name — runs on carrier-derived databases maintained by specialist aggregators. The largest, Neustar, was acquired in December 2021 by the credit bureau TransUnion for $3.1 billion. Sit with that transaction for a moment: a consumer credit bureau bought the company that knows which phone numbers are live, whose they are, and when they change. The supply chain's tiers are not merely adjacent; they are consolidating into single owners.
The credit-header loophole: a fifty-year policy failure in four acts
If one dataset explains why a people-search profile nails your exact address chronology, it is this one — and its legal history is the clearest single illustration of how American privacy law actually works.
The top portion of your credit file — name, aliases, current and former addresses, date of birth, phone numbers, Social Security number — is called the credit header. It is the most accurate identity data in existence, because you curate it yourself: every credit application you have ever submitted updated it, truthfully, under penalty of being denied credit. And for fifty years it has flowed out of the credit bureaus through a gap between two statutes.
Act one (1970): The Fair Credit Reporting Act regulates "consumer reports" — data bearing on creditworthiness, used for credit, employment, insurance, and similar decisions. Regulators long treated the identifying header fields as falling outside that definition, so the bureaus could license them freely to marketers, private investigators, and people-search compilers. The most sensitive file in America was regulated; its table of contents was not.
Act two (1997–2001): Under public pressure, the industry tried self-regulation. Fourteen companies formed the Individual Reference Services Group and adopted voluntary principles, which the FTC dutifully endorsed in a report to Congress. The IRSG then disbanded in 2001, on the stated theory that the new Gramm-Leach-Bliley Act made self-regulation unnecessary. Industry self-regulation of data brokers thus lasted approximately four years, and ended by its own motion.
Act three (1999–2002): Gramm-Leach-Bliley did partially close the gap. The FTC classified credit-header data as "personally identifiable financial information," and when Trans Union sued, the D.C. Circuit upheld the rule (Trans Union LLC v. FTC, 295 F.3d 42 (D.C. Cir. 2002)). That ended the bureaus' bulk sale of headers for marketing. But GLBA's exceptions — fraud prevention, identity verification, legal compliance — left the other doors open, and the people-search and risk industries walked through them. The same field, leaving the same bureau, is forbidden or permitted depending on the label on the box.
Act four (2024–2025): The Consumer Financial Protection Bureau proposed a rule in December 2024 that would have treated data brokers selling credit-header identifiers as consumer reporting agencies, pulling the whole flow inside FCRA. Five months later, the agency withdrew it, stating the rulemaking was "not necessary or appropriate at this time."
Fifty years, four attempts, and the loophole stands. There is no consumer opt-out for credit-header data — you cannot ask Experian, Equifax, or TransUnion to stop licensing your identifying information for "verification" purposes — and every accurate address on your people-search profile is the downstream evidence.
Regulation by obituary
Here is a pattern you cannot unsee once you notice it: essentially every American law that restricts data brokers is a memorial. The industry has never been regulated prospectively, as a system; it has been regulated retrospectively, one death at a time.
Rebecca Schaeffer, 1989. A 21-year-old actress was murdered at her Los Angeles door by a stalker whose private investigator had obtained her home address from California DMV records. Congress responded with the Driver's Privacy Protection Act of 1994, restricting the sale of motor-vehicle records — the first federal statute aimed at a specific supply line feeding what we would now call data brokerage.
Amy Boyer, 1999. A 20-year-old New Hampshire woman was murdered at her workplace by a stalker who had purchased her Social Security number and employment address from a data broker called Docusearch — which had obtained the workplace by having a subcontractor place a pretext phone call to Boyer herself. In Remsburg v. Docusearch (2003), the New Hampshire Supreme Court held that an information broker owes a duty of reasonable care to the person whose information it sells, because stalking and identity theft are foreseeable risks of the sale. It remains one of the few judicial statements anywhere that selling a person's data creates responsibility toward that person — and it took a murder to produce it.
Daniel Anderl, 2020. The 20-year-old son of U.S. District Judge Esther Salas was shot dead at the family's New Jersey home by a litigant who had assembled the judge's home address from online sources. New Jersey enacted Daniel's Law within months, giving judges, police, and prosecutors the right to demand brokers delete their home addresses — with damages for noncompliance. The 2023 amendments made claims assignable, and in early 2024 a company called Atlas Data Privacy Corp., as assignee for roughly 19,000 covered persons, sued about 140 data brokers at once. The brokers' consolidated First Amendment challenge failed at the district court in November 2024 — the law was held constitutional, though the ruling is now on appeal at the Third Circuit. Watch that litigation: it is the first time the supply chain has faced mass liability for what it publishes, and the industry is treating it accordingly.
Three laws, three graves. The pattern matters for a reason beyond its grimness: it reveals what the political system considers the threshold of action. Continuous, ambient exposure of 250 million people's addresses does not clear the bar. A murdered actress, a murdered student, a murdered judge's son — each cleared it locally, once. The supply chain is legal not because anyone decided it was safe, but because its harms are usually distributed too thinly to produce a name and a date. This is the same structural failure that has kept a comprehensive federal privacy law from passing for half a century.
Tier 3: The loyalty pipeline — how your groceries meet your identity
The newest and fastest-growing supply line runs through the checkout lane, and it is worth understanding precisely, because it is the tier you feed most directly and most often.
When you key in your rewards number, the transaction does not stay at the store. The mechanics, per the participating companies' own documentation, run like this:
- You identify yourself — a loyalty ID, a phone number at the keypad, the card you pay with.
- The retailer converts your email or phone number into a hash, a scrambled identifier marketed as anonymization.
- The hash is matched inside a "data clean room" — infrastructure such as LiveRamp's retailer clean room, whose own documentation describes ingesting hashed emails and loyalty IDs and resolving them to persistent identity-graph keys shared across companies. (Corporate genealogy note, because it is telling: LiveRamp is the former Acxiom Corporation — in 2018 it sold the Acxiom marketing business and name to IPG and renamed itself after its identity-matching division. The 1969 mailing-list company's direct descendant is now the connective tissue of the clean-room economy.)
- Your purchase behavior, joined to your identity, becomes sellable audience data — and revenue: retailers now operate "retail media networks" that monetize exactly this join, a business eMarketer projects at $62.8 billion in U.S. ad spending in 2025.
The "anonymized" framing in step two deserves to be retired, and the demolition is a matter of public record. Princeton researchers showed in 2018 that hashed email addresses are trivially reversible: every plausible address can be hashed and matched for a fraction of a cent, and companies at the time openly sold hash-reversal as a service. A hashed email is not anonymity. It is a persistent identifier wearing a costume — Sweeney's 87 percent, industrialized.
None of this is hypothetical plumbing, and it is not hidden — it is marketed, just not to you. Epsilon's own client case studies name the loyalty programs it powers and monetizes: Walgreens' myWalgreens (105 million active members), Ulta Beauty's Ultamate Rewards, Ahold Delhaize USA's grocery retail-media operation (Food Lion, Stop & Shop, Giant), The Container Store, and DSW. The pharmacy aisle is instructive about how close to sensitive territory the model runs: CVS's retail-media arm describes ExtraCare loyalty data, on its own insights page, as "the lifeblood" of its ad campaigns, and CVS's privacy policy discloses sharing purchase history with "marketing, analytics and research partners" — prescriptions excluded, but the wellness purchases around a prescription paint their own picture. And where independent auditors have looked closely, the picture matches: Consumer Reports' 2025 investigation of Kroger found the grocer building extensive profiles of loyalty-program members — inferred attributes included — as an asset in its own right. The honest way to describe a modern loyalty program is a data-contribution agreement with a discount attached; almost no one would sign it if it were titled that way.
The newest input: the car itself
One supply line deserves its own mention because it shows the model metastasizing into physical infrastructure. A modern car is a sensor platform with a subscription attached, and the data it generates has already entered the brokerage economy. In August 2024, the Texas Attorney General sued General Motors, alleging that since 2015 GM had collected detailed driving-behavior data on more than 1.8 million Texans — enrollment steered through the dealership "onboarding" process — and sold it onward, including to insurers who used it to price policies. It was the first state action of its kind, and it followed Mozilla's September 2023 review of 25 car brands, every single one of which failed Mozilla's privacy criteria — with 84 percent stating in their own policies that they may share or sell driver data. The wholesale tier is ready to receive it: Acxiom's automotive marketing page advertises unifying "online research, media exposure, dealer visits, and purchases" into identity profiles, and claims eight of the ten largest automotive companies as clients. The car is becoming a loyalty card that knows where you drove, and the supply chain has already priced it.
The location layer: where "anonymized" went to die in public
If the loyalty pipeline shows the supply chain at its most banal, the location-data layer shows it at its most dangerous — and it is the one tier where regulators have recently drawn actual blood, which makes it a useful case study in what enforcement looks like when it finally arrives.
The mechanics: thousands of smartphone apps embed location-collecting software development kits; the SDK vendors aggregate the resulting movement histories — pseudonymous, in theory — and sell them onward. What that meant in practice became a matter of record through a string of incidents. In 2020, Motherboard documented that X-Mode was collecting location data through apps including Muslim Pro — a prayer-times app with tens of millions of downloads — and selling it to defense contractors serving the U.S. military. In 2021, a Catholic newsletter used "commercially available" app-signal data from Grindr to identify and out a senior priest, tracing his device across locations over years; he resigned within days. No hack, no subpoena — a purchase.
The FTC's response, when it came, arrived in a cluster: a January 2024 order against X-Mode/Outlogic imposing the agency's first-ever ban on selling sensitive location data; a parallel order against InMarket the same month; a December 2024 order against Gravy Analytics and its Venntel unit — notable because Venntel's customers included government agencies buying their way around warrant requirements; and, after nearly four years of litigation, a May 2026 settlement banning Kochava from selling sensitive location data without express consent. And in a fitting coda, Gravy Analytics itself was breached in January 2025, with a hacker claiming terabytes of location data drawn from thousands of apps.
Note what the FTC orders concede by their own shape: the agency banned the sale of sensitive location data — visits to clinics, churches, shelters — company by company, under its general unfairness authority, because no statute gives it more. Everything short of that line, from everyone not yet sued, remains for sale.
The quiet tiers: utilities, telecom, and the exchanges you've never heard of
Two smaller supply lines round out the picture, and both illustrate how far the exchange model reaches. The National Consumer Telecom & Utilities Exchange (NCTUE) is a member-owned data pool where telecom, pay-TV, and utility companies contribute customers' account and payment histories; the database is operated under contract by Equifax. Most Americans have never heard of it, yet it functions as a shadow credit file — your relationship with your power company, searchable by members. Similar cooperative exchanges exist for check-writing histories, subprime lending, and rental payments. The pattern generalizes: wherever companies hold parallel files on the same people, someone has built an exchange to pool them — because pooled, the data is worth more than the sum of its silos. The supply chain is not a pipeline so much as a network of these joins, each individually obscure, collectively comprehensive.
What happens when the warehouse fails
Everything above describes the supply chain working as intended. Two incidents, nineteen years apart, show what its failure modes look like — and how little changed between them.
ChoicePoint, 2005, you have already met: criminals didn't breach the warehouse, they subscribed to it, and walked out with 163,000 files through the front door. The FTC's settlement forced the industry to vet buyers.
National Public Data, 2024, is the modern rhyme, and it is worse in every dimension. NPD was a people-search back-end operator — a supplier to other lookup sites — run by a tiny Florida company, Jerico Pictures. In 2024 its database turned up for sale on a criminal forum, advertised as "2.9 billion records." The number-laundering that followed is itself a lesson in this industry's opacity: the 2.9 billion was rows, not people; researcher Troy Hunt's analysis of the leaked files found 134 million unique email addresses; Krebs on Security reported an independent count of roughly 272 million unique Social Security numbers; and the company itself, in its official breach disclosure, admitted to 1.3 million affected people — a figure smaller than the researchers' by two orders of magnitude. Then, in October 2024, Jerico Pictures filed for bankruptcy, listing total assets between $25,000 and $75,000.
Let the asymmetry of that sentence land: a company with less than the price of a car in assets held Social Security numbers on a large fraction of the American population, lost them, and dissolved — leaving no one to sue, no one to fine, and no one to compel remediation. The supply chain has no minimum capital requirement, no licensing regime, and no financial-responsibility rule. Any entity that can scrape and store is qualified to warehouse the identity data of a nation, and when it fails, the losses are borne entirely by the people in the files — who were never its customers and never consented to be its inventory.
The provenance problem: the one question the law never forces
Which brings us back to this article's central asymmetry, because now you can see its full shape.
Every tier above is documented at the category level — by the FTC, the Senate, the courts, the companies' own B2B marketing. But try to move from category to instance. Which suppliers feed the specific profile of you on a people-search site? PeopleConnect — operator of TruthFinder, Intelius, and Instant Checkmate — discloses, in its Intelius brand's privacy policy, that it collects "Publicly Available Information or Public Data from various databases, government entities, commercial data providers, and websites to create our reports." Which commercial data providers is nowhere stated, in that policy or any other. Supplier relationships are trade secrets, wrapped in NDAs, invisible even to regulators between enforcement actions.
This is not an oversight; it is the industry's load-bearing wall, and it has been identified as such for over a decade. The FTC's 2014 report specifically recommended that Congress require people-search brokers to "disclose the original sources of their information so consumers can correct it" at the source. Congress never acted on it. The state-level transparency laws that did pass — Vermont's first-in-the-nation broker registry in 2018, California's registry in 2019, and California's Delete Act in 2023 — require brokers to register their existence and, in California, to honor deletion. None requires disclosure of provenance. You can now, in one state, order a broker to delete your data. You still cannot, in any state, ask it where the data came from.
Our own analysis of the 2024 compliance filings brokers submitted to California's registry suggests how lopsided the resulting system is in practice: marketing-tier brokers granted essentially every deletion request they received (direct-mail brokers denied a fraction of one percent of more than a hundred thousand requests), while brokers holding the most consequential data — the financial and credit tier — denied nearly all of them, lawfully, by invoking the same FCRA and GLBA carve-outs traced above. The deletion rights stop precisely where the exemptions begin. Meanwhile roughly a quarter of registered brokers reported receiving zero requests all year: the registry exists, but almost nobody knows to use it.
The result is a one-way mirror, and it is worth stating as a principle, because it is the single most accurate answer to the question this article set out to address: the supply chain can see you completely, and you cannot see it at all. Every downstream harm — the stalker who buys an address, the error that migrates from file to file, the profile that resurrects itself after deletion — is a consequence of that one structural fact.
What you can actually do about it
Standing at the end of the pipe, an individual has real but bounded options. Ordered by leverage:
Start with the display layer, where results are visible. People-search sites are where the supply chain touches your life — where a landlord, a stalker, or a scammer actually finds you — and they accept opt-outs. The PeopleConnect Suppression Center clears TruthFinder, Intelius, Instant Checkmate, and US Search in a single request; our master removal guide covers the rest of the major sites one by one. This does not touch the wholesale layer, but it removes the assembled, searchable you — which is what most concrete harms require.
If you live in California, use DROP. The Delete Act's Delete Request and Opt-out Platform came online in January 2026, and as of this month brokers are legally required to process its deletion requests: one free request reaching every broker on the state registry. It is the strongest single privacy lever any American currently has — bounded by the registry's coverage and the exemptions noted above, but unmatched in breadth per minute of effort.
Hit the wholesalers that accept opt-outs. Two of the biggest do:
How to opt out of Acxiom
Acxiom offers a free consumer opt-out from its marketing-data products. Go to acxiom.com/optout, use the U.S. opt-out form (it routes through a OneTrust privacy portal), and submit the identifiers you want scrubbed — name, addresses, emails, phone numbers. Requests are stated to process within a couple of weeks. Two honest limits: the opt-out covers Acxiom's marketing products, and it cannot claw back data already delivered downstream.
How to opt out of Epsilon
Epsilon accepts consumer requests through its consumer-information page — choose the do-not-sell/opt-out option on its request form, or call the privacy line it publishes (+1-866-267-3861). As with Acxiom, this stops future sale from Epsilon's databases; it does not undo past distribution, and it does not remove you from the Abacus co-op's contributing retailers' own files.
Know where the wall is. LexisNexis restricts its public-records suppression to narrow categories — by its own eligibility language, "public and elected officials, including law enforcement officers, and private individuals who are facing a substantial risk of physical harm or who are victims of identity theft," with documentation such as a police report or protective order required. Credit-header data has no consumer opt-out at all — that is the withdrawn CFPB rule's unfinished business. And the exchanges, the co-ops, and the clean rooms take no requests from you, because you are not their customer; you are their commodity. Starving them at the source — paying without a loyalty ID, auditing app location permissions, declining the phone number at checkout — is the only lever, and it only stops future contribution.
Why removal is maintenance, not surgery
Understanding the supply chain explains the industry behavior that frustrates people most: re-listing. When you opt out of a people-search site, you remove the assembled profile. The supply lines keep flowing — the county keeps recording, the header keeps updating, the co-op keeps pooling — and the next refresh can regenerate a profile your old suppression never covered. Deleting the join while every input still runs is why opting out is a subscription-grade chore rather than a one-time fix; the profile is not a document but a query, and the query can always be run again.
That recurring chore is exactly what DelistMyData is being built to automate — filing removals across the people-search layer, verifying they actually took effect, and re-filing when the supply chain regenerates your listing. We're in pre-launch; join the waitlist for founding-member access.