Summary. Seventeen templates, highest-value first.
1. Data map worksheet
WHO HAS MY DATA — build this once
CATEGORY 1: COMPANIES I HAVE A RELATIONSHIP WITH
My leverage: state privacy law rights · sector rules · ACCOUNT SETTINGS
(the fastest lever and the most underused)
COMPANY WHAT THEY HAVE RIGHT AVAILABLE DONE
______________________ __________________ ______________ [ ]
______________________ __________________ ______________ [ ]
[banks · card issuers · insurers · employer · landlord/servicer ·
utilities · telecom · health providers · pharmacies · schools ·
loyalty programs · every app with an account]
CATEGORY 2: CONSUMER REPORTING AGENCIES
My leverage: THE STRONGEST RIGHTS I HAVE — access, dispute, accuracy
obligations, time limits, permissible purpose limits, adverse action
AGENCY PULLED FROZEN ERRORS FOUND DISPUTED
Equifax ________ [ ] ____________ [ ]
Experian ________ [ ] ____________ [ ]
TransUnion ________ [ ] ____________ [ ]
Tenant screening #1 ________ [ ] ____________ [ ]
Tenant screening #2 ________ [ ] ____________ [ ]
Employment screening ________ [ ] ____________ [ ]
Check/bank screening ________ [ ] ____________ [ ]
Insurance claims history ________ [ ] ____________ [ ]
Medical information ________ [ ] ____________ [ ]
Utility/telecom payment ________ [ ] ____________ [ ]
Gig platform screening ________ [ ] ____________ [ ]
CATEGORY 3: DATA BROKERS (no relationship with me)
My leverage: opt-outs · state privacy law · state broker registry ·
address confidentiality program
See the opt-out log, Template 3.
CATEGORY 4: GOVERNMENT
Federal agencies — access AND amendment under 5 U.S.C. § 552a
State agencies — state public records and privacy laws
Courts — largely public; sealing or expungement addresses the SOURCE
Property, voter, licensing, business filings — public
AGENCY/RECORD WHAT IT SHOWS ACTION DONE
______________________ __________________ ______________ [ ]
CATEGORY 5: PEOPLE
My leverage: revoke access; criminal and civil remedies if it crosses
a line. See Template 15.
PERSON WHAT ACCESS THEY HAVE REMOVED
______________________ ______________________________________ [ ]
2. Freeze and lock tracker
FREEZE TRACKER — the highest-value protections, all free
CREDIT BUREAUS
AGENCY FROZEN DATE PIN/ACCOUNT STORED WHERE
Equifax [ ] ________ ______________________
Experian [ ] ________ ______________________
TransUnion [ ] ________ ______________________
SPECIALTY AGENCIES — where account fraud actually happens
Check/bank screening [ ] ________ ______________
Telecom/utility payment [ ] ________ ______________
Insurance claims history [ ] ________ ______________
Tenant screening (each) [ ] ________ ______________
Employment screening [ ] ________ ______________
Other: ______________ [ ] ________ ______________
MINOR CHILDREN — free in every state; prevents the fraud typically
discovered at age 18
Child ____________ Equifax [ ] Experian [ ] TransUnion [ ] ______
Child ____________ Equifax [ ] Experian [ ] TransUnion [ ] ______
MOBILE ACCOUNT — this is what defeats SIM swapping
Carrier: ______________
[ ] Port-out PIN / account passcode set on ________
[ ] Asked what is required to port the number or change the SIM;
answer: ______________________
[ ] Strongest available option selected
[ ] Authorized users on the account reviewed: ______________
OTHER OPT-OUTS
[ ] Pre-screened credit offers opted out ________ (5-year / permanent)
[ ] National do-not-call registered ________
[ ] Mail forwarding commercial-use opt-out asked about ________
[ ] Financial privacy notice sharing opt-out exercised ________
[ ] Directory information opted out at school ________
VERIFY ANNUALLY: freezes can be lifted and forgotten.
Last verified: ________ Next: ________
3. People-search opt-out log
OPT-OUT LOG — this has to repeat; that is normal, not a failure
SITE PROFILE URL OPT-OUT CONF. RE-CHECK
SUBMITTED REC'D DUE
__________________ _________________ ________ [ ] ________
__________________ _________________ ________ [ ] ________
__________________ _________________ ________ [ ] ________
__________________ _________________ ________ [ ] ________
__________________ _________________ ________ [ ] ________
BEFORE OPTING OUT
[ ] Screenshot each profile with the URL and date visible
(removal destroys the evidence of what was published)
[ ] Note what each profile exposed: address [ ] prior addresses [ ]
phone [ ] relatives [ ] employer [ ] age/DOB [ ] other ________
SEARCHES RUN
[ ] Full name, engine 1 ________ engine 2 ________
[ ] Name + current city [ ] Name + former city
[ ] Name + employer [ ] Images tab
[ ] Phone number [ ] Email address
[ ] Spouse / parent / adult child name
(their profiles frequently list MY address)
STATE-LEVEL TOOLS
[ ] Does my state have a comprehensive privacy law? Yes / No
-> if yes, send Template 4 to the largest brokers
[ ] Does my state have a DATA BROKER REGISTRY? Yes / No
-> if yes, it is the closest thing to a complete target list.
Registry reviewed on ________; requests sent to ____ brokers
[ ] Single deletion mechanism directed at all registered brokers?
Yes / No Used on ________
IF SAFETY IS THE CONCERN
[ ] ADDRESS CONFIDENTIALITY PROGRAM — my state has one? Yes / No
Enrolled ________ (This addresses the SOURCE, not just the
republication. It is far stronger than site-by-site opt-outs.)
[ ] PO box or commercial mail address for anything that becomes public
[ ] Family asked to lock down their profiles
[ ] My own posts audited for home, routine, workplace, children's school
NEXT FULL RE-CHECK: ________ (every six months)
4. State privacy law request
[Date]
[Company privacy contact — from the privacy policy]
[Address / email / webform]
RE: Consumer rights request under [STATE] privacy law
Requester: ______________
Email associated with the account: ______________
Account or customer number, if any: ______________
State of residence: ______________
I am a resident of [state] and I am exercising my rights under [state
statute]. I am making the following requests:
[ ] RIGHT TO KNOW / ACCESS. Please provide:
a. the specific pieces of personal information you have collected
about me;
b. the categories of personal information collected;
c. the categories of SOURCES from which it was collected;
d. the business or commercial purpose for collecting or selling it;
e. the categories of THIRD PARTIES to whom you have disclosed,
sold, or shared it, and the categories of information disclosed
to each;
f. whether you have sold or shared my personal information, and to
whom.
Time period: [the maximum your statute allows / from ________ to the
present].
[ ] RIGHT TO DELETE. Please delete all personal information you have
collected about me, and direct any service providers, processors,
and third parties to whom you disclosed it to do the same. Please
identify any information you retain and the specific statutory
exception you rely on for each.
[ ] RIGHT TO CORRECT. The following information you maintain about me is
inaccurate: ______________________________.
The accurate information is: ______________________________.
Documentation is attached.
[ ] OPT OUT OF SALE AND OF SHARING for targeted advertising. Please
record this as an opt-out and confirm it applies across all my
identifiers, including those you have associated with me.
[ ] LIMIT THE USE AND DISCLOSURE OF MY SENSITIVE PERSONAL INFORMATION to
what is necessary to perform the services requested.
[ ] I am also enabling a universal opt-out preference signal in my
browser and expect it to be honored where required.
IDENTITY VERIFICATION
I am providing the following to verify my identity as your policy
requires: ______________________________.
If you need something further, please tell me specifically what, and I
will provide it. [Most refusals are verification failures, not
substantive denials — so make this easy.]
RESPONSE
Please respond within [__] days, as [state statute] requires, and
confirm receipt of this request now. Please respond in writing to
[email/address].
If you contend you are not subject to [state statute], please say so
expressly and state the basis.
______________________ · [Address] · [Email] · [Phone]
Sent by ______________ on ________; confirmation ____________
5. Consumer report dispute letter
The single most valuable letter in this toolkit.
[Date]
[Consumer reporting agency — dispute address]
RE: DISPUTE OF INACCURATE INFORMATION
Consumer: [Full legal name, including middle name]
Date of birth: ____/____/______
Current address: ______________________________
Prior addresses (last 5 years): ______________________
Social Security number: xxx-xx-____
Report/file number: ______________ Report dated: ________
I am disputing information in my file under 15 U.S.C. § 1681i. Please
conduct a reasonable reinvestigation and forward ALL information I
provide to the furnisher, as the statute requires.
DISPUTED ITEM 1
Item as reported: ______________________________
Account/case/record number: ______________
Furnisher/source: ______________________
WHY IT IS INACCURATE:
[ ] THIS IS NOT MY ACCOUNT/RECORD. It belongs to a different person
with a similar name. My full name is ______________; the record
shows ______________. My date of birth is ________; the record
shows ________. I have never lived at ______________. This is a
MIXED FILE, and reporting it does not comply with the requirement
in 15 U.S.C. § 1681e to follow reasonable procedures to assure
MAXIMUM POSSIBLE ACCURACY.
[ ] THIS RECORD IS OUTSIDE THE REPORTING PERIOD. The item is dated
________, which is more than [__] years old. 15 U.S.C. § 1681c
bars reporting it.
[ ] THIS IS AN ARREST THAT DID NOT RESULT IN A CONVICTION, dated
________, and is outside the permitted reporting period.
[ ] THIS EVICTION CASE WAS DISMISSED. Case number ______, dismissed on
________. The docket is attached. Reporting a dismissed filing as
an eviction is inaccurate and materially misleading.
[ ] THE STATUS IS WRONG. It reports ______________; the correct status
is ______________.
[ ] THE BALANCE/DATE IS WRONG. It reports $______ / ________; correct
is $______ / ________.
[ ] THIS ACCOUNT IS A DUPLICATE of ______________.
[ ] THIS ACCOUNT RESULTED FROM IDENTITY THEFT. See my separate block
request, Template 13.
[ ] THIS INQUIRY WAS NOT AUTHORIZED. I did not initiate any
transaction with ______________ and there was no permissible
purpose under 15 U.S.C. § 1681b.
PROOF ENCLOSED: ______________________________
ACTION REQUESTED: delete this item.
DISPUTED ITEM 2
[Repeat the structure.]
ALSO REQUESTED
1. Provide the results of the reinvestigation in writing.
2. Provide the name, address, and telephone number of each furnisher
contacted.
3. Provide a description of the procedure used to determine the
accuracy, as 15 U.S.C. § 1681i permits me to request.
4. Send corrected reports to everyone who received a report about me
in the last [six months / two years for employment purposes], and
tell me who they were.
5. Provide a free copy of my file after the reinvestigation.
6. If any item is verified rather than deleted, state the specific
evidence relied on and add my statement of dispute to the file.
ENCLOSED
[ ] Copy of my government-issued identification
[ ] Proof of current address (utility bill or bank statement)
[ ] Copy of the report with the disputed items marked
[ ] Supporting documentation, numbered
______________________ Date: ________
[Address] · [Phone]
SENT CERTIFIED MAIL, RETURN RECEIPT REQUESTED, tracking ____________
KEEP: a complete copy of everything sent, the certified receipt, and the
green card. This is your evidence if the dispute fails.
6. Furnisher dispute letter
Send this at the same time as Template 5. Disputing with only the agency is half the job.
[Date]
[Furnisher — the creditor, landlord, records vendor, or court data
provider that supplied the information]
RE: Dispute of information you furnished to consumer reporting agencies
Consumer: ______________
Account/case/record number: ______________
Date of birth: ________ SSN: xxx-xx-____
You have furnished the following information about me to one or more
consumer reporting agencies: ______________________________.
That information is inaccurate. Specifically:
______________________________________________________________
______________________________________________________________
Documentation is enclosed: ______________________________.
I request that you:
1. Investigate this dispute;
2. Correct or delete the inaccurate information;
3. Notify EVERY consumer reporting agency to which you furnished it,
including [name them], of the correction or deletion;
4. Confirm to me in writing what you have done;
5. Cease furnishing the information you know or should know is
inaccurate.
I have also disputed this with [agencies] on ________. Under the Fair
Credit Reporting Act you have obligations upon receiving a dispute from
a consumer reporting agency, and separate obligations upon receiving
this direct dispute.
______________________ · [Address] · [Phone]
Sent certified mail, tracking ____________
7. Adverse action information request
[Date]
[Landlord / employer / lender / insurer]
RE: Request for information following adverse action
Applicant: ______________
Application for: ______________ Dated: ________
Decision received: ________
You informed me on ________ that my application was [denied / approved
on less favorable terms]. You indicated the decision was based in whole
or in part on information in a consumer report.
I request the following, which I am entitled to receive:
1. The NAME, ADDRESS, and TELEPHONE NUMBER of the consumer reporting
agency that furnished the report, including a toll-free number if
the agency compiles and maintains files nationwide.
2. A statement that the agency did not make the decision and cannot
explain why it was made.
3. Notice of my right to obtain a FREE COPY of the report from that
agency within the applicable period, and of my right to dispute the
accuracy or completeness of any information in it.
4. A copy of the report you relied on, if you retain one.
5. [FOR EMPLOYMENT] A copy of the report and a summary of my rights,
which should have been provided to me BEFORE adverse action was
taken so that I could respond. If that was not provided, please
explain.
6. The specific information in the report that contributed to the
decision.
I believe the report may contain inaccurate information. I intend to
dispute it, and I ask that you HOLD THE APPLICATION OPEN or agree to
RECONSIDER once corrected information is available. Please confirm
whether you will do so.
______________________ · [Address] · [Phone] · [Email]
NOTE TO SELF: for employment, a standalone written disclosure and my
written authorization were required BEFORE the report was obtained, and
a pre-adverse action notice with a copy of the report and a summary of
rights was required BEFORE the decision. The absence of either is itself
a violation worth raising.
8. Tenant screening dispute
[Date]
[Tenant screening company — dispute address]
RE: Dispute — tenant screening report
Consumer: [Full legal name with middle name]
DOB: ____/____/______ SSN: xxx-xx-____
Current address: ______________________
Report/reference number: ______________ Dated: ________
Requested by: [property/management company]
I dispute the following information under 15 U.S.C. § 1681i.
ITEM: [describe exactly as it appears]
THE PROBLEM
[ ] WRONG PERSON — MIXED FILE
The record identifies "______________." My full legal name is
"______________." The record shows a date of birth of ________; mine
is ________. The record's address is ______________; I have never
resided there. Enclosed: my driver's license, my lease history for
the relevant period, and the court docket showing the other
individual's full identifying information.
Reporting this record as mine does not satisfy the requirement of
reasonable procedures to assure MAXIMUM POSSIBLE ACCURACY under
15 U.S.C. § 1681e.
[ ] DISMISSED EVICTION REPORTED AS AN EVICTION
Case number ______ in ______________ County was DISMISSED on
________. The certified docket is enclosed. A dismissed filing is
not an eviction, and reporting it without the disposition is
materially misleading.
[ ] CASE RESOLVED IN MY FAVOR
Judgment was entered for me / the case was settled and vacated on
________. Enclosed: the order.
[ ] OUTSIDE THE REPORTING PERIOD
The item is dated ________, more than [__] years ago, and
15 U.S.C. § 1681c bars its inclusion.
[ ] ARREST WITHOUT CONVICTION, outside the permitted period.
[ ] SEALED OR EXPUNGED RECORD that should not be reported at all.
Enclosed: the sealing/expungement order.
REQUESTED
1. Delete the item.
2. Send a corrected report to [property/management company], who
received a report about me on ________.
3. Provide the results in writing, and a free copy of my corrected
file.
4. Identify the source of the information and the procedure used to
verify it.
ENCLOSED, numbered: ______________________________
______________________ · [Address] · [Phone]
Sent certified mail, tracking ____________
WHY THIS MATTERS: tenant screening reports contain errors at meaningful
rates, and most people never see the report that cost them a home. If
this is not corrected, complain to the federal consumer financial
regulator and consult a consumer lawyer — the statute provides
attorney's fees, which is why these cases are taken on contingency.
9. Privacy Act access request
[Date]
[Agency Privacy Act Officer]
[Agency FOIA/Privacy office address]
RE: Request under the Privacy Act, 5 U.S.C. § 552a, and the Freedom of
Information Act
Requester: ______________
This is a request for records about me. I am making it under BOTH the
Privacy Act and the Freedom of Information Act, so that records
available under either are produced.
RECORDS REQUESTED
All records maintained by [agency] that are retrievable by my name or
by an identifier assigned to me, including but not limited to:
1. ______________________________
2. ______________________________
3. ______________________________
[If you know the system of records, name it: "the system of records
described at ______________."]
Time period: ________ to the present.
Please include records in electronic form, email, case notes, and any
records held by contractors on the agency's behalf.
IDENTITY VERIFICATION
My full name: ______________
Any former names: ______________
Date and place of birth: ______________
Current address: ______________
Addresses during the period: ______________
[Signature notarized or the following certification:]
I declare under penalty of perjury under the laws of the United States
that I am the person named above and that I understand that knowingly
requesting or obtaining records about an individual under false
pretenses is a criminal offense.
______________________ Date: ________
FEES
I request a fee waiver / I agree to pay fees up to $______; please
contact me before exceeding that amount.
FORM
Please provide records electronically if possible.
If any record is withheld, please identify it, state the exemption
relied on, and advise me of my appeal rights.
______________________ · [Address] · [Phone] · [Email]
Sent by ______________ on ________
10. Privacy Act amendment request
[Date]
[Agency Privacy Act Officer]
RE: Request to AMEND records under the Privacy Act, 5 U.S.C. § 552a(d)(2)
Requester: ______________
Records received in response to my request dated ________
I request amendment of the following records, which are not accurate,
relevant, timely, or complete.
RECORD 1
System of records / file: ______________________
Document and date: ______________________
WHAT IT SAYS: "[quote it exactly]"
WHY IT IS WRONG: ______________________________
[ ] Factually inaccurate
[ ] Incomplete in a way that is misleading
[ ] Not relevant and necessary to a purpose the agency is required to
accomplish
[ ] Not timely
WHAT IT SHOULD SAY: "______________________________"
DOCUMENTATION ENCLOSED: ______________________
RECORD 2
[Repeat.]
REQUESTED
1. Amend the records as set out above.
2. Notify any person or agency to whom the record was previously
disclosed of the amendment.
3. Acknowledge receipt of this request within ten working days, as the
statute requires.
IF YOU REFUSE
Please provide the reason, the name and title of the official
responsible, and the procedure for administrative review of the
refusal. If review is denied, I intend to file a STATEMENT OF
DISAGREEMENT, which must be included in the record and provided to any
person to whom the record is disclosed, and I reserve the right to
bring a civil action.
______________________ · [Address] · [Phone]
Sent certified mail, tracking ____________
11. Employer personnel file request
[Date]
[Employer — HR director]
RE: Request to inspect and copy my personnel file
Employee: ______________ Employee ID: ______________
Department: ______________
I request to inspect and receive copies of my complete personnel file,
including:
1. Application materials and resume
2. Offer letter, employment agreement, and any amendments
3. Job descriptions
4. Performance evaluations, reviews, and ratings
5. Disciplinary records, warnings, and counseling memoranda
6. Attendance and leave records
7. Compensation history and payroll records
8. Training records and certifications
9. Complaints or grievances involving me, and any investigation
records
10. Any background check or consumer report obtained about me, and the
disclosure and authorization forms I signed
11. Medical and accommodation records maintained separately
12. Any signed acknowledgments and policies
13. Any records of monitoring of my communications or activity
14. Separation documents, if applicable
[If your state has a personnel file statute:] I make this request under
[state statute], which requires an employer to permit inspection within
[__] days and to provide copies [on request / at reasonable cost].
Please advise when and where I may inspect the file, and the cost of
copies. If you contend any record is not subject to inspection, please
identify it and state the basis.
______________________ · [Address] · [Phone] · [Email]
Sent on ________ by ______________
12. Evidence preservation and doxxing log
EXPOSURE AND HARASSMENT LOG
Subject: ______________ Log started: ________
RULE: SCREENSHOT AND DOCUMENT BEFORE REQUESTING REMOVAL. Removal
destroys the proof you will need for a protective order, a police
report, or a civil claim.
ENTRY
Date/time discovered: ____/____/______ ________
Platform/site: ______________________
URL: ______________________________
Account/username: ______________________
WHAT WAS POSTED (describe; do not paraphrase threats — quote them):
______________________________________________________________
______________________________________________________________
MY INFORMATION EXPOSED:
[ ] Home address [ ] Prior addresses [ ] Phone [ ] Email
[ ] Employer [ ] Workplace address [ ] Vehicle/plate
[ ] Children's names/school [ ] Family members [ ] Photographs
[ ] Financial information [ ] Government ID number
[ ] Intimate images [ ] Other: ______________
SCREENSHOT SAVED: [ ] filename ______________
(must show URL, date, and content)
ARCHIVED COPY: [ ] archive service URL ______________
WITNESSES: ______________________
EFFECT ON ME: ______________________________
[Repeat for every entry.]
ACTIONS TAKEN
DATE WHAT RESULT / REF #
______ ____________________________________ ________________
[ ] Platform report — category used: ______________
[ ] Platform escalation / appeal
[ ] Search engine removal request — category: ______________
[ ] Host or registrar complaint
[ ] Hash-matching service (non-consensual intimate imagery) — free,
operated by nonprofits, blocks across participating platforms
WITHOUT uploading the images anywhere
[ ] Police report — number ______________
[ ] Protective order petition filed ________
[ ] Employer or school notified ________
[ ] Address confidentiality program enrolled ________
[ ] Attorney consulted ________
PATTERN SUMMARY — for a protective order petition
First incident: ________ Most recent: ________
Total incidents: ______ Platforms involved: ______________
Escalation observed: ______________________________
Threats made: ______________________________
Steps I have taken to stop it: ______________________________
13. Identity theft block request
Stronger than an ordinary dispute, and rarely used.
[Date]
[Consumer reporting agency]
RE: REQUEST TO BLOCK INFORMATION RESULTING FROM IDENTITY THEFT
15 U.S.C. § 1681c-2
Consumer: ______________
DOB: ________ SSN: xxx-xx-____
Address: ______________________________
I am a victim of identity theft. I request that you BLOCK the following
information, which resulted from the identity theft, from appearing in
my file. This is a block request, not merely a dispute.
INFORMATION TO BE BLOCKED
1. Account/item: ______________ Furnisher: ______________
Amount: $______ Date opened/reported: ________
2. Account/item: ______________ Furnisher: ______________
3. Inquiry by ______________ dated ________
ENCLOSED, as required
[ ] IDENTITY THEFT REPORT filed with the federal trade regulator on
________, report number ______________
[ ] Police report filed with ______________ on ________, number ______
[ ] Proof of my identity: government-issued identification
[ ] Proof of my address
[ ] A statement identifying each item as resulting from the identity
theft
I certify that the information identified above does not relate to any
transaction by me.
I also request that you:
1. Notify each furnisher that the information has been blocked and
that it may be the result of identity theft;
2. Provide me with written confirmation of the block;
3. Provide a free copy of my file after the block;
4. Place an extended fraud alert on my file.
______________________ Date: ________
[Address] · [Phone]
Sent certified mail, tracking ____________
14. Regulator complaint
[Date]
[Regulator — see the routing guide below]
COMPLAINT
Complainant: ______________
Address: ______________ Phone: ______________ Email: ____________
Company complained of: ______________________
Company address: ______________________
WHAT HAPPENED — chronological, factual, one page
____/____/____ ______________________________________________
____/____/____ ______________________________________________
____/____/____ ______________________________________________
WHAT I REQUESTED AND WHEN
Request type: ______________ Sent ________ by ________
Confirmation/tracking: ______________
Statutory response period: ______ days. Due: ________
Second request sent: ________
WHAT THEY DID OR FAILED TO DO
______________________________________________________________
THE PROVISION I BELIEVE WAS VIOLATED
______________________________________________________________
[Naming the provision moves a complaint out of the general queue.]
HARM
______________________________________________________________
WHAT I WANT
[ ] Correction of the information
[ ] Deletion
[ ] A substantive response to my request
[ ] Investigation
[ ] Other: ______________________
ATTACHMENTS, numbered
1. ______________________ 2. ______________________
3. ______________________ 4. ______________________
______________________ Date: ________
WHERE TO SEND IT
Consumer reporting agency, furnisher, bank, lender, debt collector
-> FEDERAL CONSUMER FINANCIAL REGULATOR. Complaints are routed to
the company with a response deadline, and the responses are
frequently substantive. This is the most effective free tool an
individual has here.
Deceptive privacy practices, data security, identity theft
-> FEDERAL TRADE REGULATOR (and file the identity theft report here)
Telecom privacy, unwanted calls and texts
-> FEDERAL COMMUNICATIONS REGULATOR
State privacy law, unfair or deceptive practices
-> STATE ATTORNEY GENERAL (many have dedicated privacy units)
Insurer, bank, or utility
-> that entity's STATE LICENSING REGULATOR
Health plan, provider, clearinghouse, or business associate
-> HEALTH PRIVACY ENFORCEMENT OFFICE
Federal agency refusing access or amendment
-> the agency's internal appeal, then FEDERAL COURT
KEEP THE REFERENCE NUMBER. It is leverage in every later conversation.
15. Account access audit worksheet
ACCESS AUDIT — who can already see me
Completed: ________ Next review: ________
LOCATION AND DEVICE SHARING
Family/group location sharing — who can see me: ______________ [ ]remove
Device finder sharing: ______________ [ ]remove
Fitness/activity sharing: ______________ [ ]remove
CLOUD AND STORAGE
Shared photo libraries/albums: ______________ [ ]remove
Shared drives/folders: ______________ [ ]remove
Backup accounts and who can restore them: ______________ [ ]remove
ACCOUNT RECOVERY — the doors people forget
Email recovery phone: ______________ Mine? Y/N [ ]fix
Email recovery email: ______________ Mine? Y/N [ ]fix
Trusted/legacy contacts: ______________ [ ]fix
Security question answers known to others? [ ]fix
Two-factor method: [ ] app [ ] hardware key [ ] SMS (weakest)
MOBILE
Plan owner: ______________ (can see call/text metadata, often
location) [ ]move
Authorized users on the account: ______________ [ ]remove
Port-out PIN set: [ ] Date ________
CONNECTED SERVICES
Third-party apps with account access: ______________ [ ]revoke
Active sessions/trusted devices unrecognized: ______________ [ ]sign out
Smart home administrators: ______________ [ ]remove
Vehicle app users: ______________ [ ]remove
Streaming/subscription profiles: ______________ [ ]remove
FINANCIAL
Authorized users on cards: ______________ [ ]remove
Joint account holders: ______________ [ ]review
Password manager shared vaults: ______________ [ ]remove
Bill-pay and transfer permissions: ______________ [ ]review
PHYSICAL
Old devices held by others: ______________ [ ]wipe
Keys, safes, mailbox access: ______________ [ ]change
Work devices / work profile on my phone: ______________ [ ]review
SAFETY GATE — READ BEFORE ACTING
[ ] Is there any history of violence, threats, or controlling
behavior by anyone on this list?
IF YES: STOP. Do not change anything yet. Contact a domestic
violence advocate and ask about a technology safety consultation.
Abrupt loss of access can escalate danger. Document first, from a
device that person has never had access to, and plan the sequence
with an advocate.
IF NO, work in this order:
1. Email password AND every recovery method
2. Trusted/recovery contacts
3. Location and family sharing
4. Mobile account — move to your own with a port-out PIN
5. Cloud storage and photo sharing
6. Smart home and vehicle
7. Financial credentials and authorized users
8. Sign out of all sessions everywhere
16. Device check for monitoring software
DEVICE CHECK
Device: ______________ Checked: ________
BEFORE YOU START
[ ] If a violent person may be monitoring you, DOCUMENT FIRST and
speak to an advocate. Removing software alerts the person who
installed it.
[ ] Do this research on a DIFFERENT device that person has never had
access to.
WHAT TO LOOK FOR
[ ] Applications you do not recognize, including ones with generic
names ("System Service," "Device Health," "Backup")
[ ] DEVICE MANAGEMENT or CONFIGURATION PROFILES you did not install
— this is the most common mechanism and the least examined
[ ] Accessibility services enabled for apps that have no reason to
need them
[ ] Administrator privileges granted to unknown apps
[ ] Unusual battery drain or data usage
[ ] The device running warm when idle
[ ] Settings that changed without your action
[ ] Unknown accounts signed in on the device
[ ] Screen-time or parental-control software you did not enable
[ ] Unfamiliar browser extensions
[ ] Unknown paired Bluetooth devices
[ ] A "developer options" or sideloading setting turned on
WHAT TO DO
[ ] Screenshot everything found, before removing
[ ] UPDATE THE OPERATING SYSTEM — updates commonly remove monitoring
software
[ ] Change passwords from a DIFFERENT, clean device
[ ] Revoke sessions everywhere
[ ] Consider a FACTORY RESET after documenting
[ ] DO NOT RESTORE FROM A BACKUP that may contain the software —
set the device up as new
[ ] Check the vehicle for tracking devices (wheel wells, under seats,
OBD port, trunk)
[ ] Check smart home devices, cameras, and shared displays
[ ] Check for AirTag-style trackers using your phone's built-in
detection
DOCUMENT
What was found: ______________________________
When it was likely installed: ______________
Who had physical access at that time: ______________
Screenshots saved to: ______________ (not on the affected device)
17. Six-month maintenance sheet
PRIVACY MAINTENANCE — [Month] and [Month] each year
FREEZES
[ ] Equifax still frozen [ ] Experian [ ] TransUnion
[ ] Specialty agencies still frozen
[ ] Children's freezes still in place
[ ] Mobile port-out PIN still set
SEARCH MYSELF
[ ] Name, two engines [ ] Name + city [ ] Images tab
[ ] Phone [ ] Email [ ] Family members' names
New profiles found: ______________________
[ ] Opt-outs re-submitted; log updated
[ ] State broker registry re-checked for new entrants
ACCOUNTS
[ ] App permissions reviewed on every device
[ ] Connected apps reviewed; unused revoked
[ ] Active sessions and trusted devices reviewed
[ ] Recovery methods and trusted contacts still correct
[ ] Family sharing, location sharing, shared albums reviewed
[ ] Smart home and vehicle administrators reviewed
[ ] Ad identifier reset
ANNUAL ADDITIONS
[ ] ALL consumer reports pulled — credit PLUS tenant, employment,
check, insurance, medical, utility
[ ] Errors found: ______________________ Disputed [ ]
[ ] Financial privacy notice read; sharing opt-out re-exercised
[ ] High-value passwords updated
[ ] Public posts from the last year reviewed
[ ] State privacy law requests re-sent to key brokers
TRIGGER A FULL AUDIT AFTER
[ ] A move [ ] A separation or divorce
[ ] A breach involving my SSN [ ] A job change
[ ] A death in the family [ ] Any denial of housing, employment,
credit, or insurance
[ ] Any sign someone knows something they should not
STATUS PAGE — keep current at the front of the folder
Frozen at: ______________________ Last verified: ________
Mobile PIN: set ________ Carrier: ______________
Opt-out log location: ______________
Request log location: ______________
Last full report pull: ________ Next: ________
Open disputes: ______________________
Open complaints and reference numbers: ______________________
Related documents
- Personal Privacy: Data Brokers, Surveillance, and Your Rights Over Your Own Information
- Protecting Your Personal Information
- Personal Privacy Checklist
- Scams, Fraud, and Elder Financial Exploitation
- Consumer Debt Defense Toolkit
Templates only, not legal advice. Adapt to your facts and to your state's current law. Framework: 15 U.S.C. § 1681 · § 1681b · § 1681c · § 1681e · § 1681i · 5 U.S.C. § 552a · 18 U.S.C. § 2510 · 18 U.S.C. § 2701 · 15 U.S.C. § 6801 · 47 U.S.C. § 222 · 16 C.F.R. Part 313.