Sites Are Accused of Privacy Failings

By JULIA ANGWIN

Getting personal information removed from websites that collect it can feel a lot like playing Whac-a-Mole.

David Cox, a businessman from Tulsa, Okla., got his name, address and other personal details removed from the online background-check website BeenVerified.com, but his success was temporary. He submitted his first request for removal in April, using a service called "DeleteMe" from Boston privacy start-up Abine Inc., and it was almost immediately honored. But four months later, in August, his information popped up again on the website—forcing him to submit another request.

"It should be illegal," Mr. Cox said in an interview. "It should never reappear on there again."

BeenVerified.com said the reappearance of Mr. Cox's information was a mistake, but concedes that sometimes data about individuals resurface when the company adds new data to its system. "We need to figure out a way to do better," said Josh Levy, founder of the four-year-old New York start-up BeenVerified Inc.

Mr. Cox's experience isn't unusual in the unregulated world of people-search websites. Reputation.com Inc., which sells a subscription service removing people's data from such sites, reports that on average about 10% of the records it has removed reappear every day, forcing it to submit new removal requests.

"It's very difficult to get out and stay out," says Michael Fertik, chief executive of Reputation.com.

Hundreds of websites make personal data available online, ranging from the free phone and address listings on Whitepages.com to the $49.95 background reports sold by Intelius Inc. These sites generally obtain publicly available data, such as phone books, postal records, property and vehicle listings, and court records.

Lawmakers and regulators are trying to do more to address consumer concerns. There is no U.S. law, as there is in Europe, requiring companies to allow people to view or delete their personal data on file at an institution. Last year, Sens. John Kerry (D., Mass.) and John McCain (R., Ariz.) introduced legislation that would require most data brokers to let people view and make corrections to the personal data stored about them. The White House is expected to call for similar rights when it releases its "Privacy Bill of Rights" later this year.

The Federal Trade Commission has recently increased scrutiny of some background-check providers. Last week, the agency sent letters warning three marketers of mobile apps that provide background checks that they might be violating the Fair Credit Reporting Act. The act says that if an individual's personal data are used to deny them a job, a loan, housing or other important benefit, the individual must be given an opportunity to view the data and dispute its accuracy. In its warning letters, the agency said it hadn't yet determined if the apps were violating the law.

Last month FTC Commissioner Julie Brill called on data brokers to provide consumers with better visibility into the personal data that are collected and sold by data brokers.

The agency also has stepped up enforcement of companies that don't honor privacy promises. Two years ago, the agency forced the online people directory, US Search Inc., to refund nearly 5,000 people who had paid to remove their records from the site but whose information wasn't completely removed. Last year, the agency forced online advertising company Chitika Inc. to delete data it had collected from people who tried to opt-out but were unaware that Chitika's opt-out expired after 10 days.

"If a company offers an opt-out, then they can't misrepresent what they are offering," said Anthony Rodriguez, staff attorney for the FTC.

Companies that sell data about individuals online say it is difficult to completely remove people's information from their sites because personal records are difficult to match. An individual's middle name may be included in some records and not others, or records for the same person can contain different addresses.

Jim Adler, chief privacy officer for Intelius, which operates people search websites including USSearch.com, Zabasearch.com and PhonesBook.com, said it is particularly difficult to remove the records of people with common names, people whose addresses change, or women who have changed their name after marriage.

"We're not in a set and forget-it world," he said. "People have this expectation that they can opt out and never check it again and that's not a reasonable expectation."

But Sarah Downey, an attorney at Abine, the privacy start-up, argues that it is deceptive for websites to promise removal if they can't deliver it. Ms. Downey has filed a complaint against BeenVerified with the FTC, alleging that the site reinstated information of eight of Abine's DeleteMe customers approximately three months after their removal requests were initially honored.

Ms. Downey said that of all the websites she monitors for customers for Abine's $99-a-year DeleteMe service, BeenVerified was the only one where records consistently popped back up.

That includes her own personal information, which she said reappeared on BeenVerified a few months after she opted out. When Ms. Downey called to complain, she said the customer-service representative told her: "Oh, you should have asked them to remove you permanently."

Mr. Levy of BeenVerified said that his company aims to remove customers completely but that many of the Abine customers had different addresses or other information that caused BeenVerified to be unaware that it was the same individual's data.

Mr. Levy added that BeenVerified has been overwhelmed by its explosive growth in the past four years. Revenue from the company's $20 background-check business swelled from $500,000 in 2009 to $11 million in 2011. Based in New York, BeenVerified has 16 employees and recently opened a customer-service center in Cleveland.

"We have a lot of ambitions to do things better," Mr. Levy said. "But we're still the smaller guy in the space."

Write to Julia Angwin at julia.angwin@wsj.com