People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions

Type your own name into a people-search site some evening. There you are: middle initial, age range, the town you live in, the town you left, two relatives, and a phone number with the last four digits blurred. Beside it sits a button. "View full report." Click it and the page asks for a credit card, and the charge is for a monthly subscription that would let you look up anyone in the database, your dentist and your ex included.

You never signed up. Nobody asked you. And a question forms that has now occupied federal judges for six years: is that page a directory listing, which the First Amendment has protected since the phone book, or is it an advertisement that uses your name to sell something, which the law of most states has forbidden without consent for a very long time?

The fall of 2026 sharpened the question from both ends. On September 24, the Ninth Circuit affirmed certification of a class of an estimated 100,000 Californians whose names can be searched in the Classmates.com yearbook library, on a theory that being searchable is enough. About five weeks later, the Fourth Circuit held that a West Virginia statute protecting the home addresses of judges and police officers violates the First Amendment, in a suit against people-search companies, and described name-and-address lookups as a tradition of protected speech running back to the White Pages. Both opinions are published. Both are about the same kind of website. They do not conflict, for reasons this article explains, but anyone advising a person or a data company has to hold both in mind.

The short answer

• The theory that keeps winning at the pleading stage is narrow. Plaintiffs generally do not attack the database. They attack the free preview used to sell access to the database. Courts in Illinois, California, Ohio, Indiana, Nevada, and Washington have let that claim past a motion to dismiss, starting with Lukis v. Whitepages Inc., 454 F. Supp. 3d 746 (N.D. Ill. 2020).
• The theory that keeps losing later is the one with no audience. When discovery shows that nobody but the plaintiff's own lawyer ever triggered the display, several courts have ended the case: Hoffower v. Seamless Contacts Inc., 736 F. Supp. 3d 605 (N.D. Ill. 2024), Wilson v. Ancestry.com LLC (S.D. Ohio 2024), and Braundmeier (the Bonilla docket) (N.D. Ill. 2025). Server logs now decide cases.
• California is the current high-water mark, but it is a class certification ruling. Nolen v. PeopleConnect, Inc. (9th Cir. 2026) held that whether searchability alone is a use "directly connected" to advertising is a merits question for later. The panel did not hold that searchability is enough.
• Article III standing is split, and it depends on the stage. Most courts accept that an unconsented commercial use resembles the common law appropriation tort. A minority, reading TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) strictly, require disclosure to a third party.
• Section 230 has mostly failed as an early exit, with one prominent exception. Compiling and reformatting data into a sales funnel usually defeats immunity at the pleadings. Callahan v. Ancestry.com Inc. went the other way, and the courts also disagree on whether state publicity claims fall within the statute's intellectual property carve-out.
• Arbitration clauses have rarely stuck to non-users. A lawyer who opens an account to investigate does not automatically bind the client. Real account holders are a different story: in Nolen, four earlier named plaintiffs dropped out after it emerged that they had registered.
• Other legal tracks reach the same data. The Fair Credit Reporting Act applies if a site functions as a consumer reporting agency. Daniel's Law statutes protect covered officials, with New Jersey's law under constitutional review in the Third Circuit and West Virginia's struck down. California's Delete Act has required brokers to process deletion requests through a single state platform since August 1, 2026.
• If you want your listing gone, the fastest route is usually not a lawsuit. The companion guide, Removing Yourself From People-Search Sites and Evaluating a Publicity Claim: A Practical Guide, walks through it.

How these sites work, because the law now turns on the plumbing

A people-search business has four layers, and each has become a legal argument.

Ingestion. The company takes in records from public sources (property rolls, court dockets, voter files where permitted, professional license lists), commercial data vendors, and in some cases scraped web pages. One complaint quoted Whitepages as ingesting more than two billion records a month, a figure the court recited from the allegations in Lukis. The yearbook companies do something more physical: they buy or accept donated yearbooks, scan them, and run optical character recognition (software that converts page images into searchable text). The Nolen record notes that the software sometimes misses names, which is why some printed names are not searchable at all.

Entity resolution. Software then decides that the "S. Lukis" in one record and the "Stephanie M. Lukis" in another are the same human, and merges them into a profile. This step matters more than it sounds. The merged profile did not exist in any source record. It is the company's inference, and plaintiffs argue it is the company's own creation.

Rendering. Here the architectures diverge, and the divergence has decided lawsuits. Some sites generate permanent public profile pages in advance, one per person, which search engines index. Anyone who searches your name on Google may land on one without ever visiting the site's home page. Other sites hold records in a database and build a page only when a user runs a query. In that design, your "teaser" does not exist as a page until someone asks for it. In Hoffower, a suit over a sales-contact platform, the plaintiff's former lawyer was, on the undisputed record, the only person ever to click the "find" button for her name. Wilson's yearbook records could appear in a results list, but the pop-up advertisement appeared only when a visitor hovered over "view records," and the evidence was that nobody had.

The funnel. The preview hands off to a paywall. In Krause v. RocketReach, the complaint described the sequence screen by screen: a preview page with the line "Found phones: 4 available on +Phone plans," a link inviting the user to get direct dial numbers, a "View Plans Now" button, and plans priced by the number of lookups. In Nolen, the funnel was less direct. A visitor who clicked a thumbnail was prompted to register for a free account and then immediately shown an offer for a paid subscription (the parties called this the "sequence theory"), and free members saw banner advertisements beside search results (the "banner theory").

Keep those four layers in view. Standing, the "use" element, Section 230, and class certification each ask a different question about them.

The doctrine underneath: appropriation, statutes, and why a nobody can sue

William Prosser's 1960 article, Privacy, 48 Cal. L. Rev. 383, sorted the privacy cases into four torts. The fourth, appropriation of a name or likeness for the defendant's advantage, became the root of the modern right of publicity (the right to control commercial use of your identity). The New Jersey Supreme Court recited the taxonomy again in August 2026 in Atlas Data Privacy Corp. v. We Inform, LLC. The Right of Publicity Basics piece and the fuller treatment in The Right of Publicity: Name, Image, Likeness, Digital Replicas, and the Limits of Owning Yourself cover the general law. The standard reference is McCarthy and Schechter, The Rights of Publicity and Privacy, and Jennifer Rothman's The Right of Publicity: Privacy Reimagined for a Public World (Harvard University Press 2018) is the best account of how the right drifted away from its dignitary roots.

People-search suits run mostly on statutes, because statutes offer a floor on damages. A class of a hundred thousand is not interesting at actual damages of a few cents per person. It is very interesting at $750 or $1,000 each.

Why can an ordinary person, whose name would never sell a pair of sneakers, sue at all? Because the statutes do not say "celebrity," and because of a piece of logic the Ninth Circuit first stated in 1974 and repeated in Nolen: appropriating the identity of an unknown person may create value in what had none. Motschenbacher v. R.J. Reynolds Tobacco Co., 498 F.2d 821 (9th Cir. 1974). If your name helps move subscriptions, the company has told you what it is worth. In Nolen's phrasing, "a Joe Schmoe could not command the kind of multi-million-dollar endorsement deal" a celebrity might, yet it is reasonable to infer that even an average person could negotiate at least a nominal fee.

That inference is not universal. In LaFleur v. Yardi Systems, Inc. (N.D. Ohio Feb. 11, 2025), the court dismissed Ohio claims against PropertyShark, whose free property reports listed the plaintiffs as owners. The court held the use incidental: the names appeared only as accurate historical information, without implying any endorsement, and the plaintiffs had not alleged commercial value in their names. Ohio plaintiffs now face a split between that decision and the opposite treatment of similar arguments in Wilson v. Ancestry.com LLC (S.D. Ohio 2023) and Kellman v. Spokeo, Inc. (N.D. Cal. 2022). The Ohio appellate decision the parties usually fight over, Harvey v. Systems Effect, L.L.C., 154 N.E.3d 293 (Ohio Ct. App. 2020), involved informational slides about earlier litigation, not a website funnel, and it separates informative uses from promotional ones.

The teaser theory, from Dobrowolski to Lukis and beyond

The first wave lost. In Dobrowolski v. Intelius, Inc., No. 17 C 1406 (N.D. Ill. May 21, 2018), a court dismissed Illinois claims against sellers of background reports, reasoning, as later opinions describe it, that a person's identity is not used to promote a separate product when the identity is part of the product offered for sale. Think of a bookstore displaying the cover of a biography. Showing you what you are about to buy is not a celebrity endorsement of the book.

Judge Feinerman's 2020 decision in Lukis did not reject Dobrowolski. It distinguished it, and the distinction became the foundation of the field. Whitepages' previews advertised, he reasoned, not a report on Stephanie Lukis but a monthly subscription giving access to reports on anyone in the database. Using her identity for that was, in the opinion's words, "a textbook example under the IRPA of using a person's identity for a commercial purpose." He rejected the rest of the defendants' list in turn:

• Public records are no defense. The Illinois Act covers every aspect of identity whether it came from public or private sources.
• A common name does not make you unidentifiable. The previews tied the name to a middle initial, age range, addresses, and relatives, so a viewer could pick out the actual person.
• The exemptions for books, articles, and public affairs miss the target. The claim was aimed at the previews, not the reports. Whether a background report itself resembles a news article or a private investigator's file could not be resolved on the pleadings.
• Personal jurisdiction exists in Illinois. Whitepages drew data from Illinois government sources and marketed reports about Illinois residents.

Krause v. RocketReach, LLC (N.D. Ill. 2021) extended the reasoning to a sales-contact database, with the memorable description of the preview as information displayed "as bait to entice users to purchase subscriptions." Later courts have gone further and rejected the "separate product" requirement outright as unsupported by the Illinois text, as in Carrera, collecting cases. The theory has also reached business-to-business contact tools: Green v. Datanyze, LLC (N.D. Ill. 2024), LaRock v. ZoomInfo Technologies LLC (W.D. Wash. 2025), and Sant v. RocketReach LLC (W.D. Wash. 2025). The defendants there argue that professional details are not the stuff of publicity law. So far that has not worked at the pleading stage. In LaRock, ZoomInfo's argument that previews were merely "descriptive" under RCW 63.60.070 failed at the motion to dismiss.

The Seventh Circuit has set an outer limit. In Huston v. Hearst Communications, Inc., 53 F.4th 1097 (7th Cir. 2022), a magazine sold mailing lists containing subscriber data. The court held that the identity "must help sell something" and that an identity revealed only after the sale cannot have been used to sell. That cuts cleanly through this field. Information behind a paywall is not a use under the Illinois Act. Only what the prospect sees before paying can be. A careful plaintiff pleads the preview. A careful defendant redesigns it.

Worked example. Suppose Nell Abernathy, a school librarian in Peoria, finds a page on a hypothetical site called Quillon Records with her name, age, and city, plus "Phone: (309) 555-XXXX. Unlock for $24.95/month. Search anyone." Suppose a second hypothetical site, Fernhill Reports, shows the same facts but charges $3.99 for a one-time report on her alone. Under Lukis, Quillon is using her identity to sell something other than information about her. Fernhill is closer to Dobrowolski, though it may not stay there. Carrera suggests some courts will not follow the "part of the product" line at all, and if Fernhill's checkout also upsells a subscription, the distinction evaporates. If Fernhill's pages are permanent and indexed, the "use" issue is easy. If they exist only when someone searches, Nell's lawyer will need more than the lawyer's own screenshot.

Yearbooks: same plaintiffs, same facts, opposite rulings

The yearbook suits give the clearest view of how much depends on the judge. In late 2020, the same California plaintiffs sued Ancestry and PeopleConnect over substantially the same conduct. Their cases went to different judges in the same courthouse.

Magistrate Judge Beeler dismissed the Ancestry suit twice, the second time with prejudice. Callahan v. Ancestry.com Inc. (N.D. Cal. Mar. 1, 2021); Callahan v. Ancestry.com Inc., 2021 WL 2433893 (N.D. Cal. June 15, 2021). She held that using public yearbook data to solicit subscribers, standing alone, was not injury in fact without something more, like the implied personal endorsement in Fraley v. Facebook, Inc., 830 F. Supp. 2d 785 (N.D. Cal. 2011). And she held Ancestry immune under Section 230 because it did not create the yearbooks: "Adding an interactive button and providing access on a different platform do not create content. They just add functionality."

Judge Chen went the other way in the PeopleConnect suit. Callahan v. PeopleConnect Inc. (N.D. Cal. Nov. 1, 2021). He refused to give Judge Beeler's rulings preclusive effect, held that Section 230 immunity could not be decided on the pleadings because yearbook publishers might never have intended internet publication, and rejected the public affairs exemption for subscriptions ("only reprinted yearbooks potentially have a public affairs connection; the subscription membership clearly does not"). He did find the claims preempted in part by the Copyright Act, as to the reprints. He later refused to revisit the ruling or certify an appeal. Callahan v. PeopleConnect Inc. (N.D. Cal. June 14, 2022).

Outside California, Ancestry's record is mixed in a way worth tracing.

PeopleConnect's Illinois and Washington suits followed a similar early path: Mackey v. PeopleConnect, Inc. (N.D. Ill. 2023) and Boshears v. PeopleConnect Inc. (W.D. Wash. 2022) both rejected the immunity, copyright, and First Amendment grounds at the pleadings. The California case is the one that has now reached a merits-adjacent appellate decision.

What Nolen decided and what it did not

Nolen came up on a Rule 23(f) petition (an interlocutory appeal limited to class certification) from Judge Chen's orders. The certified class is California residents who never registered on Classmates.com, never donated a yearbook, and whose name search returns a record from a California yearbook first made publicly available on or after December 18, 2018. The panel (Judges Berzon, Friedland, and Mendoza) affirmed.

The central move is simple and consequential. PeopleConnect argued that Cal. Civ. Code § 3344 requires proof that someone actually searched the plaintiff, which would have required person-by-person evidence the company's records could not supply. The panel declined to resolve that. Subdivision (e) makes the direct connection between use and advertising "a question of fact," so whether searchability alone suffices is a merits dispute that can be answered once for everybody. Either the jury accepts the theory or it does not, and quoting Amgen, the opinion says the class "will prevail or fail in unison." The panel cautioned that PeopleConnect "may eventually be proven right" on the merits, said again that a jury may find the common evidence unpersuasive, and plaintiffs' counsel conceded at argument that the claims would simply fail if searchability were not enough.

Four other holdings will be cited for years:

1. Economic injury can be shown on a classwide basis. The district court's inference that a name used in direct connection with advertising has some value, "even if small," was within its discretion. The company's purchase and licensing of yearbooks was further classwide evidence. PeopleConnect's argument that statutory damages require individualized mental anguish was not preserved, so the panel did not decide it. The question stays open. Ancestry raised the same point in moving to strike in Callahan, and that motion was mooted by the dismissal.
2. There is no administrative feasibility requirement, even with per-capita statutory damages. The panel applied Briseno v. ConAgra Foods, Inc., 844 F.3d 1121 (9th Cir. 2017) and approved a process in which claimants self-certify and the company cross-checks against its user and donor records.
3. Speculative defenses do not defeat predominance. PeopleConnect offered seven sample school release forms, only three of which reached anyone other than the district, and no proof it was an assignee. Nine same-name instances and twenty similar-name instances within yearbooks did not make identifiability an individual issue.
4. Suppressing the lead plaintiff's name after suit does not make her inadequate. A defendant cannot moot or disqualify a representative that way, under the voluntary cessation principle.

The panel also flagged a serious issue for remand without deciding it. Class members whose names really were searched have a stronger claim. If the class loses on searchability, preclusion may wipe out those stronger claims. Borrowing from Slade v. Progressive Security Insurance Co., 856 F.3d 408 (5th Cir. 2017), the panel told the district court how to evaluate that conflict if PeopleConnect raises it in a motion to decertify, and noted that class notice may need to warn about it.

Nolen rests on California's text. Subdivision (e) of Cal. Civ. Code § 3344 has no counterpart in Illinois's "public use or holding out" definition, which is part of why the Illinois cases have come out differently, as the next section shows. Nor is Nolen alone on searchable classes: in Kellman v. Spokeo, Inc. (N.D. Cal. May 29, 2024), Judge Orrick granted certification of California and Ohio classes, including classes framed around published, searchable teaser profiles, after the plaintiffs withdrew their nationwide proposal. A $10 million settlement covering claims under nine states' laws was reported as proposed in July 2026; check the docket for its approval status. For the general framework on predominance and proof at this stage, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.

Article III: does anyone need to have seen it?

Federal court requires a concrete injury. Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), which began as a suit against one of these very companies over an inaccurate profile, held that a statutory violation does not automatically supply one. TransUnion then split a class of 8,185 people: the 1,853 whose misleading credit files went to third parties had standing, and the rest, whose files sat unread, did not. The general framework is in Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims.

Defendants say the fit is exact: a teaser nobody viewed is a credit file in a drawer. Plaintiffs answer that TransUnion borrowed from defamation, which has always required publication to a third party, whereas appropriation has no such element. The injury is the taking.

The strict view. Verde v. Confi-Chek, Inc. (N.D. Ill. 2021) dismissed because the plaintiff did not allege anyone but her viewed the preview, reading TransUnion to require disclosure. Callahan v. Ancestry required something beyond the statutory violation.

The analog view. Lukis v. Whitepages Inc., 549 F. Supp. 3d 798 (N.D. Ill. 2021) called this an easy case: the Illinois Act codifies a common law tort, so a violation is itself concrete. Sessa, Bonilla, and Kellman reasoned similarly. Hoffower sided with Lukis over Verde, as did the January 2025 Bonilla ruling, and a July 2026 decision applied the analogy to a statute that never mentions publicity. Byer v. Buildout, Inc. (N.D. Ill. 2026) found standing for a Coloradan whose cell number was listed in a real estate database. A Washington court recently summed up the state of play: "Courts have diverged on whether the use of a plaintiff's information to create a free-preview page inflicts an injury in fact even if nobody views the advertisement." Carrera v. Whitepages Inc. (W.D. Wash. 2025). I have found no precedential circuit ruling that resolves the point on these facts. The vacated panel opinion in Martinez v. ZoomInfo Technologies, Inc., 82 F.4th 785 (9th Cir. 2023), which addressed standing, cannot be cited as law after the en banc order, 90 F.4th 1042 (9th Cir. 2024).

The attorney-screenshot problem

Plaintiffs usually discover and document these listings through counsel, who runs a search and captures the screen. The practice has become a trap in two distinct ways.

In Fry, the court denied dismissal but warned that the claim "necessarily requires that some third party saw the advertisement at some point," and that it "will not suffice if the advertising occurred only to Mr. Fry's attorneys for the purpose of litigation, as that defies all logic." A self-inflicted injury does not count.

Then came summary judgment rulings. In Hoffower, 736 F. Supp. 3d 605, Judge Kennelly agreed the plaintiff had standing but granted judgment on the merits. Under Fischer v. Instant Checkmate LLC (N.D. Ill. 2022), "public use" means exposure to a substantial number of people, while "holding out" need not be seen, following Trannel v. Prairie Ridge Media, Inc., 987 N.E.2d 923 (Ill. App. Ct. 2013). But the platform's logs showed only the lawyer's search, and "[t]his Court cannot endorse a reading of IRPA that permits a plaintiff to obtain relief based on her own attorney making a direct request for, and then obtaining, the plaintiff's identifying information." The later Bonilla ruling followed Hoffower. Wilson framed the same fact as both a standing failure and a failure of proof: "The commercial use ... never occurred."

The most punishing version came in August 2026. In Dobija v. Accucom Corp. (N.D. Ill. 2026), an earlier class plaintiff had been recruited through a solicitation, and the company's investigation showed the Infotracer site had returned her name only in searches run by her counsel or by the company's own investigators. Her case was dismissed for lack of standing. New plaintiffs filed, and the court held their claims time-barred: under Walters v. Edgar, 163 F.3d 430 (7th Cir. 1998), a suit by a plaintiff who never had standing does not toll limitations under American Pipe & Construction Co. v. Utah, 414 U.S. 538 (1974). With Illinois's one-year period, that ended the case.

California's approach is different, at least for now. Nolen treats searched versus searchable as merits, and in the Nevada case the court recently said, in the jurisdictional context, that the right of publicity does not impose a viewership requirement, citing Maloney v. T3Media, Inc., 853 F.3d 1004 (9th Cir. 2017). Sessa. The result is a real regional difference in how much the logs matter, and an open question whether a California jury will accept a theory that Illinois judges have rejected as a matter of law under their own statute.

Section 230: when is a data company a publisher of someone else's information?

47 U.S.C. § 230(c)(1) bars treating an interactive computer service as the publisher or speaker of information provided by another information content provider. An information content provider is anyone responsible "in whole or in part" for creating or developing the information. The governing Ninth Circuit test comes from Fair Housing Council v. Roommates.com, LLC, 521 F.3d 1157 (9th Cir. 2008) (en banc), which asks whether the service materially contributed to what makes the content unlawful, as applied in Kimzey v. Yelp! Inc., 836 F.3d 1263 (9th Cir. 2016) (star ratings derived from user reviews did not forfeit immunity) and Dyroff v. Ultimate Software Group, Inc., 934 F.3d 1093 (9th Cir. 2019) (recommendations and notifications were neutral tools). For the statute generally, see Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops.

The defense argument has force on the data layer. A county recorder wrote that address; a yearbook staff wrote that caption. But the claim is not that the address is false or defamatory. The alleged wrong is building an advertisement from it. So courts have mostly asked who made the advertisement.

• Lukis: Whitepages allegedly "actively compiled and collated, from several sources" and was not a passive conduit under Huon v. Denton, 841 F.3d 733 (7th Cir. 2016).
• Krause: the complaint alleged curation for commercial gain.
• Kellman: Spokeo is "alleged to actively take content from other sources, curate it, and upload it to its site in a novel configuration for repurposed uses."
• Sessa and Callahan v. PeopleConnect: both add a separate ground from Batzel v. Smith, 333 F.3d 1018 (9th Cir. 2003). Immunity reaches information provided for publication on the internet, and a yearbook staff of decades past may have had no such intent.
• Callahan v. Ancestry: the outlier, reading Batzel narrowly and treating a pop-up as a new functionality that creates no content. The plaintiffs dropped their appeal before argument, so the Ninth Circuit never reviewed it.

Most of these are pleading rulings on an affirmative defense, which a plaintiff need not plead around. They do not hold that Section 230 can never apply. A defendant with a clean evidentiary record that it licensed a compiled file and displayed it verbatim might try again at summary judgment. Outside the publicity context, Henderson v. Source for Public Data, L.P., 53 F.4th 110 (4th Cir. 2022) reversed a Section 230 dismissal of Fair Credit Reporting Act claims against a public-records reseller. It reasoned that some of the claims did not treat the company as a publisher at all, and that on the others the company materially contributed to the relevant information. That reasoning will travel.

The intellectual property carve-out

Separately, 47 U.S.C. § 230(e)(2) says the immunity does not limit "any law pertaining to intellectual property." Is a state publicity right such a law? The Ninth Circuit says the carve-out covers only federal intellectual property. Perfect 10, Inc. v. CCBill LLC, 488 F.3d 1102 (9th Cir. 2007). The Third Circuit disagrees and held that a Philadelphia news anchor's state publicity claim falls within it. Hepp v. Facebook, 14 F.4th 204 (3d Cir. 2021). That is a true circuit split. A people-search defendant sued in the Third Circuit may lose Section 230 entirely on a publicity claim, whoever authored the data. Bonilla noted the issue without reaching it.

Anti-SLAPP: a tool that has mostly misfired here

California's anti-SLAPP statute (a procedure for striking meritless suits aimed at speech on public issues) was a natural tool, with attorney's fees for a winning movant. It has not worked well for these defendants, for three reasons that stack.

First, yearbook and profile data struggle to qualify as a public issue. Even the Callahan v. Ancestry order that dismissed the case denied the anti-SLAPP motion, because "decades-old yearbooks are not demonstrably an issue of public interest." Sessa did the same under Nevada's statute.

Second, California's public-interest exemption, Cal. Civ. Proc. Code § 425.17(b), removes qualifying class actions from the statute altogether. The vacated Martinez panel so held, and a later panel applied the exemption in a Dun & Bradstreet directory suit, also rejecting the argument that the database was a "literary work." Batis v. Dun & Bradstreet Holdings, Inc., 106 F.4th 932 (9th Cir. 2024).

Third, the appeal is gone. The en banc Ninth Circuit overruled Batzel on this point and held that orders denying California anti-SLAPP motions are not immediately appealable. Gopher Media LLC v. Melone (9th Cir. Oct. 9, 2025) (en banc). The en banc rehearing in Martinez itself appears to have been overtaken by settlement discussions, and I have found no en banc opinion in that case. Without an interlocutory appeal, the motion loses much of its tactical value, and a people-search defendant now weighs fee exposure against a slim prospect. The general mechanics are in Filing an Anti-SLAPP Motion: A Practical Guide and Anti-SLAPP Statutes and Strategic Litigation Against Public Participation.

Arbitration: who agreed to what?

These sites all have terms of service with arbitration clauses and class waivers. The plaintiffs mostly have not agreed to them, since the whole point of the class definition is non-users. So defendants look for someone who did agree and try to tie that person to the plaintiff. Arbitrability of a non-signatory turns on ordinary state contract and agency law. Arthur Andersen LLP v. Carlisle, 556 U.S. 624 (2009). See Multiparty and Multicontract Arbitration: Consolidation, Joinder, and the Non-Signatory Problem.

The lawyer's account. PeopleConnect argued repeatedly that plaintiffs' counsel, by creating a Classmates account to take screenshots, had bound their clients. The results so far:

• Callahan v. PeopleConnect (9th Cir. Mar. 18, 2022) (unpublished): under California law, counsel lacked authority to bind clients to arbitration without consent, relying on Blanton v. Womancare, Inc., 38 Cal. 3d 396 (1985), and the clients did not ratify.
• Knapke v. PeopleConnect, Inc., 38 F.4th 824 (9th Cir. 2022): the published opinion cuts the other way procedurally. It vacated a denial of arbitration because Washington law, not Ohio law, governed and fact questions about agency and ratification remained, and PeopleConnect was entitled to discovery. Rule 11's investigation duty, the panel said, does not alter agency law. The plaintiff's lawyer had even bought a three-month subscription and skipped the opt-out.
• Boshears v. PeopleConnect, Inc., 76 F.4th 858 (9th Cir. 2023): a jurisdictional ruling that vacated a denial and sent the issue back. On remand, the Boshears district court (W.D. Wash. Sept. 5, 2024) denied arbitration on three independent grounds: opt-out, no authority, and no ratification.
• Mackey (N.D. Ill. 2023): counsel had created several accounts, without opting out on the first of them, and the court still denied arbitration.
• Carrera (W.D. Wash. June 9, 2025): Whitepages' proof was only a screenshot of a pop-up with a "Got it" button. No evidence showed that the plaintiffs or their lawyers clicked it, and the request for discovery had been waived.

Nobody should read this as immunity for plaintiffs' lawyers. Knapke gives defendants discovery into attorney-client interaction about the account, and that is expensive for plaintiffs, whatever the outcome.

The plaintiff's own account. This one is simple and fatal. Nolen records in a footnote that four earlier named plaintiffs voluntarily dismissed after it turned out they had registered on Classmates.com and thereby consented under the terms. A consent provision aimed at self-searches goes further. The Classmates terms state that users who search for themselves consent to the company's "use and display of information" about them, and Fischer v. Instant Checkmate describes a similar clause added in November 2020 that also reached people who authorize another to search for them. Whether such a clause holds up against a person who merely wanted to see what was out there is unresolved, but anyone considering a claim should not create an account first.

A family member's account. I have not found a reported decision squarely holding that a spouse's or parent's people-search or genealogy account binds a relative who never used it. The general principles favor the non-user. Agency requires the principal's conduct, so one spouse does not bind another merely by being married, as a California appellate court held in a nursing home case. Flores v. Evergreen at San Diego, LLC, 148 Cal. App. 4th 581 (2007). Equitable estoppel requires knowingly exploiting the contract, and the Ninth Circuit's description of the doctrine in Kramer v. Toyota Motor Corp., 705 F.3d 1122 (9th Cir. 2013) is demanding. But watch the facts. Clauses in these terms sometimes state that a person using the site on another's behalf affirms authority to agree for that person, as the terms in Boshears did. A minor whose parent agreed, or a person who asked a relative to set up a search and enjoyed the results, gives a defendant something to work with. Assent itself must be shown first, under Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022) and Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014), which require reasonably conspicuous notice and an unambiguous manifestation of assent. The "Got it" button in Carrera would have faced that hurdle even with proof of a click.

Timing and forum: the quiet case-killers

Limitations. Illinois applies the one-year period in 735 ILCS 5/13-201 for publication of matters violating the right of privacy. Tims v. Black Horse Carriers, Inc., 2023 IL 127801, which set five years for the biometric privacy statute, did not change that for publicity claims, as Judge Kendall held on reconsideration in Bonilla v. Ancestry.com Operations, Inc. (N.D. Ill. May 23, 2023). The clock runs from first publication under the single-publication rule, and the Seventh Circuit, following an Illinois appellate decision, has refused to apply a discovery rule. Giovannelli v. Walmart Inc., 164 F.4th 1052 (7th Cir. 2026). California applies two years to § 3344 claims, and the single-publication rule starts the clock when material first becomes publicly available, subject to equitable exceptions. Judge Chen applied that in Tseng v. PeopleConnect (the Callahan v. PeopleConnect docket) (N.D. Cal. Mar. 30, 2023), granting judgment against a named plaintiff whose image went online in 2014. That is why the Nolen class is limited to yearbooks first posted on or after December 18, 2018. A profile you found this year may have gone live long ago.

Personal jurisdiction. Sessa is the cautionary saga. The court found jurisdiction in 2021, reconsidered after a 2023 Ninth Circuit panel decision in Briskin v. Shopify, dismissed for failure to show the company actively targeted Nevada, and then, after the en banc court reversed course in Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025), granted relief from judgment in Sessa v. Ancestry.com Operations Inc. (D. Nev. Mar. 30, 2026) and reopened the case. Six years in, the plaintiffs are back at the pleading stage. For the larger picture, see Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor. The Ohio court in Wilson, by contrast, found jurisdiction and stuck with it. Standing and removal interact in an awkward way too: a defendant that wins an Article III dismissal may simply send the case back to state court, where federal standing limits do not apply. Zhang v. Ancestry.com Operations Inc. (N.D. Cal. 2022) shows the procedural tangle, and Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives gives the framework.

The Fair Credit Reporting Act: a different statute with a different question

If a people-search site is a consumer reporting agency, it inherits a heavy regime: permissible purpose limits under 15 U.S.C. § 1681b, accuracy procedures under 15 U.S.C. § 1681e, dispute rights under 15 U.S.C. § 1681i, and statutory damages of $100 to $1,000 for willful violations under 15 U.S.C. § 1681n. A "consumer report" under 15 U.S.C. § 1681a(d) is a communication bearing on a person's creditworthiness, character, general reputation, personal characteristics, or mode of living that is used, expected to be used, or collected to be used for credit, insurance, employment, or another listed purpose. The test looks at function and purpose, so a label does not end the inquiry.

So nearly every people-search site carries a disclaimer: "We are not a consumer reporting agency. Do not use this for employment or tenant screening." The disclaimer does real work when it is honest. In Kidd v. Thomson Reuters Corp., 925 F.3d 99 (2d Cir. 2019), the Second Circuit held that a company with policies and practices aimed at preventing FCRA uses lacked the specific intent to furnish consumer reports. It does less work when marketing tells a different story. The FTC's enforcement record is the guide: the 2012 Spokeo consent decree ($800,000), the 2014 Instant Checkmate settlement ($525,000), and the 2023 action against TruthFinder and Instant Checkmate ($5.8 million). The 2023 complaint alleged the companies marketed reports for screening while disclaiming that use, misrepresented accuracy, and offered "Remove" and "Flag as Inaccurate" buttons that did not work as advertised. Those are also 15 U.S.C. § 45 theories, and that matters to anyone relying on an opt-out button.

For the individual, this helps on a narrow set of facts. If a landlord or employer used a report from a site and you were denied, you may have a strong claim, subject to the limits in 15 U.S.C. § 1681p (generally two years from discovery and five from the violation). Spokeo's long history shows the Article III catch: the Ninth Circuit found standing on remand, in Robins v. Spokeo, Inc., 867 F.3d 1108 (9th Cir. 2017), but after TransUnion the plaintiff needs dissemination.

The CFPB proposed in December 2024 to treat many data brokers as consumer reporting agencies, then withdrew the proposal on May 15, 2025 (90 Fed. Reg. 20568), saying it no longer aligned with the Bureau's interpretation. So the law remains statute and case law. For the wider statute, see Consumer Financial Protection Statutes: The FCRA, the FDCPA, the ECOA, and TILA in Practice, and on employer duties, Hiring With Background Checks: FCRA Compliance, Ban-the-Box, and Adverse Action.

Daniel's Law: when the data can get someone killed

In July 2020, a lawyer who had appeared before U.S. District Judge Esther Salas came to her home in New Jersey disguised as a delivery driver, killed her 20-year-old son, Daniel Anderl, and seriously wounded her husband. He had found her address online. New Jersey enacted Daniel's Law that November, and Congress and many states followed.

New Jersey's statute, as quoted by the state supreme court in Atlas, works like this. An authorized person gives written notice. Within 10 business days, the recipient must stop disclosing the covered person's home address or unpublished telephone number. A violator "shall be liable" to the covered person or an assignee for actual damages, not less than $1,000 per violation, plus punitive damages for willful or reckless disregard, fees, and equitable relief. N.J.S.A. 56:8-166.1. "Covered person" includes active, formerly active, and retired judicial officers, prosecutors, and law enforcement officers, and immediate family in the household.

The word "assignee" produced the largest litigation in this area. Atlas Data Privacy Corporation offers covered persons a platform for sending notices, took assignments from about 19,000 people, and filed dozens of separate suits against people-search sites, real estate companies, marketers, and others. Judge Bartle, sitting by designation after the New Jersey federal judges recused, upheld the law against a facial challenge in Atlas Data Privacy Corp. v. We Inform, LLC, 758 F. Supp. 3d 322 (D.N.J. 2024), reading in a negligence standard to avoid a strict liability problem. In a June 27, 2025 Atlas opinion, he denied pleading challenges, including an argument that the law could not reach out-of-state conduct.

On certification from the Third Circuit, the New Jersey Supreme Court removed the premise. Atlas Data Privacy Corp. v. We Inform, LLC (N.J. Aug. 12, 2026) holds unanimously that the statute contains no mental state requirement for actual damages. The court pointed to the "willful or reckless" language in the next subsection, to the Legislature's 2022 deletion of "reasonable person" language, and rejected the Attorney General's argument that the 10-day window is a proxy for negligence. It acknowledged that a company acting reasonably might miss the deadline, for instance if flooded with requests. And it stated flatly that constitutionality "is for the Third Circuit to determine." As of this writing I have found no Third Circuit decision.

That Third Circuit decision now has to be read against the Fourth Circuit's. Jackson v. Whitepages, Inc. (4th Cir. Oct. 27, 2026) (consolidated with suits against Thomson Reuters, Thryv, PeopleConnect, and LexisNexis Risk Solutions) struck W. Va. Code § 5A-8-24(e), a statute with no notice step at all. Judge Niemeyer's opinion takes each step in order. Addresses are speech under Sorrell v. IMS Health Inc., 564 U.S. 552 (2011) and Bartnicki v. Vopper, 532 U.S. 514 (2001). The law is content-based: telling the world that a grocery clerk lives at 100 Main Street is allowed, and telling it a police officer lives there is not. Safety is a compelling interest, as all parties agreed. But the law is not narrowly tailored, because liability attaches automatically, without knowledge or notice, so a publisher of a town directory must either self-censor or be liable. The "reasonable person" limit turned out, by the plaintiff's own concession at argument, to limit nothing.

The court was careful about its reach. It said "[f]or that reason and only that reason" West Virginia went too far, and it noted that notice-and-takedown is the way Congress and virtually every other state have narrowed their laws, quoting the district court's observation that more tailored statutes "pass constitutional muster." New Jersey's law has notice. It does not have fault. Jackson said a knowledge requirement matters, and Atlas says New Jersey has none beyond the notice itself. Defendants will argue the deadline with strict liability still chills. Plaintiffs will say a company that received a specific written notice knows exactly what to take down. And the Atlas model adds a wrinkle Jackson never faced: mass assignment and bulk notices. The state court's own example of a reasonable company missing the window was one hit with a high volume of requests.

As-applied claims are a separate matter. In Kratovil v. City of New Brunswick (N.J. June 17, 2025), a journalist wanted to publish a police director's exact address to show he lived far from his post. The New Jersey Supreme Court applied Smith v. Daily Mail Publishing Co., 443 U.S. 97 (1979) and Florida Star v. B.J.F., 491 U.S. 524 (1989), found the information truthful, lawfully obtained, and of public concern, and still upheld the law as narrowly tailored. The holding reads "address" to mean the exact street address, so a reporter can still name the town. The Fourth Circuit doubted that the Florida Star line applies to data brokers at all, but noted the analysis would be strict scrutiny either way. If you want a practical pointer: a covered person's notice should be specific and should keep proof of delivery, which the toolkit addresses in People-Search Toolkit: Opt-Out Letters, Claim Evaluation Worksheets, and Defense Frameworks.

Registration and deletion: the regulatory track

California's Delete Act amended the state's data broker registration law. A "data broker" under Cal. Civ. Code § 1798.99.80 is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship, excluding entities to the extent they are covered by the FCRA, Gramm-Leach-Bliley, and certain other regimes. Brokers register annually under Cal. Civ. Code § 1798.99.82. Under Cal. Civ. Code § 1798.99.86, the state privacy agency (which now goes by CalPrivacy) had to build a single deletion mechanism by January 1, 2026, the Delete Request and Opt-out Platform, or DROP. Beginning August 1, 2026, a broker must access the system at least every 45 days, delete matching data, direct its vendors to do the same, and delete newly acquired data on a continuing basis. An unverifiable request is treated as an opt-out of sale. The fines are $200 per day for failing to register and $200 per request per day for failing to delete. Independent audits begin in 2028. The agency reported in June 2026 that more than 300,000 Californians had signed up.

Three limits deserve attention. Only California residents can use DROP. There is no private right of action in the Delete Act itself, since enforcement is administrative. And "publicly available" information is outside the CCPA's definition of personal information under Cal. Civ. Code § 1798.140, so a broker may argue that much of a people-search record, drawn from government sources, is not within the deletion duty. How the agency treats that argument in enforcement is worth watching. For the wider statute, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Vermont was first to require registration (9 V.S.A. § 2446), and Texas (Tex. Bus. & Com. Code ch. 509) and Oregon (ORS 646A.593) followed in 2023, with others since. These laws mainly create transparency rather than deletion rights, so check each state's registry and current requirements. And other statutes target the people at highest risk. California's Safe at Home program bars knowingly and intentionally posting a participant's home address after a sworn written demand, with a demand good for four years, under Cal. Gov't Code § 6208.1. Other states have address confidentiality programs of their own. On the personal side, see Personal Privacy: Data Brokers, Surveillance, and Your Rights Over Your Own Information.

The First Amendment: the phone book and the billboard

Every defendant raises it. The courts, so far, have drawn a line that the two fall 2026 decisions help locate.

The directory is speech. Jackson could not be plainer: "For generations now, home addresses and telephone numbers have been disseminated to the public," and the tradition continues in the digital age. A statute that suppresses the listing is a content-based speech restriction, and profit motive alone does not make it commercial speech under Bolger v. Youngs Drug Products Corp., 463 U.S. 60 (1983). When a statute covers commercial and noncommercial messages alike, Jackson held, citing City of Austin v. Reagan National Advertising of Austin, LLC, 596 U.S. 61 (2022), intermediate review is unavailable. The same logic drove the Ninth Circuit in IMDb.com Inc. v. Becerra, 962 F.3d 1111 (9th Cir. 2020), which struck a California law barring publication of actors' ages.

The advertisement may not be. A publicity claim aimed at the teaser targets a proposal to buy. Krause walked through the test in Jordan v. Jewel Food Stores, Inc., 743 F.3d 509 (7th Cir. 2014) and held that a page offering plans for sale qualifies as commercial speech. Commercial speech gets intermediate scrutiny under Central Hudson Gas & Electric Corp. v. Public Service Commission, 447 U.S. 557 (1980). And in Zacchini v. Scripps-Howard Broadcasting Co., 433 U.S. 562 (1977), the Supreme Court held that publicity liability does not necessarily offend the First Amendment. Kellman relied on exactly that. Byer applied Central Hudson at the pleading stage in rejecting a facial attack on Colorado's ban on listing cell numbers in commercial directories without consent.

The hard middle. Nolen's searchability theory strains this line. If the name in a searchable database counts as a use "directly connected" to advertising even when no ad ever displayed it, the regulated thing starts to look like the directory itself. That is the argument in waiting for PeopleConnect at summary judgment and on any eventual appeal, and Jackson gives it new material. Illinois decisions anticipated the concern in another way: in Nieman v. VersusLaw, Inc., 512 F. App'x 635 (7th Cir. 2013), a plaintiff lost a claim over judicial records republished in a commercial database, and Lukis itself allowed that a report limited to judicial records might be protected. The more detailed treatment of expressive-use doctrine is in The Right of Publicity and the First Amendment: Transformative Use, Newsworthiness, and the Limits of Owning a Persona.

Credit reporting offers a useful comparison. Dun & Bradstreet, Inc. v. Greenmoss Builders, Inc., 472 U.S. 749 (1985) (plurality) treated a credit report sent to a few subscribers as speech of purely private concern, receiving reduced protection in a defamation case. A paid profile about a private person, sold to one subscriber, sits closer to Greenmoss, while a public directory sits closer to Jackson. Nobody has yet worked out where a teaser falls.

Worked example. Suppose a hypothetical company, Tallgrass Contacts, sells a sales-prospecting database. It receives a Daniel's Law notice from a New Jersey sheriff's deputy, and separately a demand letter from a California marketing manager who found a preview page with her name, employer, and title. The deputy's claim is a pure disclosure claim about a home address. If Tallgrass misses the 10-business-day window, New Jersey law as now construed makes it liable without fault, and its defense is constitutional, resting on the Third Circuit's coming decision and on Jackson by analogy. The marketing manager's claim is an advertising claim. Her home address is irrelevant. It turns on the funnel, on Nolen's fact question, and on Tallgrass's logs. Taking her off the site does not end the matter either, as Nolen notes. Tallgrass can win one and lose the other, and the two lawyers on its team should be comparing notes on whether the same pages are being called a directory in one case and a neutral lookup tool in the other.

What the cases mean in practice

For a person whose name appears. Most people want the listing gone more than they want $750 and a role in a six-year lawsuit. A removal request is usually quicker, and it does not necessarily forfeit a claim, since damages for past use are not erased by later suppression. Do not create an account. Do preserve evidence with date and URL, and be realistic about whether anyone but you has seen the page. Limitations may already be running, or may have run, and in Illinois a year passes quickly. If you are in a safety situation, use the safety-specific statutes first.

For plaintiffs' counsel. Plead preview, funnel, and third-party viewing with facts. Do not build the case on a screenshot you took yourself. Ask for logs early. Vet the class representative for accounts on the site and on affiliated sites. If you investigate, consider having an investigator use a method that does not require accepting terms, and document who authorized what, because Knapke opens that door. Check for the Walters tolling trap in the Seventh Circuit.

For operators. The risk sits in the funnel design. A pure lookup with no identifiable preview above the paywall is different from a named teaser beside a price. Retention of event logs is a double-edged decision, since logs won Hoffower and their absence may hurt elsewhere. Honor deletion and notice obligations with records you can prove in court, because in New Jersey the clock is now strict. A disclaimer is only as good as the marketing around it. The People-Search Listing Response Checklist: A Practical Checklist and the guide's operator section go further. If your data comes from scraping, Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims and The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement cover the upstream exposure. For a comparison with another category of sensitive data sold outside classic privacy statutes, see Consumer Health Data Outside HIPAA: My Health My Data, the FTC, and the Apps That Know Too Much.

What remains unsettled

• Searchable versus searched in California. Nolen reserved it for the merits, and a conflict motion may come first.
• Whether mental anguish is required for § 3344 statutory damages. Nolen found the argument forfeited.
• Whether unseen use is concrete. There is a live split among district courts and no controlling circuit ruling on these facts.
• Whether "holding out" in Illinois reaches a database entry nobody retrieved. Hoffower and Bonilla say no on their records. No Seventh Circuit decision has addressed it.
• Section 230 at summary judgment, and the CCBill/Hepp split. A clean record on licensed data has not been tested in a published appellate decision here.
• New Jersey's Daniel's Law. The Third Circuit must now decide a strict liability, notice-based statute after Jackson.
• The commercial value element in Ohio and Indiana. LaFleur and Fry point different ways.
• How far DROP reaches into "publicly available" data. Enforcement history will answer this.

This article is general information as of its last-modified date and is not legal advice for any specific situation. MC Law handles right of publicity, privacy, and platform disputes, and if a listing or a demand letter has landed on your desk, it may help to talk through which of these tracks actually applies.

Related Documents

Related Guides

• Removing Yourself From People-Search Sites and Evaluating a Publicity Claim: A Practical Guide: the step-by-step companion for individuals, with a section for operators.
• Filing an Anti-SLAPP Motion: A Practical Guide: mechanics of the motion these defendants keep trying.
• Protecting Your Personal Information: A Practical Guide: broader habits that reduce what ends up in broker files.

Related Checklists

• People-Search Listing Response Checklist: A Practical Checklist: the desk version, in phases, for a listing or a safety concern.

Related Toolkits

• People-Search Toolkit: Opt-Out Letters, Claim Evaluation Worksheets, and Defense Frameworks: letters, evidence sheets, a state worksheet, and an operator defense framework.

Related Articles

• The Right of Publicity: Name, Image, Likeness, Digital Replicas, and the Limits of Owning Yourself: the general doctrine.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the standing framework behind the split.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: the immunity in full.
• Personal Privacy: Data Brokers, Surveillance, and Your Rights Over Your Own Information: the wider privacy picture.
• The Computer Fraud and Abuse Act After Van Buren: Gates, Insiders, Scrapers, and the Loss Requirement: the law that governs how data gets collected.
• Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives: why a standing win can send a case to state court.