$45 for a Death Sentence: How Data Brokers Enable Stalkers

On October 15, 1999, Amy Boyer left work at a dental office in Nashua, New Hampshire. She was 20 years old, working as a receptionist, planning her future. Liam Youens was waiting in the parking lot. Youens had been obsessed with Boyer since high school. He'd spent years tracking her online, documenting his stalking on a website, and planning her murder in explicit detail. The final piece he needed was her workplace address. He bought it from Docusearch, a data broker, for $45. Youens shot Boyer as she walked to her car, then killed himself.

The New Hampshire Supreme Court later ruled that Docusearch could be held liable—that "the risk of criminal misconduct is sufficiently foreseeable" when selling personal information to unknown buyers. It was a landmark decision. But here's what should haunt you: twenty-five years later, buying someone's home address, workplace, phone number, and daily patterns is easier and cheaper than ever. The industry that enabled Amy Boyer's murder didn't reform. It metastasized.

The Pervasive People Search Economy

It’s a grim reality: type virtually any name into a search engine, and within seconds, you'll be inundated with advertisements for "people search" websites. Services like BeenVerified, Spokeo, WhitePages, TruePeopleSearch, Intelius, and PeopleFinder, among dozens of others, operate on a simple premise: for prices ranging from free to a few dollars, they offer detailed dossiers on individuals.

What These Sites Uncover

These platforms typically provide a disturbing array of personal information, often with no verification of the buyer's identity or intent. This includes:

Contact Information: Current and past home addresses, cell and landline phone numbers, and email addresses.
Familial and Social Connections: Names of family members, known associates, neighbors, and roommates.
Professional and Financial Data: Employment history, property ownership records, and court records, which can include sensitive documents like divorce filings and restraining orders.
Digital Footprint: Social media profiles, providing a gateway to online activity and personal updates.
Basic Demographics: Age, birthday, and sometimes even fragments of Social Security numbers.

The Deceptive Marketing of Data Brokers

Companies like BeenVerified often market themselves as legitimate background check services. Their "Background Check FREE" features promise access to addresses, relatives, criminal records, property ownership, bankruptcies, and social media accounts. However, the disclaimer often found at the bottom of their pages—"BeenVerified does not provide private investigator services and this information should not be used for employment, tenant screening, or any FCRA related purposes"—reveals a calculated attempt to evade responsibility. This disclaimer is essentially an admission that they understand the potential for misuse and danger associated with the data they provide, pushing the liability onto the user.

The Existential Threat to Domestic Violence Survivors

The National Domestic Violence Hotline has long warned that stalking is frequently facilitated by "collecting information about you using public records, online search services, or hiring investigators." For individuals escaping abusive relationships, data brokers transform from abstract privacy concerns into direct, life-threatening dangers.

How Abusers Exploit People Search Sites

An abuser armed with access to people search sites can systematically re-establish control and inflict further harm by uncovering:

New Locations: The new address where a survivor has sought refuge.
Employment Details: The workplace where they are trying to build financial independence.
Support Networks: The names and addresses of family members or friends providing crucial shelter.
Children's Safety: The schools their children attend, compromising their safety.
Daily Routines: Patterns of life gleaned from social media check-ins, phone records, and other aggregated data.

Documented Devastation by Privacy Advocates

Organizations like EPIC (Electronic Privacy Information Center) have meticulously documented the devastating consequences of this data accessibility. Their findings highlight:

Housing Insecurity

Survivors often find themselves in a desperate situation where they must avoid purchasing or renting property to keep their addresses out of public records. This forces many into precarious living situations, including couch surfing, relying on temporary shelters, or even experiencing homelessness, all to evade discovery.

Barriers to Legal Protection

Court filings, which are essential for obtaining legal protections like restraining orders, become accessible data points. These filings are often scraped by data brokers, inadvertently revealing a survivor's location to their abuser and discouraging them from seeking the very legal remedies designed to protect them.

Ongoing Psychological Trauma

Even when an abuser has not successfully located them, survivors live under the constant, debilitating fear that data brokers will inevitably enable their discovery. The psychological burden of knowing that their safety is precariously balanced on the loopholes in a data broker's database is immense.

Undoing Years of Safety Planning

When survivors bravely manage to establish new, safer lives—finding new homes, securing employment, and building new relationships—a single data broker update or a determined search can instantly undo years of meticulous safety planning, plunging them back into terror.

The National Network to End Domestic Violence has been vocal about the dangers of people search sites for over 15 years. Their message remains tragically consistent: data brokers are providing essential tools that enable abusers to locate and harm their victims.

The Echo of Amy Boyer: Twenty-Five Years of Stagnation

The landmark ruling in the Amy Boyer case, which acknowledged the foreseeable risks of violence when selling personal information, should have been a watershed moment. A young woman was dead because a company prioritized profit over basic safety precautions. Yet, twenty-five years later, Congress has responded with... a deafening silence.

The Paucity of Federal Protection

There is still no federal law that effectively restricts the ability of data brokers to publish information that could be exploited by stalkers or facilitate harm to domestic violence victims. Crucially, there are no federal mandates requiring buyers' identities or intentions to be verified, nor any obligation for data brokers to remove information when victims report threats.

The industry, far from being chastened, has instead experienced exponential growth, while the number of victims has proliferated. The legal framework has remained stubbornly inadequate.

California's Partial Safeguard

The only significant legislative protection exists in California, where the "Safe at Home" program offers victims of stalking, domestic violence, and sexual assault the ability to request the removal of their personal information from people search sites. This program extends its protections to public safety officials, elected officials, and reproductive healthcare workers. However, this is a singular state initiative, offering only partial, opt-in protection.

Everywhere else, survivors are left to fend for themselves. They must individually submit opt-out requests to hundreds of data brokers, a painstaking process fraught with uncertainty. The hope is that each company will honor the request, but the reality is that new brokers launch constantly, and a single point of failure can have catastrophic consequences.

Navigating the Legal Gray Zone: Data Brokers' Defensive Strategy

People search sites operate within a complex and carefully curated legal gray zone, largely designed to shield them from accountability.

The FCRA Distinction

The Fair Credit Reporting Act (FCRA) imposes strict regulations on "consumer reporting agencies" (CRAs). CRAs are companies that compile information used for critical decisions like credit assessments, employment screening, housing applications, and insurance evaluations. Under FCRA, CRAs are bound by accuracy standards, must provide consumers with the ability to dispute errors, and must verify that buyers have legitimate purposes for accessing the data.

People search sites cleverly sidestep these obligations by asserting they are not CRAs. They claim they are merely providing "public information" for "personal use." Their ubiquitous disclaimers, stating that the information is "not for FCRA purposes," are strategically intended to avoid regulatory burdens while preserving their lucrative revenue streams.

The Consequences of This Legal Maneuver

This manufactured legal ambiguity results in an industry that:

Aggregates Extensive Dossiers: Compiles detailed personal profiles on nearly every American.
Sells Data Broadly: Makes this information available to anyone willing to pay, irrespective of their motives.
Avoids Accuracy Standards: Faces no legal requirement to ensure the accuracy of the data collected.
Offers No Meaningful Dispute Process: Provides no effective mechanism for individuals to correct errors or contest the presence of their information.
Ignores Buyer Intentions: Has no obligation to verify the purposes for which the data will be used.
Shifts Liability: Bears no responsibility when the information is used to cause harm.

When an individual uses a people search site to stalk an ex-partner, the site deflects blame, claiming ignorance of the buyer's intent. When an abuser discovers a survivor's hidden address, the data broker simply states they only provide "publicly available" information. In the tragic aftermath of a murder, the industry offers perfunctory condolences while continuing its operations unabated. The law, structured around an era before these commercial surveillance operations existed, has failed to keep pace, and the data broker industry actively lobbies to ensure it remains that way.

The Pernicious Fiction of "Publicly Available" Information

Data brokers frequently defend their practices by asserting that they merely aggregate "publicly available" information. They argue that anyone could theoretically find this data themselves; they simply make it more convenient. This defense, while technically accurate on a superficial level, is profoundly misleading and dangerous.

The Transformation of Information

It is true that property records are public, court filings are accessible, and voter registration information is available through various government channels. However, the crucial distinction lies in the friction involved in accessing such data. In the past, obtaining this information would require physically visiting county courthouses, spending hours sifting through paper records, and piecing together scattered data points. This inherent effort acted as a natural barrier, providing a degree of practical obscurity that offered protection.

Data brokers have systematically demolished this friction. They've created instantly searchable databases that are accessible to anyone, anywhere in the world, from their personal device. The "public" nature of the underlying records becomes irrelevant when their aggregation transforms disparate data points into a comprehensive targeting package.

As Beth Givens, founder of the Privacy Rights Clearinghouse, explained over two decades ago, "Providing access to public records on the internet alters the balance between access and privacy that has existed in paper and microfiche records." The convenience they offer comes at the immense cost of obliterated privacy and heightened danger.

The Private Investigator Pipeline: Deeper Surveillance

People search sites are merely the visible retail front of a far more extensive and sophisticated surveillance ecosystem. Behind these consumer-facing platforms lie professional-grade data brokers that cater to private investigators, skip tracers, and corporate investigators.

Access to More Sensitive Data

These "professional" services offer an even deeper dive into an individual's life, including:

Real-time Location Data: Acquired through partnerships with mobile applications that track user movements.
Utility Connection Records: Revealing current residential addresses.
Financial Account Information: Providing insights into banking and other financial activities.
Vehicle Registration and Movement Patterns: Tracking individuals through their vehicles.
Social Media Monitoring and Analysis: Offering detailed breakdowns of online presence and interactions.
Network Mapping: Visualizing relationships and associations between individuals.

While licensed private investigators may have legitimate uses for some of this data—such as locating witnesses for legal proceedings or investigating insurance fraud—the same tools are easily accessible to a far broader, and often less scrupulous, clientele.

The Ambiguity of "Legitimate Use"

This includes:

Estranged Spouses: Conducting invasive divorce surveillance.
Employers: Investigating employees' activities outside of work.
Individuals with Personal Grudges: Using the data for harassment or revenge.
Anyone Willing to Pay: The barrier to entry is simply financial.

The distinction between "legitimate" and "illegitimate" use is largely theoretical. Data brokers rarely, if ever, verify that private investigators are working on legitimate cases, and private investigators do not always confirm that their clients have justifiable purposes. The information flows freely to the highest bidder. In the tragic case of Amy Boyer, Liam Youens was not a licensed investigator; he was a stalker with a credit card, and Docusearch sold him the critical information he needed to commit murder.

Digital Stalkerware: The Sinister New Frontier

Beyond data aggregation, a parallel industry has burgeoned, offering "stalkerware." This is software designed to secretly monitor individuals' phones and computers, providing unfettered access to their digital lives.

Capabilities of Stalkerware

Applications marketed under names like "mSpy," "FlexiSpy," and "Cocospy" allow an individual with brief, physical access to a target device to install covert monitoring software. Once installed, the stalker gains the ability to:

Read all text messages and emails.
Track the target's real-time GPS location.
Listen in on phone calls.
Access photos and videos stored on the device.
Monitor social media activity and private messages.
Remotely activate microphones and cameras to eavesdrop and record.

Deceptive Marketing and Real-World Harm

While companies selling stalkerware often market it for "parental monitoring" or "employee oversight," their primary and most sinister use case is intimate partner surveillance. A 2020 study revealed that stalkerware was present on the phones of a significant percentage of domestic violence survivors seeking assistance. Abusers often install this software before a relationship ends, ensuring continued surveillance even after victims have fled.

While the FTC has taken some enforcement actions against stalkerware vendors for unfair and deceptive practices, the industry persists, often operating from overseas jurisdictions that are beyond the reach of U.S. regulations. The insidious synergy between data brokers and stalkerware is profoundly destructive: data brokers provide the initial targeting information—where someone lives, works, and who they associate with—while stalkerware enables ongoing, invasive surveillance, creating a devastating combination for victims.

Judges, Officials, and Public Figures: Targeted for Danger

Domestic violence survivors are not the only demographic endangered by the pervasive reach of data brokers. Public officials and their families are also at significant risk, as evidenced by a tragic incident in July 2020.

The Assassination of Daniel Salas

A man disguised as a FedEx driver appeared at the New Jersey home of federal judge Esther Salas. When her husband answered the door, the assailant shot and killed him, and then fatally shot their 20-year-old son, Daniel. The shooter, Roy Den Hollander, was a disgruntled attorney who had previously appeared before Judge Salas. He had located the judge's home address online, facilitated by the very data aggregation services that are now commonplace.

Daniel's Law and Targeted Protections

In the wake of this horrific event, Daniel's Law was enacted in New Jersey. This legislation allows federal judges, prosecutors, law enforcement officers, and their families to request the removal of their personal information from data brokers. Similar protections have been extended to other categories of public officials in various states.

The "Important Enough" Divide

However, the critical flaw in this system is that these protections are limited to specific groups of individuals who successfully navigate opt-out processes. For the vast majority of citizens, particularly those who lack the public profile or resources to assert their rights, the danger remains unabated. The message is stark: if you are important enough, you may receive protection. If you are an ordinary person—a domestic violence survivor fleeing an abuser, a victim of stalking, or someone with a troubled past relationship—you are left to fend for yourself.

The Congressional Stalemate: A Policy Choice

Despite the clear and present DANGERS posed by data brokers and people search sites, legislative progress in Congress has been remarkably slow. For years, proposals aimed at addressing these issues have been debated, but meaningful federal action has been minimal.

Attempts at Legislation

In 2021, Senators Amy Klobuchar (D-MN) and Lisa Murkowski (R-AK) urged the FTC to take action against people search sites and stalking. Simultaneously, Senators Klobuchar and Ted Cruz (R-TX) attempted to include provisions in the 2024 National Defense Authorization Act that would empower officials to remove their information from data brokers.

The Privacy vs. Journalism Dilemma

Civil liberties advocates, including the ACLU and the Freedom of the Press Foundation, have expressed concerns. Their primary worry is that overly broad restrictions on data aggregation could inadvertently impede legitimate uses of public records for journalism, academic research, and government accountability. This tension is real; journalists rely on public records to investigate corruption and expose wrongdoing, and researchers use data to understand societal trends. Transparency, in principle, is vital for an informed democracy.

The Current System's Failure

However, the current landscape fails to strike a balance between these interests; it effectively disregards victim safety altogether. People search sites are not primarily designed for journalistic endeavors; they are commercial products that profit from making individuals universally discoverable by anyone, regardless of intent. While a solution that safeguards legitimate public records access while simultaneously preventing the targeting of vulnerable individuals is entirely possible, Congress has consistently failed to prioritize its development. The substantial lobbying efforts of the data broker industry undoubtedly play a significant role in this legislative inertia.

The Opt-Out Nightmare: A Burden on Victims

In the stark absence of comprehensive legal protections, individuals are left to defend themselves through a torturous process of individual opt-out requests. This arduous undertaking often feels like navigating a bureaucratic labyrinth designed for failure.

The Kafkaesque Process

The typical opt-out journey involves a series of soul-crushing steps:

Identification: The first hurdle is identifying all the people search sites that possess your personal information. Given that hundreds of such sites exist, this is a monumental task in itself.
Navigating Unique Processes: Each website maintains its own distinct opt-out procedure, often buried deep within privacy policies or hidden contact forms.
Verification Burden: To prove you are who you claim to be and that you are entitled to remove your data, you are often required to submit identifying information—sometimes including the very sensitive data you are trying to suppress.
Waiting Game: Once requests are submitted, the processing time can range from several days to weeks, leaving individuals in prolonged uncertainty.
Verification of Removal: After the wait, individuals must meticulously verify that their information has actually been removed.
The Cycle Repeats: Data is dynamic; new sources constantly feed these databases, and information often reappears, necessitating the repetition of the entire process.
New Entrants: The constant launch of new data broker sites means the opt-out effort is never truly complete.

The Privacy Rights Clearinghouse offers a comprehensive opt-out guide, which, while informative, serves as a stark testament to the overwhelming nature of this task. The process can consume dozens of hours, requires regular re-application, and never guarantees permanent removal.

The fundamental injustice is that the burden of opting out of a demonstrably dangerous system falls squarely on the shoulders of potential victims. The default should be safety and privacy; instead, the default is exposure and vulnerability.

What You Can Do: Taking Proactive Steps

Protecting yourself in the current data landscape requires vigilance and ongoing effort. While systemic reform is desperately needed, there are concrete steps you can take to mitigate your exposure:

Proactive Information Management

Google Yourself Regularly: Perform regular searches of your name, enclosed in quotation marks, along with your city and state. This will help you identify which data brokers have your information.
Submit Opt-Out Requests Systematically: Begin by focusing on the largest and most prominent people search sites: Spokeo, BeenVerified, WhitePages, Intelius, TruePeopleSearch, and PeopleFinder. Locate and follow each site's specific opt-out procedure, often found in their respective privacy policies.
Utilize Automated Removal Services: Consider subscribing to services like ZoraSafe, DeleteMe, or Kanary. These platforms automate the monitoring and removal process, continuously working to reduce your online data footprint.
Limit New Data Exposure: Be extremely cautious about the personal information you share online. Whenever possible, use a P.O. Box instead of your home address for mail. carefully consider whether your voter registration should use your actual physical address, as this information is often publicly accessible.

Securing Your Digital Presence

Fortify Social Media Privacy: Thoroughly review and adjust the privacy settings on all your social media accounts. Disable location tagging for posts and be mindful of any location data embedded in photos or check-ins.
Protect Your Primary Phone Number: Consider using a Google Voice number or a similar service for any public-facing registrations or online sign-ups. This can help keep your primary mobile number private.

Seeking Help in Times of Danger

Contact the National Domestic Violence Hotline: If you are experiencing abuse or feel you are in danger, call 1-800-799-7233. They offer extensive resources and support specifically for technology-enabled abuse and digital safety planning.
Advocate for Legislative Change: Contact your elected representatives to voice your support for comprehensive federal privacy legislation. The current patchwork of state-level protections is insufficient to address the national scope of this problem.

The Unignorable Reality: A Systemic Failure

Amy Boyer was murdered twenty-five years ago. Her death was a direct consequence of a data broker selling her workplace address to her stalker for a mere $45. In the quarter-century since, the data broker industry has exploded into a multi-billion dollar behemoth. The sheer volume of personal information harvested and aggregated has grown exponentially, while the tools for tracking and locating individuals have become alarmingly sophisticated, inexpensive, and widely accessible.

The Perpetuation of Danger

During this same period, Congress has largely failed to implement meaningful protective legislation. Every single day, stalkers exploit people search sites to locate their victims. Abusers find the hidden addresses where ex-partners have sought refuge. Harassers identify workplaces, family members, and daily routines. This sensitive, personal information remains readily available to anyone willing to pay, often for less than the price of a cup of coffee.

The data broker industry refers to its practices as merely "providing public information." However, the reality is far more sinister: they are effectively operating as a targeting service for predators. While some victims are tragically murdered, countless others live in a constant state of fear. They are forced to relocate, remain hyper-vigilant, and live with the gnawing awareness that their hard-won safety is perpetually one database update away from being shattered. The psychological toll of this sustained anxiety is incalculable.

A Choice, Not an Inevitability

This grim reality is not an inevitable consequence of technological advancement. It is, fundamentally, a policy choice. Many other developed nations have enacted robust laws to protect their citizens from invasive commercial surveillance. The United States, however, has demonstrably prioritized the protection of the data broker business model over the safety and privacy of its own citizens.

Twenty-five years after Amy Boyer's senseless death, the question is no longer whether data brokers enable stalking and violence—that has been unequivocally proven. The pertinent question, the one that demands an answer, is how many more lives must be lost before we finally enact meaningful reform and hold these industries accountable for the harm they facilitate?

This is Part 9 of "Who's Buying Your Data?" — a 10-part investigation into the companies and organizations purchasing your personal information from data brokers. Next week: Hedge Funds & Wall Street.

Sources:

Remsburg v. Docusearch, Inc., 149 N.H. 148 (2003)
EPIC: Domestic Violence and Privacy: https://epic.org/privacy/domestic-violence/
National Network to End Domestic Violence: Data Brokers Fact Sheet: https://nnedv.org/wp-content/uploads/2021/05/NNEDV_DataBrokers_FactSheet_2021.pdf
Privacy Rights Clearinghouse: Data Brokers and People Search Sites: https://www.privacyrights.org/consumer-surveillance/data-brokers-and-people-search-sites
National Domestic Violence Hotline: Technology Safety: https://www.thehotline.org/resources/technology-safety/
Lawfare: People Search Data Brokers, Stalking, and 'Publicly Available Information' Carve-Outs: https://www.lawfareblog.com/people-search-data-brokers-stalking-and-publicly-available-information-carve-outs
FTC Enforcement Actions Against Stalkerware Companies: https://www.ftc.gov/news-events/news/press-releases/2023/01/ftc-actions-deter-stalkerware-companies-taking-consumers-privacy-personal-information-their-own-hands
Daniel's Law (New Jersey) and Federal Judicial Security Legislation: You can find information on Daniel's Law from various government and news sources, e.g., https://www.nj.gov/governor/news/news/562021/20210706a.html

Hashtags

#DataBrokers #PrivacyMatters #DigitalSafety #Cybersecurity #Stalking #DomesticViolence #DataProtection #OnlineSafety #PersonalPrivacy #ZoraSafe #StaySafeWithZora #ZoraProtects #PeopleSearch #Surveillance #ConsumerPrivacy