How to use this toolkit

Everything here is meant to be copied and adapted. Fill in the brackets, delete what does not apply, and read the drafting notes before sending anything, because small wording choices carry legal weight. A person sending Tool 3 from a kitchen table does not need Tool 13. An operator's general counsel may want nothing else.

The doctrine is in People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions. The sequence and judgment calls are in Removing Yourself From People-Search Sites and Evaluating a Publicity Claim: A Practical Guide. The check-off version is the People-Search Listing Response Checklist: A Practical Checklist.

Contents

For individuals:

  1. Routing matrix
  2. Evidence capture sheet
  3. General opt-out and deletion letter
  4. California follow-up letter
  5. Safety-based removal request and sworn demand
  6. Daniel's Law notice
  7. Re-check log
  8. FCRA dispute and source request

For counsel:

  1. Claim evaluation worksheet by state
  2. Viewership and standing worksheet
  3. Demand letter skeleton
  4. Named plaintiff vetting questionnaire

For operators:

  1. Funnel audit worksheet
  2. Defense framework matrix
  3. Terms of service clause bank and assent log
  4. Notice intake procedure and response templates
  5. Risk control register

Tool 1: Routing matrix

Purpose: send the problem down the right path. Owner: the listed person or intake lawyer. Timing: first conversation.

If this is true Go first to Then
Someone may physically harm you Advocate or police; Tool 5 Tools 2, 3, 7
You are a judge, prosecutor, officer, or household member Tool 6; court or agency security office Tools 2, 7
California resident wanting removal only DROP at privacy.ca.gov/drop Tools 3, 4, 7
Resident elsewhere wanting removal only Tool 3 to each site and parent Tool 7
A report cost you a job, home, or credit Tool 8 Tools 2, 9
Your photo or name is in a sales preview, and others saw it Tools 2, 9, 10 Tool 11, or a regulator complaint
You received a class notice Read definition and opt-out date; Tool 9 Counsel if your actual damages may exceed the floor
You are the company receiving any of these Tool 16 Tools 13, 14, 17

Drafting note: The order is deliberate. Under Nolen v. PeopleConnect, Inc. (9th Cir. 2026), an account can remove a person from a class altogether, so no row sends anyone to sign up on a site.

Tool 2: Evidence capture sheet

Purpose: preserve what the page said and how it was reached. Owner: listed person, or a paralegal who has not accepted the site's terms. Timing: before any removal request.

PEOPLE-SEARCH CAPTURE SHEET
Captured by: [name]            Date/time/zone: [ ]
Device/browser: [ ]            Logged in? [No: if yes, stop and ask counsel]
Site name: [ ]                 Full URL: [ ]
Parent company (from privacy page): [ ]

HOW REACHED
[ ] Search engine result. Engine and query: [ ]. Position: [ ]
[ ] Site's own search box. Query: [ ]
[ ] Link sent by another person. Who/when: [ ]

WHAT THE PAGE SHOWS ABOUT ME
Name [ ]  Middle initial [ ]  Age/range [ ]  City [ ]  Street address [ ]
Phone (blurred?) [ ]  Email [ ]  Relatives [ ]  Photo [ ]  Yearbook/school [ ]
Employer/title [ ]  Other [ ]

SALES ELEMENTS ON THE SAME SCREEN
Button or link text: [ ]    Price shown? [ ]    Subscription language: [ ]
Next screen (only if reachable without accepting terms): [ ]
Terms pop-up or "Got it" prompt? [Describe. Do not click.]

ERRORS AND SENSITIVE ITEMS
[ ]

WHO ELSE HAS SEEN THIS
Person: [ ]  How I know: [ ]  Date: [ ]  Evidence saved at: [ ]

FILES SAVED
PDF: [path]   Image: [path]   Hash, if counsel requests: [ ]

Drafting notes: The "how reached" block addresses the distinction that decided Hoffower v. Seamless Contacts Inc., 736 F. Supp. 3d 605 (N.D. Ill. 2024), and Wilson v. Ancestry.com LLC (S.D. Ohio 2024). The "who else" block answers Fry v. Ancestry.com Operations Inc. (N.D. Ind. 2023), which warned against reliance on displays to the plaintiff's lawyers. The "do not click" instruction reflects Knapke v. PeopleConnect, Inc., 38 F.4th 824 (9th Cir. 2022). For anyone with safety concerns, keep the sheet offline.

Tool 3: General opt-out and deletion letter

Purpose: request removal without agreeing to anything. Owner: listed person. Timing: after Tool 2. Send to: the privacy address on the site and parent.

[Date]
[Company], Attn: Privacy
[Address or email]

Re: Removal and suppression request

I am writing to request that you remove and suppress all information about me
from [site name] and every other site or service that you own, operate, or
supply.

Profile URL(s): [URL]
Name as listed: [name]
Other identifiers shown on your page, for matching only: [city/state]

Please (1) remove the listed profile(s) and any preview, search result, or
teaser that displays my name or identifying details; (2) suppress my
information so that it does not reappear when your data is refreshed; (3) stop
selling or sharing it; (4) direct your service providers and data recipients to
do the same; and (5) confirm in writing within [15] days what you have done and
which sites this covers.

[If applicable: I make this request under [state statute], including any right
to delete personal information and to opt out of sale or sharing.]

I do not consent to any commercial use of my name, image, or identity. I have
not created an account with you. This letter is not an acceptance of your terms
of service, and I do not agree to arbitration or any other term by sending it.
Nothing here waives any right or claim.

Please reply to [dedicated email].

[Name]

Drafting notes:

  • The non-acceptance sentence responds to terms like those described in Fischer v. Instant Checkmate LLC (N.D. Ill. 2022), which treated people who search for themselves as consenting. Assent requires an unambiguous manifestation under Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022).
  • The withdrawal of consent helps with the "without consent" element of Cal. Civ. Code § 3344 and 765 ILCS 1075/30, though these statutes put the burden of getting consent on the user anyway.
  • Do not state a home address or phone number the site does not already show. Do not attach ID unless required, and if it is, redact it.
  • If you may sue, keep the reservation of rights. Removal after capture does not erase past use. Nolen says later suppression cannot moot a filed claim.

Tool 4: California follow-up letter

Purpose: press a broker that has not complied after a DROP or direct deletion request. Owner: California resident or authorized agent. Timing: after the statutory period has passed.

[Date]
[Registered data broker]

Re: Delete Act and CCPA request, DROP confirmation [number, if shown]

I submitted a deletion request through the California Delete Request and
Opt-out Platform on [date]. As of [date], the following still appears on your
service: [URL and description; capture attached].

Civil Code section 1798.99.86 requires a registered data broker to access the
platform at least every 45 days, to process requests within 45 days of receipt,
to direct its service providers and contractors to delete, and to continue
deleting and not sell or share new information unless an exception applies.

Please confirm within [10] days: (a) whether you claim an exception, and which;
(b) whether you claim the information is not "personal information" and the
basis; (c) if you could not verify me, that you have processed this as an
opt-out of sale and sharing; and (d) when the listing will come down.

If I do not hear from you, I intend to file a complaint with the California
Privacy Protection Agency.

[Name]

Drafting notes: Authority: Cal. Civ. Code § 1798.99.86(c), (d). Fines are set in Cal. Civ. Code § 1798.99.82(c), (d). Exceptions in Cal. Civ. Code § 1798.105(d) and the "publicly available" carve-out in Cal. Civ. Code § 1798.140 are the usual responses. A broker may also say it is outside the definition in Cal. Civ. Code § 1798.99.80 to the extent the FCRA covers it. If so, ask for its FCRA dispute process and use Tool 8. The status of a request can also be checked on the platform.

Tool 5: Safety-based removal request and sworn demand

Purpose: get priority handling, and, where available, trigger statutory protection. Owner: survivor with an advocate or lawyer. Timing: as soon as safe. Coordinate with your safety plan first.

Part A: letter to any site

[Date]
[Company], Attn: Trust & Safety / Legal

Re: Urgent safety request

Your site displays my home address and contact details at [URL]. I have reason
to fear for my safety and that of my household if this information remains
available. Please remove it immediately, suppress it against future updates,
and confirm by email at [safe address].

Please do not contact me by mail or phone. Please do not send confirmation to
any other address you hold for me. I will provide [program enrollment card /
court order number / advocate's letter] on request through [channel], if your
policy requires verification.

Part B: California Safe at Home participants, sworn demand

DEMAND UNDER GOVERNMENT CODE SECTION 6208.1(b)

To: [Person, business, or association]
I, [name], am a participant in the California Safe at Home program. I demand that
you not publicly post or publicly display on the internet or any other public
space my home address or home telephone number.

I declare under penalty of perjury under the laws of the State of California
that I am subject to the protection of Government Code section 6208.1, and that I
have a reasonable fear for my safety or that of a person residing at my home
address, based on [brief description of a violation of subdivision (a), per
counsel].

Executed on [date] at [city, state].    [Signature]
Contact only through: [program address or counsel]

Drafting notes:

Tool 6: Daniel's Law notice

Purpose: start the clock under a notice-based statute. Owner: covered person, authorized person, or their counsel. Timing: as soon as the disclosure is found.

[Date]
[Recipient], [address / designated email]
Sent by: [certified mail / email with read receipt / both]

Re: Written notice under N.J.S.A. 56:8-166.1

I am an authorized person under New Jersey's Daniel's Law. I am [a covered person
/ acting on behalf of a covered person], namely [active, formerly active, or
retired judicial officer, prosecutor, or law enforcement officer / immediate
family member residing in the same household].

I request that you cease disclosing and remove from the internet, and wherever
else you make it available, the following protected information:

  Home address: [ ]
  Unpublished home telephone number: [ ]
  Where it appears: [URLs, product names]

Under the statute, you may not disclose or re-disclose this information on the
internet or otherwise make it available beyond 10 business days after you receive
this notice. Please confirm completion in writing to [address].

Drafting notes:

  • Authority: N.J.S.A. 56:8-166.1(a), as quoted in Atlas Data Privacy Corp. v. We Inform, LLC (N.J. 2026). Check the current text and any Office of Information Privacy material for New Jersey forms.
  • Do not include more than the statute covers. A home address means the exact street address under Kratovil v. City of New Brunswick (N.J. 2025). That decision also shows the law can survive an as-applied First Amendment challenge from a journalist, on its facts.
  • If you are in West Virginia, Jackson v. Whitepages, Inc. (4th Cir. 2026) struck the damages provision, but it does not stop you from asking for voluntary removal, and federal judges can use the federal act. For other states, adjust the time period and addressee, for example 72 hours under Del. Code Ann. tit. 10, § 1923(b).
  • Assignments: a covered person may assign under the current New Jersey text. Read any platform's agreement with care. The Third Circuit has yet to rule on the statute's constitutionality.
  • Keep a list of each notice with date, method, and proof of receipt. That list is the case.

Tool 7: Re-check log

Purpose: catch reappearances and prove them. Owner: listed person or paid service. Timing: 45 days, 90 days, then quarterly.

Site and parent Request date and method Confirmation Check 1 (date, result) Check 2 Check 3 Reappeared? Capture file Next step
[ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ]

Drafting note: A relisting after a written confirmation is the best available fact for willfulness, which matters for punitive damages under 765 ILCS 1075/40(b). It is also the basis for a complaint about deception under 15 U.S.C. § 45, on the FTC's theory in its 2023 TruthFinder and Instant Checkmate action.

Tool 8: FCRA dispute and source request

Purpose: dispute a report used against you, and find out where it came from. Owner: the consumer. Timing: promptly after an adverse decision.

Part A: to the employer, landlord, or lender

You took action on my [application] on [date]. Please tell me whether you used
any report or information from a third party, identify the company that supplied
it, and provide a copy of what you received and any notice required under the
Fair Credit Reporting Act.

Part B: to the site or reseller

Your company supplied a report about me to [recipient] on or about [date]. I
dispute the following as inaccurate or incomplete: [item, reason, documents].

Please (1) conduct a reasonable reinvestigation and correct or delete the
information; (2) identify all sources; (3) identify everyone who received a
report in the past [two years] and the purpose certified; and (4) state your
position on consumer reporting agency status for this report.

If you contend you are not, please explain, in light of how this report was used
and marketed.

Drafting notes:

Tool 9: Claim evaluation worksheet by state

Purpose: test a publicity claim against the state's actual statute. Owner: counsel. Timing: before any demand. Confirm current text and limitations before relying on this table.

Factor California Illinois Ohio Indiana Washington
Statute Civ. Code § 3344 765 ILCS 1075/30 R.C. § 2741.02 Ind. Code § 32-36-1-8 RCW 63.60.050
Protected Name, voice, signature, photo, likeness "Identity": any attribute identifying to an ordinary viewer (1075/5) Persona, if commercial value (R.C. § 2741.01) Personality, if commercial value Name, voice, signature, photograph, likeness
Key use language "for purposes of advertising or selling"; direct connection is a fact question (subd. (e)) "public use or holding out" for sale, advertising, or fundraising "commercial purpose" "commercial purposes" Advertising, goods, or services use without consent
Consent Prior consent Previous written consent Written consent Written consent Consent
Minimum money $750 $1,000 (1075/40) $2,500 to $10,000 (R.C. § 2741.07) $1,000, under § 32-36-1-10 $3,000 civil penalty plus actual damages, under RCW 63.60.060 as amended in 2026
Fees Prevailing party Check Act and case law Check Act Check Act Prevailing party (RCW 63.60.060)
Limitations Two years; single publication per Callahan v. PeopleConnect Inc. One year per Bonilla v. Ancestry.com Operations, Inc. Confirm Confirm Confirm
Lead teaser case Kellman v. Spokeo, Inc.; Nolen Lukis v. Whitepages Inc., 454 F. Supp. 3d 746 Wilson v. Ancestry.com LLC; contra LaFleur v. Yardi Systems, Inc. Fry Carrera v. Whitepages Inc.; LaRock v. ZoomInfo Technologies LLC
Main adverse ruling Callahan v. Ancestry.com Inc. Hoffower; Bonilla v. Ancestry.com Operations, Inc. Wilson v. Ancestry.com LLC at summary judgment Fry warning on attorney-only views Few so far; watch RCW 63.60.070

Client-specific questions

Client: [ ]    Resident of: [ ]    Date page first public (best evidence): [ ]
Date discovered: [ ]       Limitations date: [ ]   Tolling theory, if any: [ ]
Commercial use before payment? [ ]  Describe screen: [ ]
Client has account? [ ]  Relative's account? [ ]  Lawyer's account? [ ]
Written consent ever? (school release, donation form, terms) [ ]
Commercial value facts (profession, prior licensing, site's own conduct): [ ]
Viewers other than client and counsel: [ ]   Evidence: [ ]
Actual damages: [ ]   Class coverage: [ ]   Opt-out date: [ ]
Best forum and personal jurisdiction facts: [ ]
Removal status (capture before removal?): [ ]
Recommendation: [remove only / regulator / demand / suit / class]

Drafting notes: Nolen's economic injury inference favors plaintiffs on commercial value, relying on Motschenbacher v. R.J. Reynolds Tobacco Co., 498 F.2d 821 (9th Cir. 1974), but it arose under California's statute, which has no commercial value element. A school release may matter too, although Nolen found samples that did not name the company inadequate. Note Callahan v. PeopleConnect Inc. (N.D. Cal. 2021) on copyright preemption of claims about reprints, under 17 U.S.C. § 301.

Tool 10: Viewership and standing worksheet

Purpose: decide what your proof of an audience is, before a defendant asks. Owner: counsel. Timing: pre-filing, and again after first discovery.

Question Facts Why it matters
Is there an indexed public profile URL? [ ] Supports public use without a search on the site; contrast Hoffower
Who other than client and counsel has seen it? [ ] Verde v. Confi-Chek, Inc.; TransUnion
Was the display triggered only by counsel's search? [ ] Fry; Dobija v. Accucom Corp.
Which user action triggers the ad? [ ] Wilson (hover over "view records")
Is the theory "searchable" or "searched"? [ ] Nolen left this for the merits, and flagged an adequacy conflict under Slade v. Progressive Security Insurance Co., 856 F.3d 408 (5th Cir. 2017)
Does the forum treat publication alone as concrete? [ ] Lukis v. Whitepages Inc., 549 F. Supp. 3d 798; Sessa v. Ancestry.com Operations Inc., 561 F. Supp. 3d 1008; Kellman v. Spokeo, Inc.
Emotional or dignitary harm with facts, or conclusory? [ ] Callahan v. Ancestry.com Inc. rejected bare distress and investigation time
Injunctive relief: certainly impending? [ ] Clapper v. Amnesty International USA, 568 U.S. 398 (2013) as applied in Verde; suppression may matter
If dismissed for standing, will state court hear it? [ ] Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives

Drafting note: Plead the common law analog using Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and plead third-party viewing separately. Use the Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing for allegation language.

Tool 11: Demand letter skeleton

Purpose: a credible pre-suit demand for an individual with good facts. Owner: counsel. Timing: after Tools 2, 9, and 10, and with limitations calendared.

[Date]        By email and overnight delivery
[Company], Attn: General Counsel

Re: Unauthorized commercial use of [Client]'s identity

We represent [Client]. Your site [name] displays [Client]'s [name, city, age range,
photo] at [URL] next to [quoted sales language], and uses that display to promote
[subscription]. [Client] never consented, has no account, and has no relationship
with you. [Third parties, including [description], have seen this display.]

This use violates [statute]. [One-sentence case support, such as: courts have held
that using identifying details in a free preview to advertise a subscription is
a commercial use.] Remedies include [statutory amount or actual damages and
attributable profits, fees, and injunctive relief].

We demand that you: (1) remove and suppress [Client]'s information across all
affiliated services within [10] days; (2) preserve all logs showing display of
and searches for [Client], your page templates, marketing tests, and terms
acceptance records; (3) tell us the date the page first became public and the
number of times it was displayed; and (4) contact us to resolve damages by
[date].

This letter does not waive any right. [Client] has not agreed to your terms.
[Signature]

Drafting notes: Avoid overstating. If your only viewer is your own investigator, do not imply otherwise, given Fed. R. Civ. P. 11. For California, remember that prevailing party fees run both ways. Limit threats to what you can file, under your state's ethics rules. Item (3) often elicits the log evidence that decides whether suit is worthwhile. The general structure of demand letters and the recipient's perspective are in Responding to a Consumer Class Action Demand Letter, and the Right of Publicity Toolkit: Releases, NIL Agreements, and Takedown Demands has further takedown language.

Tool 12: Named plaintiff vetting questionnaire

Purpose: find the facts that have ended earlier cases. Owner: class counsel. Timing: before filing or substitution.

1. Have you ever had an account on [site], its affiliates, or similar sites? Free?
   Trial? Old email addresses you used?
2. Has anyone (relative, friend, employer, investigator, lawyer) searched for you
   there at your request? Who, when, and using what account?
3. Did you donate a yearbook or sign a form allowing your school to share images?
4. How did you learn about this claim? Any advertisement or recruiter?
5. Who else has told you they saw the listing? Can they confirm in writing?
6. When did you first see it? When was it first posted, if you know?
7. Have you been harmed? Lost work, contact from strangers, distress with details?
8. Do you hold any interest in other suits over the same listing? Prior releases?
9. Is your name shared with a classmate or another listed person?
10. Do you still want your listing up during the case? (Suppression does not moot
    your claim, but discuss the injunctive class and evidence first.)

Drafting notes: Questions 1 to 3 respond to Nolen, footnote 1, where four former named plaintiffs had registered, and to Boshears v. PeopleConnect Inc. (W.D. Wash. 2024) on opt-out, authority, and ratification. Question 4 responds to Dobija. Question 9 responds to the identifiability dispute in Nolen, and Question 10 to the voluntary cessation point there. If counsel has used an account, deal with Callahan v. PeopleConnect (9th Cir. 2022) (unpublished), Blanton v. Womancare, Inc., 38 Cal. 3d 396 (1985), and Mackey v. PeopleConnect, Inc. (N.D. Ill. 2023) now. Do not wait for a motion.

Tool 13: Funnel audit worksheet

Purpose: map where identity meets a sales message. Owner: product counsel with product and marketing leads. Timing: before launch, at each redesign, and on receipt of the first claim.

Screen or email Who sees it (logged-out, free, paid) Identifiers shown Sales element Indexed? Logged at what level? Risk (H/M/L) Change or justification
Landing page search result [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Profile preview [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Hover or pop-up [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Registration prompt [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Banner beside results [ ] [ ] [ ] [ ] [ ] [ ] [ ]
"Hint" or marketing email [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Free trial view [ ] [ ] [ ] [ ] [ ] [ ] [ ]
Paid report (post-sale) [ ] [ ] [ ] [ ] [ ] [ ] [ ]

Drafting notes:

  • Post-sale screens are lower risk in Illinois under Huston v. Hearst Communications, Inc., 53 F.4th 1097 (7th Cir. 2022). Pre-sale screens drive Krause v. RocketReach, LLC (N.D. Ill. 2021).
  • The "hint email" row responds to Ancestry's practice as described in the Wilson and Bonilla orders.
  • The registration prompt and banner rows are the "sequence" and "banner" theories in Nolen.
  • Treat the audit as privileged legal work where possible. A redesign is a legitimate response to legal risk, but keep the record that explains it.

Tool 14: Defense framework matrix

Purpose: match each defense to stage, forum, and evidence. Owner: defense counsel. Timing: at the first claim.

Defense Best stage Support Adverse Evidence needed
No third-party view: no standing 12(b)(1) factual attack or summary judgment Verde; TransUnion; Fry; Wilson Lukis, 549 F. Supp. 3d 798; Kellman; Hoffower on standing Event logs, declarant with personal knowledge
No public use or holding out (Illinois) Summary judgment Hoffower; Bonilla; Huston Fischer (holding out need not be seen); Trannel v. Prairie Ridge Media, Inc., 987 N.E.2d 923 (Ill. App. Ct. 2013) Logs; proof of how pages render
Searchability is not use (California) Summary judgment or trial Nolen leaves the point open Callahan v. PeopleConnect (motion to dismiss denied) Ad flow evidence; jury question under Cal. Civ. Code § 3344(e)
Part of the product 12(b)(6) Dobrowolski, as described in Lukis Carrera; Green v. Datanyze, LLC Per-report pricing, no subscription upsell
Incidental use or no commercial value (Ohio, Indiana) 12(b)(6) LaFleur Wilson v. Ancestry.com LLC; Fry; Kellman Accurate historical context, no endorsement
Statutory exemptions 12(b)(6), usually later Limited; Harvey v. Systems Effect, L.L.C., 154 N.E.3d 293 (Ohio Ct. App. 2020); Nieman v. VersusLaw, Inc., 512 F. App'x 635 (7th Cir. 2013) Krause; Sessa; LaRock; Sant v. RocketReach LLC The reports themselves, in the record
Section 230 Pleading if clean; else summary judgment Callahan v. Ancestry; Kimzey v. Yelp! Inc., 836 F.3d 1263 (9th Cir. 2016); Dyroff v. Ultimate Software Group, Inc., 934 F.3d 1093 (9th Cir. 2019) Roommates.com; Huon v. Denton, 841 F.3d 733 (7th Cir. 2016); Mackey; Hepp on the IP carve-out, against CCBill Source licenses; proof content unchanged; proof it was provided for internet publication under Batzel v. Smith, 333 F.3d 1018 (9th Cir. 2003)
Anti-SLAPP Early, if at all Fee shifting if successful Batis v. Dun & Bradstreet Holdings, Inc., 106 F.4th 932 (9th Cir. 2024); Gopher Media LLC v. Melone (no immediate appeal); Callahan v. Ancestry Public issue connection, which is hard to find
Arbitration First motion Knapke (discovery on agency) Boshears; Callahan; Carrera Assent logs tied to a person
Limitations Pleadings or summary judgment Bonilla; Dobija; Callahan v. PeopleConnect Equitable exceptions; tolling under American Pipe & Construction Co. v. Utah, 414 U.S. 538 (1974) Page publication dates
Personal jurisdiction First response Sessa until reopened Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025); Lukis; Wilson Forum sales, targeting, source data
First Amendment Throughout Jackson; Sorrell v. IMS Health Inc., 564 U.S. 552 (2011); IMDb.com Inc. v. Becerra, 962 F.3d 1111 (9th Cir. 2020) Zacchini v. Scripps-Howard Broadcasting Co., 433 U.S. 562 (1977); Central Hudson Gas & Electric Corp. v. Public Service Commission, 447 U.S. 557 (1980); Krause on commercial speech Show the directory, not just the ad, is the target
Class certification Rule 23 Evidence of individualized issues Nolen; Briseno v. ConAgra Foods, Inc., 844 F.3d 1121 (9th Cir. 2017) Quantified, not speculative, proof

Drafting notes: Consistency matters. A company arguing it is merely a neutral directory for Section 230 and First Amendment purposes will have its marketing read back to it, and an argument that a page exists only upon search must fit with what its SEO team says. Daniel's Law sits on a separate line because it does not depend on advertising: see Atlas, Kratovil, and the district court's opinion in Atlas v. We Inform. For general class defense, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.

Tool 15: Terms of service clause bank and assent log

Purpose: terms that will bind people who actually agree. Owner: product counsel. Timing: before launch; on each change, with version control.

Clause A: Assent block (shown at sign-up, above the button)

By clicking "Create account," you agree to our Terms of Service [link] and Privacy
Policy [link], including the agreement to arbitrate and class action waiver in
Section [X].
[ Create account ]

Clause B: Scope and class waiver

You and [Company] agree to resolve any dispute arising out of or relating to your
use of the Services through binding individual arbitration under [rules], except
that either party may bring an individual action in small claims court. You and
[Company] waive any right to participate in a class or representative action.

Clause C: Opt-out

You may opt out of this arbitration agreement within 30 days of first accepting
these Terms by sending written notice to [address or email] with your name and
account email. Opting out does not affect the rest of these Terms.

Clause D: Use on behalf of another (use with care)

If you use the Services on behalf of another person, you represent that you have
that person's actual authority to do so. [Optional, with counsel's review:] and you
agree to these Terms on that person's behalf to the extent of that authority.

Clause E: Prohibited uses (FCRA)

[Company] is not a consumer reporting agency. You may not use the Services or any
information from them to make decisions about credit, insurance, employment,
housing, or any other purpose covered by the Fair Credit Reporting Act. We may
suspend accounts that do.

Assent log fields

user_id | email_hash | timestamp_utc | ip | terms_version | screen_version |
button_text | screenshot_ref | optout_received | optout_timestamp | on_behalf_flag

Drafting notes:

Declaration outline for a motion to compel

1. Declarant's role and basis for personal knowledge of the records.
2. How the sign-up flow appeared on [date] (attach screen version).
3. Log entry showing [person/email] clicked [button] at [time].
4. Terms version in effect (attach). Opt-out records searched; none found.
5. If relying on agency: facts showing the principal's authorization or ratification.
6. Alternative request for limited discovery on [topics].

Tool 16: Notice intake procedure and response templates

Purpose: meet deadlines and prove it. Owner: privacy operations lead, with counsel on escalation. Timing: continuous.

Procedure

  1. Receive. One monitored address and one physical address, published. Time-stamp on arrival.
  2. Classify within one business day: consumer deletion; DROP; Daniel's Law or equivalent; safety; FCRA dispute; legal demand.
  3. Suppress. Add the identifier to a suppression table that runs after every data refresh, across all brands and outbound feeds.
  4. Propagate. Instruct service providers, contractors, and data buyers, per Cal. Civ. Code § 1798.99.86(c)(1)(C).
  5. Verify. Test the public pages and search API. Record the result.
  6. Respond. Use a template, keep the record, and do not ask for more data than needed.
  7. Escalate to counsel: any bulk batch; any threat to safety; any demand letter; anything from a court or regulator.
  8. Hold. Trigger a litigation hold for logs and page templates for any demand or batch.
  9. Report monthly. Count, median time to complete, misses, and reasons.

Service levels to consider

Request Legal clock Internal target
New Jersey Daniel's Law 10 business days from receipt 3 business days
Delaware and similar 72 hours, per the statute as quoted in Jackson 24 hours
DROP Access at least every 45 days; process within 45 days Access every 30 days
Safety request Varies Same day
FCRA reinvestigation 15 U.S.C. § 1681i: generally 30 days 15 days

Template: Daniel's Law acknowledgment

We received your notice on [date/time]. We have [removed/are removing] the home
address and unpublished telephone number listed for [name] from [services], and
will keep them suppressed. If you are aware of other locations, please send URLs to
[address]. Sending this acknowledgment is not an admission of liability.

Template: request to clarify (never a reason to stop the clock)

We received your notice on [date/time] and have suppressed the records we could
match. To complete the request as to [other records], please provide [only the
specific missing item]. We do not need identification documents.

Drafting notes: The New Jersey Supreme Court in Atlas noted that a defendant might act with reasonable care and miss 10 business days, and it still found no mental state requirement for actual damages. Punitive damages require willful or reckless disregard, so records of good-faith processing help there, even if they do not bar actual damages. A defective notice argument needs counsel. The FTC's 2023 complaint makes a broken "Remove" button a liability under 15 U.S.C. § 45, so step 5 is not optional. Broader request handling is covered by the Data Subject Rights Request Handling Checklist: A Practical Checklist. For upstream data sourcing, see Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines.

Tool 17: Risk control register

Purpose: track who owns each control, and show diligence. Owner: general counsel or privacy lead. Timing: quarterly review.

Risk Control Owner Evidence kept Authority Status
Teaser treated as advertisement Remove identifiers near sales language; test alternatives Product Funnel audit (Tool 13) Lukis; Kellman [ ]
Searchable database treated as use Separate search index from ad flow where feasible Engineering Architecture memo Nolen [ ]
Unprovable logs Retention policy with hold trigger Security, Legal Policy and hold notices Hoffower; Wilson [ ]
Test searches polluting evidence Tag internal and investigator searches Engineering Log schema Dobija [ ]
Unregistered in a state Registration calendar; annual review of thresholds Compliance Filings Cal. Civ. Code § 1798.99.82; 9 V.S.A. § 2446; Tex. Bus. & Com. Code ch. 509; ORS 646A.593 [ ]
DROP failure Scheduled access and deletion; audit readiness for 2028 Privacy Ops Access logs Cal. Civ. Code § 1798.99.86 [ ]
Daniel's Law miss Tool 16 pipeline; surge staffing Privacy Ops Time-stamped log Atlas; Jackson [ ]
Safety exposure Human-reviewed channel Trust and Safety Case log Cal. Gov't Code § 6208.1 [ ]
FCRA characterization Use restrictions; marketing review; customer certification Legal, Marketing Reviewed copy 15 U.S.C. § 1681a; Kidd [ ]
Deceptive removal claims Periodic test of "Remove" and "Correct" features QA Test records 15 U.S.C. § 45 [ ]
Weak assent records Tool 15 log Engineering Log samples Berman [ ]
Upstream data rights Vendor warranties; scraping review Procurement, Legal Contracts Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims [ ]
Insurance gap Review personal and advertising injury coverage and exclusions Risk Broker letter Policy terms [ ]

This toolkit is general information and is not legal advice for a specific situation. Adapt every form to your own facts and jurisdiction, and check current statutory text before you send anything.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits