How to use this toolkit
Everything here is meant to be copied and adapted. Fill in the brackets, delete what does not apply, and read the drafting notes before sending anything, because small wording choices carry legal weight. A person sending Tool 3 from a kitchen table does not need Tool 13. An operator's general counsel may want nothing else.
The doctrine is in People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions. The sequence and judgment calls are in Removing Yourself From People-Search Sites and Evaluating a Publicity Claim: A Practical Guide. The check-off version is the People-Search Listing Response Checklist: A Practical Checklist.
Contents
For individuals:
- Routing matrix
- Evidence capture sheet
- General opt-out and deletion letter
- California follow-up letter
- Safety-based removal request and sworn demand
- Daniel's Law notice
- Re-check log
- FCRA dispute and source request
For counsel:
- Claim evaluation worksheet by state
- Viewership and standing worksheet
- Demand letter skeleton
- Named plaintiff vetting questionnaire
For operators:
- Funnel audit worksheet
- Defense framework matrix
- Terms of service clause bank and assent log
- Notice intake procedure and response templates
- Risk control register
Tool 1: Routing matrix
Purpose: send the problem down the right path. Owner: the listed person or intake lawyer. Timing: first conversation.
| If this is true | Go first to | Then |
|---|---|---|
| Someone may physically harm you | Advocate or police; Tool 5 | Tools 2, 3, 7 |
| You are a judge, prosecutor, officer, or household member | Tool 6; court or agency security office | Tools 2, 7 |
| California resident wanting removal only | DROP at privacy.ca.gov/drop | Tools 3, 4, 7 |
| Resident elsewhere wanting removal only | Tool 3 to each site and parent | Tool 7 |
| A report cost you a job, home, or credit | Tool 8 | Tools 2, 9 |
| Your photo or name is in a sales preview, and others saw it | Tools 2, 9, 10 | Tool 11, or a regulator complaint |
| You received a class notice | Read definition and opt-out date; Tool 9 | Counsel if your actual damages may exceed the floor |
| You are the company receiving any of these | Tool 16 | Tools 13, 14, 17 |
Drafting note: The order is deliberate. Under Nolen v. PeopleConnect, Inc. (9th Cir. 2026), an account can remove a person from a class altogether, so no row sends anyone to sign up on a site.
Tool 2: Evidence capture sheet
Purpose: preserve what the page said and how it was reached. Owner: listed person, or a paralegal who has not accepted the site's terms. Timing: before any removal request.
PEOPLE-SEARCH CAPTURE SHEET
Captured by: [name] Date/time/zone: [ ]
Device/browser: [ ] Logged in? [No: if yes, stop and ask counsel]
Site name: [ ] Full URL: [ ]
Parent company (from privacy page): [ ]
HOW REACHED
[ ] Search engine result. Engine and query: [ ]. Position: [ ]
[ ] Site's own search box. Query: [ ]
[ ] Link sent by another person. Who/when: [ ]
WHAT THE PAGE SHOWS ABOUT ME
Name [ ] Middle initial [ ] Age/range [ ] City [ ] Street address [ ]
Phone (blurred?) [ ] Email [ ] Relatives [ ] Photo [ ] Yearbook/school [ ]
Employer/title [ ] Other [ ]
SALES ELEMENTS ON THE SAME SCREEN
Button or link text: [ ] Price shown? [ ] Subscription language: [ ]
Next screen (only if reachable without accepting terms): [ ]
Terms pop-up or "Got it" prompt? [Describe. Do not click.]
ERRORS AND SENSITIVE ITEMS
[ ]
WHO ELSE HAS SEEN THIS
Person: [ ] How I know: [ ] Date: [ ] Evidence saved at: [ ]
FILES SAVED
PDF: [path] Image: [path] Hash, if counsel requests: [ ]
Drafting notes: The "how reached" block addresses the distinction that decided Hoffower v. Seamless Contacts Inc., 736 F. Supp. 3d 605 (N.D. Ill. 2024), and Wilson v. Ancestry.com LLC (S.D. Ohio 2024). The "who else" block answers Fry v. Ancestry.com Operations Inc. (N.D. Ind. 2023), which warned against reliance on displays to the plaintiff's lawyers. The "do not click" instruction reflects Knapke v. PeopleConnect, Inc., 38 F.4th 824 (9th Cir. 2022). For anyone with safety concerns, keep the sheet offline.
Tool 3: General opt-out and deletion letter
Purpose: request removal without agreeing to anything. Owner: listed person. Timing: after Tool 2. Send to: the privacy address on the site and parent.
[Date]
[Company], Attn: Privacy
[Address or email]
Re: Removal and suppression request
I am writing to request that you remove and suppress all information about me
from [site name] and every other site or service that you own, operate, or
supply.
Profile URL(s): [URL]
Name as listed: [name]
Other identifiers shown on your page, for matching only: [city/state]
Please (1) remove the listed profile(s) and any preview, search result, or
teaser that displays my name or identifying details; (2) suppress my
information so that it does not reappear when your data is refreshed; (3) stop
selling or sharing it; (4) direct your service providers and data recipients to
do the same; and (5) confirm in writing within [15] days what you have done and
which sites this covers.
[If applicable: I make this request under [state statute], including any right
to delete personal information and to opt out of sale or sharing.]
I do not consent to any commercial use of my name, image, or identity. I have
not created an account with you. This letter is not an acceptance of your terms
of service, and I do not agree to arbitration or any other term by sending it.
Nothing here waives any right or claim.
Please reply to [dedicated email].
[Name]
Drafting notes:
- The non-acceptance sentence responds to terms like those described in Fischer v. Instant Checkmate LLC (N.D. Ill. 2022), which treated people who search for themselves as consenting. Assent requires an unambiguous manifestation under Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022).
- The withdrawal of consent helps with the "without consent" element of Cal. Civ. Code § 3344 and 765 ILCS 1075/30, though these statutes put the burden of getting consent on the user anyway.
- Do not state a home address or phone number the site does not already show. Do not attach ID unless required, and if it is, redact it.
- If you may sue, keep the reservation of rights. Removal after capture does not erase past use. Nolen says later suppression cannot moot a filed claim.
Tool 4: California follow-up letter
Purpose: press a broker that has not complied after a DROP or direct deletion request. Owner: California resident or authorized agent. Timing: after the statutory period has passed.
[Date]
[Registered data broker]
Re: Delete Act and CCPA request, DROP confirmation [number, if shown]
I submitted a deletion request through the California Delete Request and
Opt-out Platform on [date]. As of [date], the following still appears on your
service: [URL and description; capture attached].
Civil Code section 1798.99.86 requires a registered data broker to access the
platform at least every 45 days, to process requests within 45 days of receipt,
to direct its service providers and contractors to delete, and to continue
deleting and not sell or share new information unless an exception applies.
Please confirm within [10] days: (a) whether you claim an exception, and which;
(b) whether you claim the information is not "personal information" and the
basis; (c) if you could not verify me, that you have processed this as an
opt-out of sale and sharing; and (d) when the listing will come down.
If I do not hear from you, I intend to file a complaint with the California
Privacy Protection Agency.
[Name]
Drafting notes: Authority: Cal. Civ. Code § 1798.99.86(c), (d). Fines are set in Cal. Civ. Code § 1798.99.82(c), (d). Exceptions in Cal. Civ. Code § 1798.105(d) and the "publicly available" carve-out in Cal. Civ. Code § 1798.140 are the usual responses. A broker may also say it is outside the definition in Cal. Civ. Code § 1798.99.80 to the extent the FCRA covers it. If so, ask for its FCRA dispute process and use Tool 8. The status of a request can also be checked on the platform.
Tool 5: Safety-based removal request and sworn demand
Purpose: get priority handling, and, where available, trigger statutory protection. Owner: survivor with an advocate or lawyer. Timing: as soon as safe. Coordinate with your safety plan first.
Part A: letter to any site
[Date]
[Company], Attn: Trust & Safety / Legal
Re: Urgent safety request
Your site displays my home address and contact details at [URL]. I have reason
to fear for my safety and that of my household if this information remains
available. Please remove it immediately, suppress it against future updates,
and confirm by email at [safe address].
Please do not contact me by mail or phone. Please do not send confirmation to
any other address you hold for me. I will provide [program enrollment card /
court order number / advocate's letter] on request through [channel], if your
policy requires verification.
Part B: California Safe at Home participants, sworn demand
DEMAND UNDER GOVERNMENT CODE SECTION 6208.1(b)
To: [Person, business, or association]
I, [name], am a participant in the California Safe at Home program. I demand that
you not publicly post or publicly display on the internet or any other public
space my home address or home telephone number.
I declare under penalty of perjury under the laws of the State of California
that I am subject to the protection of Government Code section 6208.1, and that I
have a reasonable fear for my safety or that of a person residing at my home
address, based on [brief description of a violation of subdivision (a), per
counsel].
Executed on [date] at [city, state]. [Signature]
Contact only through: [program address or counsel]
Drafting notes:
- Authority: Cal. Gov't Code § 6208.1(b). The statute calls for a sworn statement and says the demand lasts four years. Have counsel or the program review the basis-for-fear wording, because the subsection ties it to subdivision (a).
- Do not over-share. The site does not need your history, your abuser's name, or your new city.
- Do not send Part B from an old email account, and do not give an address the site lacks.
- A protective order may support the request even though it does not bind a data broker. See Obtaining and Defending a Protective Order: A Practical Guide and the Domestic Violence Response Toolkit: Petitions, Safety Plans, and Enforcement.
- Outside California, substitute the state's address confidentiality citation after checking its text. Statutes differ on whether they reach private publishers at all.
Tool 6: Daniel's Law notice
Purpose: start the clock under a notice-based statute. Owner: covered person, authorized person, or their counsel. Timing: as soon as the disclosure is found.
[Date]
[Recipient], [address / designated email]
Sent by: [certified mail / email with read receipt / both]
Re: Written notice under N.J.S.A. 56:8-166.1
I am an authorized person under New Jersey's Daniel's Law. I am [a covered person
/ acting on behalf of a covered person], namely [active, formerly active, or
retired judicial officer, prosecutor, or law enforcement officer / immediate
family member residing in the same household].
I request that you cease disclosing and remove from the internet, and wherever
else you make it available, the following protected information:
Home address: [ ]
Unpublished home telephone number: [ ]
Where it appears: [URLs, product names]
Under the statute, you may not disclose or re-disclose this information on the
internet or otherwise make it available beyond 10 business days after you receive
this notice. Please confirm completion in writing to [address].
Drafting notes:
- Authority: N.J.S.A. 56:8-166.1(a), as quoted in Atlas Data Privacy Corp. v. We Inform, LLC (N.J. 2026). Check the current text and any Office of Information Privacy material for New Jersey forms.
- Do not include more than the statute covers. A home address means the exact street address under Kratovil v. City of New Brunswick (N.J. 2025). That decision also shows the law can survive an as-applied First Amendment challenge from a journalist, on its facts.
- If you are in West Virginia, Jackson v. Whitepages, Inc. (4th Cir. 2026) struck the damages provision, but it does not stop you from asking for voluntary removal, and federal judges can use the federal act. For other states, adjust the time period and addressee, for example 72 hours under Del. Code Ann. tit. 10, § 1923(b).
- Assignments: a covered person may assign under the current New Jersey text. Read any platform's agreement with care. The Third Circuit has yet to rule on the statute's constitutionality.
- Keep a list of each notice with date, method, and proof of receipt. That list is the case.
Tool 7: Re-check log
Purpose: catch reappearances and prove them. Owner: listed person or paid service. Timing: 45 days, 90 days, then quarterly.
| Site and parent | Request date and method | Confirmation | Check 1 (date, result) | Check 2 | Check 3 | Reappeared? Capture file | Next step |
|---|---|---|---|---|---|---|---|
| [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
Drafting note: A relisting after a written confirmation is the best available fact for willfulness, which matters for punitive damages under 765 ILCS 1075/40(b). It is also the basis for a complaint about deception under 15 U.S.C. § 45, on the FTC's theory in its 2023 TruthFinder and Instant Checkmate action.
Tool 8: FCRA dispute and source request
Purpose: dispute a report used against you, and find out where it came from. Owner: the consumer. Timing: promptly after an adverse decision.
Part A: to the employer, landlord, or lender
You took action on my [application] on [date]. Please tell me whether you used
any report or information from a third party, identify the company that supplied
it, and provide a copy of what you received and any notice required under the
Fair Credit Reporting Act.
Part B: to the site or reseller
Your company supplied a report about me to [recipient] on or about [date]. I
dispute the following as inaccurate or incomplete: [item, reason, documents].
Please (1) conduct a reasonable reinvestigation and correct or delete the
information; (2) identify all sources; (3) identify everyone who received a
report in the past [two years] and the purpose certified; and (4) state your
position on consumer reporting agency status for this report.
If you contend you are not, please explain, in light of how this report was used
and marketed.
Drafting notes:
- Authority: 15 U.S.C. § 1681a(d), (f) (definitions); 15 U.S.C. § 1681b (permissible purpose); 15 U.S.C. § 1681e (procedures, including reasonable accuracy); 15 U.S.C. § 1681i (reinvestigation); 15 U.S.C. §§ 1681n and 1681o (remedies); 15 U.S.C. § 1681p (timing).
- Expect a disclaimer. Under Kidd v. Thomson Reuters Corp., 925 F.3d 99 (2d Cir. 2019), real policies aimed at excluding FCRA uses can defeat CRA status. Marketing to employers or landlords cuts the other way. Save any such marketing.
- TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) requires dissemination for damages standing, which a report to a landlord supplies. Henderson v. Source for Public Data, L.P., 53 F.4th 110 (4th Cir. 2022) limits a Section 230 response.
- For a broader dispute process, see the Identity Theft and Credit Report Toolkit: Freezes, Disputes, Blocks, and Litigation.
Tool 9: Claim evaluation worksheet by state
Purpose: test a publicity claim against the state's actual statute. Owner: counsel. Timing: before any demand. Confirm current text and limitations before relying on this table.
| Factor | California | Illinois | Ohio | Indiana | Washington |
|---|---|---|---|---|---|
| Statute | Civ. Code § 3344 | 765 ILCS 1075/30 | R.C. § 2741.02 | Ind. Code § 32-36-1-8 | RCW 63.60.050 |
| Protected | Name, voice, signature, photo, likeness | "Identity": any attribute identifying to an ordinary viewer (1075/5) | Persona, if commercial value (R.C. § 2741.01) | Personality, if commercial value | Name, voice, signature, photograph, likeness |
| Key use language | "for purposes of advertising or selling"; direct connection is a fact question (subd. (e)) | "public use or holding out" for sale, advertising, or fundraising | "commercial purpose" | "commercial purposes" | Advertising, goods, or services use without consent |
| Consent | Prior consent | Previous written consent | Written consent | Written consent | Consent |
| Minimum money | $750 | $1,000 (1075/40) | $2,500 to $10,000 (R.C. § 2741.07) | $1,000, under § 32-36-1-10 | $3,000 civil penalty plus actual damages, under RCW 63.60.060 as amended in 2026 |
| Fees | Prevailing party | Check Act and case law | Check Act | Check Act | Prevailing party (RCW 63.60.060) |
| Limitations | Two years; single publication per Callahan v. PeopleConnect Inc. | One year per Bonilla v. Ancestry.com Operations, Inc. | Confirm | Confirm | Confirm |
| Lead teaser case | Kellman v. Spokeo, Inc.; Nolen | Lukis v. Whitepages Inc., 454 F. Supp. 3d 746 | Wilson v. Ancestry.com LLC; contra LaFleur v. Yardi Systems, Inc. | Fry | Carrera v. Whitepages Inc.; LaRock v. ZoomInfo Technologies LLC |
| Main adverse ruling | Callahan v. Ancestry.com Inc. | Hoffower; Bonilla v. Ancestry.com Operations, Inc. | Wilson v. Ancestry.com LLC at summary judgment | Fry warning on attorney-only views | Few so far; watch RCW 63.60.070 |
Client-specific questions
Client: [ ] Resident of: [ ] Date page first public (best evidence): [ ]
Date discovered: [ ] Limitations date: [ ] Tolling theory, if any: [ ]
Commercial use before payment? [ ] Describe screen: [ ]
Client has account? [ ] Relative's account? [ ] Lawyer's account? [ ]
Written consent ever? (school release, donation form, terms) [ ]
Commercial value facts (profession, prior licensing, site's own conduct): [ ]
Viewers other than client and counsel: [ ] Evidence: [ ]
Actual damages: [ ] Class coverage: [ ] Opt-out date: [ ]
Best forum and personal jurisdiction facts: [ ]
Removal status (capture before removal?): [ ]
Recommendation: [remove only / regulator / demand / suit / class]
Drafting notes: Nolen's economic injury inference favors plaintiffs on commercial value, relying on Motschenbacher v. R.J. Reynolds Tobacco Co., 498 F.2d 821 (9th Cir. 1974), but it arose under California's statute, which has no commercial value element. A school release may matter too, although Nolen found samples that did not name the company inadequate. Note Callahan v. PeopleConnect Inc. (N.D. Cal. 2021) on copyright preemption of claims about reprints, under 17 U.S.C. § 301.
Tool 10: Viewership and standing worksheet
Purpose: decide what your proof of an audience is, before a defendant asks. Owner: counsel. Timing: pre-filing, and again after first discovery.
| Question | Facts | Why it matters |
|---|---|---|
| Is there an indexed public profile URL? | [ ] | Supports public use without a search on the site; contrast Hoffower |
| Who other than client and counsel has seen it? | [ ] | Verde v. Confi-Chek, Inc.; TransUnion |
| Was the display triggered only by counsel's search? | [ ] | Fry; Dobija v. Accucom Corp. |
| Which user action triggers the ad? | [ ] | Wilson (hover over "view records") |
| Is the theory "searchable" or "searched"? | [ ] | Nolen left this for the merits, and flagged an adequacy conflict under Slade v. Progressive Security Insurance Co., 856 F.3d 408 (5th Cir. 2017) |
| Does the forum treat publication alone as concrete? | [ ] | Lukis v. Whitepages Inc., 549 F. Supp. 3d 798; Sessa v. Ancestry.com Operations Inc., 561 F. Supp. 3d 1008; Kellman v. Spokeo, Inc. |
| Emotional or dignitary harm with facts, or conclusory? | [ ] | Callahan v. Ancestry.com Inc. rejected bare distress and investigation time |
| Injunctive relief: certainly impending? | [ ] | Clapper v. Amnesty International USA, 568 U.S. 398 (2013) as applied in Verde; suppression may matter |
| If dismissed for standing, will state court hear it? | [ ] | Federal Subject-Matter Jurisdiction: Arising Under, Diversity, Supplemental Claims, and the Defect That Never Waives |
Drafting note: Plead the common law analog using Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and plead third-party viewing separately. Use the Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing for allegation language.
Tool 11: Demand letter skeleton
Purpose: a credible pre-suit demand for an individual with good facts. Owner: counsel. Timing: after Tools 2, 9, and 10, and with limitations calendared.
[Date] By email and overnight delivery
[Company], Attn: General Counsel
Re: Unauthorized commercial use of [Client]'s identity
We represent [Client]. Your site [name] displays [Client]'s [name, city, age range,
photo] at [URL] next to [quoted sales language], and uses that display to promote
[subscription]. [Client] never consented, has no account, and has no relationship
with you. [Third parties, including [description], have seen this display.]
This use violates [statute]. [One-sentence case support, such as: courts have held
that using identifying details in a free preview to advertise a subscription is
a commercial use.] Remedies include [statutory amount or actual damages and
attributable profits, fees, and injunctive relief].
We demand that you: (1) remove and suppress [Client]'s information across all
affiliated services within [10] days; (2) preserve all logs showing display of
and searches for [Client], your page templates, marketing tests, and terms
acceptance records; (3) tell us the date the page first became public and the
number of times it was displayed; and (4) contact us to resolve damages by
[date].
This letter does not waive any right. [Client] has not agreed to your terms.
[Signature]
Drafting notes: Avoid overstating. If your only viewer is your own investigator, do not imply otherwise, given Fed. R. Civ. P. 11. For California, remember that prevailing party fees run both ways. Limit threats to what you can file, under your state's ethics rules. Item (3) often elicits the log evidence that decides whether suit is worthwhile. The general structure of demand letters and the recipient's perspective are in Responding to a Consumer Class Action Demand Letter, and the Right of Publicity Toolkit: Releases, NIL Agreements, and Takedown Demands has further takedown language.
Tool 12: Named plaintiff vetting questionnaire
Purpose: find the facts that have ended earlier cases. Owner: class counsel. Timing: before filing or substitution.
1. Have you ever had an account on [site], its affiliates, or similar sites? Free?
Trial? Old email addresses you used?
2. Has anyone (relative, friend, employer, investigator, lawyer) searched for you
there at your request? Who, when, and using what account?
3. Did you donate a yearbook or sign a form allowing your school to share images?
4. How did you learn about this claim? Any advertisement or recruiter?
5. Who else has told you they saw the listing? Can they confirm in writing?
6. When did you first see it? When was it first posted, if you know?
7. Have you been harmed? Lost work, contact from strangers, distress with details?
8. Do you hold any interest in other suits over the same listing? Prior releases?
9. Is your name shared with a classmate or another listed person?
10. Do you still want your listing up during the case? (Suppression does not moot
your claim, but discuss the injunctive class and evidence first.)
Drafting notes: Questions 1 to 3 respond to Nolen, footnote 1, where four former named plaintiffs had registered, and to Boshears v. PeopleConnect Inc. (W.D. Wash. 2024) on opt-out, authority, and ratification. Question 4 responds to Dobija. Question 9 responds to the identifiability dispute in Nolen, and Question 10 to the voluntary cessation point there. If counsel has used an account, deal with Callahan v. PeopleConnect (9th Cir. 2022) (unpublished), Blanton v. Womancare, Inc., 38 Cal. 3d 396 (1985), and Mackey v. PeopleConnect, Inc. (N.D. Ill. 2023) now. Do not wait for a motion.
Tool 13: Funnel audit worksheet
Purpose: map where identity meets a sales message. Owner: product counsel with product and marketing leads. Timing: before launch, at each redesign, and on receipt of the first claim.
| Screen or email | Who sees it (logged-out, free, paid) | Identifiers shown | Sales element | Indexed? | Logged at what level? | Risk (H/M/L) | Change or justification |
|---|---|---|---|---|---|---|---|
| Landing page search result | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Profile preview | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Hover or pop-up | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Registration prompt | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Banner beside results | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| "Hint" or marketing email | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Free trial view | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
| Paid report (post-sale) | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |
Drafting notes:
- Post-sale screens are lower risk in Illinois under Huston v. Hearst Communications, Inc., 53 F.4th 1097 (7th Cir. 2022). Pre-sale screens drive Krause v. RocketReach, LLC (N.D. Ill. 2021).
- The "hint email" row responds to Ancestry's practice as described in the Wilson and Bonilla orders.
- The registration prompt and banner rows are the "sequence" and "banner" theories in Nolen.
- Treat the audit as privileged legal work where possible. A redesign is a legitimate response to legal risk, but keep the record that explains it.
Tool 14: Defense framework matrix
Purpose: match each defense to stage, forum, and evidence. Owner: defense counsel. Timing: at the first claim.
| Defense | Best stage | Support | Adverse | Evidence needed |
|---|---|---|---|---|
| No third-party view: no standing | 12(b)(1) factual attack or summary judgment | Verde; TransUnion; Fry; Wilson | Lukis, 549 F. Supp. 3d 798; Kellman; Hoffower on standing | Event logs, declarant with personal knowledge |
| No public use or holding out (Illinois) | Summary judgment | Hoffower; Bonilla; Huston | Fischer (holding out need not be seen); Trannel v. Prairie Ridge Media, Inc., 987 N.E.2d 923 (Ill. App. Ct. 2013) | Logs; proof of how pages render |
| Searchability is not use (California) | Summary judgment or trial | Nolen leaves the point open | Callahan v. PeopleConnect (motion to dismiss denied) | Ad flow evidence; jury question under Cal. Civ. Code § 3344(e) |
| Part of the product | 12(b)(6) | Dobrowolski, as described in Lukis | Carrera; Green v. Datanyze, LLC | Per-report pricing, no subscription upsell |
| Incidental use or no commercial value (Ohio, Indiana) | 12(b)(6) | LaFleur | Wilson v. Ancestry.com LLC; Fry; Kellman | Accurate historical context, no endorsement |
| Statutory exemptions | 12(b)(6), usually later | Limited; Harvey v. Systems Effect, L.L.C., 154 N.E.3d 293 (Ohio Ct. App. 2020); Nieman v. VersusLaw, Inc., 512 F. App'x 635 (7th Cir. 2013) | Krause; Sessa; LaRock; Sant v. RocketReach LLC | The reports themselves, in the record |
| Section 230 | Pleading if clean; else summary judgment | Callahan v. Ancestry; Kimzey v. Yelp! Inc., 836 F.3d 1263 (9th Cir. 2016); Dyroff v. Ultimate Software Group, Inc., 934 F.3d 1093 (9th Cir. 2019) | Roommates.com; Huon v. Denton, 841 F.3d 733 (7th Cir. 2016); Mackey; Hepp on the IP carve-out, against CCBill | Source licenses; proof content unchanged; proof it was provided for internet publication under Batzel v. Smith, 333 F.3d 1018 (9th Cir. 2003) |
| Anti-SLAPP | Early, if at all | Fee shifting if successful | Batis v. Dun & Bradstreet Holdings, Inc., 106 F.4th 932 (9th Cir. 2024); Gopher Media LLC v. Melone (no immediate appeal); Callahan v. Ancestry | Public issue connection, which is hard to find |
| Arbitration | First motion | Knapke (discovery on agency) | Boshears; Callahan; Carrera | Assent logs tied to a person |
| Limitations | Pleadings or summary judgment | Bonilla; Dobija; Callahan v. PeopleConnect | Equitable exceptions; tolling under American Pipe & Construction Co. v. Utah, 414 U.S. 538 (1974) | Page publication dates |
| Personal jurisdiction | First response | Sessa until reopened | Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025); Lukis; Wilson | Forum sales, targeting, source data |
| First Amendment | Throughout | Jackson; Sorrell v. IMS Health Inc., 564 U.S. 552 (2011); IMDb.com Inc. v. Becerra, 962 F.3d 1111 (9th Cir. 2020) | Zacchini v. Scripps-Howard Broadcasting Co., 433 U.S. 562 (1977); Central Hudson Gas & Electric Corp. v. Public Service Commission, 447 U.S. 557 (1980); Krause on commercial speech | Show the directory, not just the ad, is the target |
| Class certification | Rule 23 | Evidence of individualized issues | Nolen; Briseno v. ConAgra Foods, Inc., 844 F.3d 1121 (9th Cir. 2017) | Quantified, not speculative, proof |
Drafting notes: Consistency matters. A company arguing it is merely a neutral directory for Section 230 and First Amendment purposes will have its marketing read back to it, and an argument that a page exists only upon search must fit with what its SEO team says. Daniel's Law sits on a separate line because it does not depend on advertising: see Atlas, Kratovil, and the district court's opinion in Atlas v. We Inform. For general class defense, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.
Tool 15: Terms of service clause bank and assent log
Purpose: terms that will bind people who actually agree. Owner: product counsel. Timing: before launch; on each change, with version control.
Clause A: Assent block (shown at sign-up, above the button)
By clicking "Create account," you agree to our Terms of Service [link] and Privacy
Policy [link], including the agreement to arbitrate and class action waiver in
Section [X].
[ Create account ]
Clause B: Scope and class waiver
You and [Company] agree to resolve any dispute arising out of or relating to your
use of the Services through binding individual arbitration under [rules], except
that either party may bring an individual action in small claims court. You and
[Company] waive any right to participate in a class or representative action.
Clause C: Opt-out
You may opt out of this arbitration agreement within 30 days of first accepting
these Terms by sending written notice to [address or email] with your name and
account email. Opting out does not affect the rest of these Terms.
Clause D: Use on behalf of another (use with care)
If you use the Services on behalf of another person, you represent that you have
that person's actual authority to do so. [Optional, with counsel's review:] and you
agree to these Terms on that person's behalf to the extent of that authority.
Clause E: Prohibited uses (FCRA)
[Company] is not a consumer reporting agency. You may not use the Services or any
information from them to make decisions about credit, insurance, employment,
housing, or any other purpose covered by the Fair Credit Reporting Act. We may
suspend accounts that do.
Assent log fields
user_id | email_hash | timestamp_utc | ip | terms_version | screen_version |
button_text | screenshot_ref | optout_received | optout_timestamp | on_behalf_flag
Drafting notes:
- Clause A follows the conspicuous-notice, unambiguous-assent test of Berman and Nguyen v. Barnes & Noble Inc., 763 F.3d 1171 (9th Cir. 2014). A site-entry pop-up with a "Got it" button is weak, and without proof that the person clicked it the motion fails, as Carrera shows.
- Clause C mirrors the 30-day provision in the Classmates terms. In Boshears, an agent's opt-out was held effective, so draft it knowing a lawyer may use it.
- Clause D will not bind a real stranger. Agency turns on the principal's conduct under state law. See Arthur Andersen LLP v. Carlisle, 556 U.S. 624 (2009) and Flores v. Evergreen at San Diego, LLC, 148 Cal. App. 4th 581 (2007). Knapke gives you discovery rather than a win.
- Clause E only helps if conduct matches. See Kidd and the FTC's enforcement history, under 15 U.S.C. § 1681b.
- I have left out a clause deeming self-searches to be consent. Such clauses exist, as Nolen and Fischer report. Enforceability against a person checking on their own data is unsettled, and it can look like the problem the law is aimed at. If you use one, have a reason, get real assent, and prepare to defend it.
- Before adopting mass-filing provisions, see the Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans and the Motion to Compel Arbitration Toolkit: Clauses, Declarations, and Appellate Strategy.
Declaration outline for a motion to compel
1. Declarant's role and basis for personal knowledge of the records.
2. How the sign-up flow appeared on [date] (attach screen version).
3. Log entry showing [person/email] clicked [button] at [time].
4. Terms version in effect (attach). Opt-out records searched; none found.
5. If relying on agency: facts showing the principal's authorization or ratification.
6. Alternative request for limited discovery on [topics].
Tool 16: Notice intake procedure and response templates
Purpose: meet deadlines and prove it. Owner: privacy operations lead, with counsel on escalation. Timing: continuous.
Procedure
- Receive. One monitored address and one physical address, published. Time-stamp on arrival.
- Classify within one business day: consumer deletion; DROP; Daniel's Law or equivalent; safety; FCRA dispute; legal demand.
- Suppress. Add the identifier to a suppression table that runs after every data refresh, across all brands and outbound feeds.
- Propagate. Instruct service providers, contractors, and data buyers, per Cal. Civ. Code § 1798.99.86(c)(1)(C).
- Verify. Test the public pages and search API. Record the result.
- Respond. Use a template, keep the record, and do not ask for more data than needed.
- Escalate to counsel: any bulk batch; any threat to safety; any demand letter; anything from a court or regulator.
- Hold. Trigger a litigation hold for logs and page templates for any demand or batch.
- Report monthly. Count, median time to complete, misses, and reasons.
Service levels to consider
| Request | Legal clock | Internal target |
|---|---|---|
| New Jersey Daniel's Law | 10 business days from receipt | 3 business days |
| Delaware and similar | 72 hours, per the statute as quoted in Jackson | 24 hours |
| DROP | Access at least every 45 days; process within 45 days | Access every 30 days |
| Safety request | Varies | Same day |
| FCRA reinvestigation | 15 U.S.C. § 1681i: generally 30 days | 15 days |
Template: Daniel's Law acknowledgment
We received your notice on [date/time]. We have [removed/are removing] the home
address and unpublished telephone number listed for [name] from [services], and
will keep them suppressed. If you are aware of other locations, please send URLs to
[address]. Sending this acknowledgment is not an admission of liability.
Template: request to clarify (never a reason to stop the clock)
We received your notice on [date/time] and have suppressed the records we could
match. To complete the request as to [other records], please provide [only the
specific missing item]. We do not need identification documents.
Drafting notes: The New Jersey Supreme Court in Atlas noted that a defendant might act with reasonable care and miss 10 business days, and it still found no mental state requirement for actual damages. Punitive damages require willful or reckless disregard, so records of good-faith processing help there, even if they do not bar actual damages. A defective notice argument needs counsel. The FTC's 2023 complaint makes a broken "Remove" button a liability under 15 U.S.C. § 45, so step 5 is not optional. Broader request handling is covered by the Data Subject Rights Request Handling Checklist: A Practical Checklist. For upstream data sourcing, see Computer Access Dispute Toolkit: Access Revocation Letters, Loss Worksheets, and Pleading Outlines.
Tool 17: Risk control register
Purpose: track who owns each control, and show diligence. Owner: general counsel or privacy lead. Timing: quarterly review.
| Risk | Control | Owner | Evidence kept | Authority | Status |
|---|---|---|---|---|---|
| Teaser treated as advertisement | Remove identifiers near sales language; test alternatives | Product | Funnel audit (Tool 13) | Lukis; Kellman | [ ] |
| Searchable database treated as use | Separate search index from ad flow where feasible | Engineering | Architecture memo | Nolen | [ ] |
| Unprovable logs | Retention policy with hold trigger | Security, Legal | Policy and hold notices | Hoffower; Wilson | [ ] |
| Test searches polluting evidence | Tag internal and investigator searches | Engineering | Log schema | Dobija | [ ] |
| Unregistered in a state | Registration calendar; annual review of thresholds | Compliance | Filings | Cal. Civ. Code § 1798.99.82; 9 V.S.A. § 2446; Tex. Bus. & Com. Code ch. 509; ORS 646A.593 | [ ] |
| DROP failure | Scheduled access and deletion; audit readiness for 2028 | Privacy Ops | Access logs | Cal. Civ. Code § 1798.99.86 | [ ] |
| Daniel's Law miss | Tool 16 pipeline; surge staffing | Privacy Ops | Time-stamped log | Atlas; Jackson | [ ] |
| Safety exposure | Human-reviewed channel | Trust and Safety | Case log | Cal. Gov't Code § 6208.1 | [ ] |
| FCRA characterization | Use restrictions; marketing review; customer certification | Legal, Marketing | Reviewed copy | 15 U.S.C. § 1681a; Kidd | [ ] |
| Deceptive removal claims | Periodic test of "Remove" and "Correct" features | QA | Test records | 15 U.S.C. § 45 | [ ] |
| Weak assent records | Tool 15 log | Engineering | Log samples | Berman | [ ] |
| Upstream data rights | Vendor warranties; scraping review | Procurement, Legal | Contracts | Data Scraping After hiQ v. LinkedIn: Copyright, Contract, and Computer Fraud Claims | [ ] |
| Insurance gap | Review personal and advertising injury coverage and exclusions | Risk | Broker letter | Policy terms | [ ] |
This toolkit is general information and is not legal advice for a specific situation. Adapt every form to your own facts and jurisdiction, and check current statutory text before you send anything.
Related Documents
Related Articles
- People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions: the case law these forms rely on.
- Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: background for the defense matrix.
- The Right of Publicity and the First Amendment: Transformative Use, Newsworthiness, and the Limits of Owning a Persona: background on constitutional defenses.
Related Guides
- Removing Yourself From People-Search Sites and Evaluating a Publicity Claim: A Practical Guide: how and when to use these papers.
- Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal: forum strategy that follows a standing dispute.
Related Checklists
- People-Search Listing Response Checklist: A Practical Checklist: the tasks these tools support.
Related Toolkits
- Privacy Toolkit: Deletion Requests, Report Disputes, and Surveillance Responses: other privacy letters.
- Class Action Defense Toolkit: From Complaint Through Settlement Approval: for what comes after Tool 14.
