A paralegal in Sacramento moved last spring, changed her phone number, and told only a few people where she went. She had reasons. One night a friend texted a screenshot: a site listing her new street, her mother's name, and a button offering "more details" for $28 a month. She had a dozen tabs open within the hour, and within two hours she had nearly done the two things that make this situation worse. She nearly signed up for an account to see what the report said. And she nearly filled in an opt-out form with her new phone number and a copy of her driver's license.

Most people who end up reading about this start where she did: scared or angry, typing fast. The order you do things in matters more than you would expect. Evidence disappears when removal works. An account can cost you a claim. And an opt-out form can hand the site better data than it had.

This is the practical companion to People-Search Sites and the Right of Publicity: Yearbooks, Data Brokers, and the Persona Class Actions, which explains the case law in depth. Here the job is to get something done.

The short answer

  • Decide first whether this is a safety problem. If someone could hurt you with this address, skip to the safety section before contacting any site. Address confidentiality programs and protective orders may change how you proceed.
  • Capture before you remove. Take dated screenshots with the URL, without logging in or creating an account. It takes ten minutes, and you cannot do it later.
  • Do not create an account on the site. Terms of service can contain arbitration clauses, class waivers, and in some cases consent to use of your information for people who search for themselves. Four named plaintiffs in the Classmates litigation dropped out for this reason.
  • Californians should start with DROP, the state's free platform. One request reaches registered data brokers, who had to begin processing on August 1, 2026, and must check at least every 45 days.
  • Elsewhere, work the opt-out pages of the largest sites and their parent companies, then re-check. Removal is not permanent, because new data flows in.
  • A claim is worth evaluating if your identity was used in a preview that sold something and someone other than you and your lawyer saw it. The statutes offer $750 in California, $1,000 in Illinois, and more in some other states, but individual suits rarely make economic sense, and class actions move slowly.
  • Deadlines are short and may have started without you. Illinois applies one year. California applies two years, generally from first public availability.
  • If a report cost you a job or an apartment, the Fair Credit Reporting Act may be your better claim.
  • Operators should separate the directory from the funnel, keep provable records, and honor notices on a clock. After the New Jersey Supreme Court's August 2026 ruling, a missed Daniel's Law deadline carries liability there without proof of fault.

Step 1: Triage what you actually want

There are four goals, and they do not always point the same way.

Your goal Primary route Speed Cost Trade-off
Physical safety Address confidentiality program, protective order, safety-specific statutes, then removal Days to weeks Low to moderate Requires disclosure to an agency or court; plan with an advocate
Listing gone DROP (California), site opt-outs, deletion rights, paid service if you value the time Days to months Free to a few hundred dollars a year Whack-a-mole; you may give data to get data removed
Correct false information Site correction tools; FCRA dispute under 15 U.S.C. § 1681i if the site is a consumer reporting agency Weeks Low Sites often deny FCRA status
Compensation or change Individual claim, class participation, or regulator complaint Years for suits; months for complaints Contingent, or none for complaints Evidence, standing, and arbitration fights; removal can complicate proof

Be honest about which row you are in. A person who wants only removal should not spend a month gathering evidence for a lawsuit they will never file. A person who wants accountability should not rush to delete everything first.

Step 2: Capture evidence before anything changes

Do this once, early, and carefully. It serves you even if you never sue, because you will need to know what the page said when you confirm removal.

  1. Stay logged out. Use a private browser window with no account on the site. Do not click through to any checkout page beyond what a visitor sees without accepting terms. If a pop-up demands that you accept terms to continue, stop and capture the pop-up.
  2. Capture the whole page with the URL and system date visible. Save it as a PDF and an image. Note the time zone.
  3. Record how you got there. Did the page come up in a Google search for your name, or only after typing your name into the site's own search box? This matters a great deal. An indexed page suggests a permanent public page. A result generated only after you search invites the argument that you alone caused it.
  4. Capture the sales language. Record the text next to your name ("View full report," "See phone number") and what the next screen offers, if a visitor can reach it without agreeing to anything.
  5. Write down who else saw it. Your friend's text in the opening scene is evidence. So is a client who mentioned it, a stranger who showed up, or a landlord who cited it. Save those messages with dates.
  6. List what is wrong. False entries, relatives named, addresses you left, and anything sensitive.

If you have safety concerns, do not paste the URL into public web archives, because saving a page there creates another public copy. Keep captures offline or in an account only you control. Note that you are not trying to create more display events. In the Illinois and Ohio cases discussed below, a search run for litigation has been treated as adding nothing.

The People-Search Toolkit: Opt-Out Letters, Claim Evaluation Worksheets, and Defense Frameworks has a capture sheet you can print.

Step 3: Removal, in the order that works

First, map the corporate family

Dozens of sites can share one owner and database, so a removal at one may flow to its siblings, or may not. In the Fourth Circuit's 2026 Jackson decision, for instance, the suit against PeopleConnect also named Intelius, PubRec, The Control Group Media Company, Instant Checkmate, and TruthFinder as related companies. Start by searching your name in a major search engine and in the largest sites, and then check each site's privacy page for its parent company. Where a parent offers a suppression request covering several brands, use it.

California residents: start with DROP

The California Delete Act, Cal. Civ. Code § 1798.99.86, required the state privacy agency to build a single mechanism, and it is live as the Delete Request and Opt-out Platform at privacy.ca.gov/drop. Here is what the law does and how it behaves.

  • One free request goes to every registered data broker, and you may exclude particular brokers.
  • Brokers must log in at least once every 45 days from August 1, 2026, delete matching data within 45 days of receiving a request, and direct service providers and contractors to delete.
  • Deletion is continuing. After the first round, the broker must keep deleting your data at least every 45 days and cannot sell or share new data about you unless an exception applies.
  • If the broker cannot match you, the request becomes an opt-out of sale and sharing.
  • An authorized agent may help, which matters for someone who cannot safely do it personally.

Expect three limits. It takes time: the agency's site warns that status updates can take up to 90 days. It only reaches businesses defined as data brokers under Cal. Civ. Code § 1798.99.80, which means businesses selling data about people they have no direct relationship with, and it excludes companies to the extent the FCRA or certain other regimes cover them. And deletion rights have exceptions, including Cal. Civ. Code § 1798.105(d) purposes, while "publicly available" government record data falls outside the definition of personal information in Cal. Civ. Code § 1798.140. So a listing built from property records might come back or stay up. If it does, the complaint route to CalPrivacy is free, and the statute imposes fines of $200 per request per day under Cal. Civ. Code § 1798.99.82 for non-compliance. Enforcement rests with the agency, so you cannot sue a broker directly under that section.

Everyone: site opt-outs

Most large sites have an opt-out page, usually linked in tiny type at the bottom. Before you use one:

  • Read what the form says you agree to. Some opt-out flows sit inside terms of service. Fischer v. Instant Checkmate LLC describes terms that treated people who search for themselves as consenting to commercial use. If the form requires accepting terms, consider a letter or email instead, and say in writing that your request is not acceptance of any terms.
  • Give the minimum. A dedicated email address, and the profile URL, usually suffice. Decline to send a government ID unless the law truly requires it. If they insist, redact everything except name and the address already shown.
  • Keep the confirmation and the date.

Sample email, which the toolkit expands:

Please remove and suppress the profile at [URL] and any other record about me in your databases and those of your affiliated sites. My name is [name] and the listed address is [address shown on the site]. I have not created an account and do not agree to your terms of service by making this request. Please confirm in writing when this is done, and tell me which sites you own or operate that this request covers.

A warning on buttons: the FTC's 2023 complaint against TruthFinder and Instant Checkmate alleged that "Remove" and "Flag as Inaccurate" buttons did not work as advertised, under the agency's 15 U.S.C. § 45 authority. Trust the re-check, not the button.

Other state rights

Many states now have comprehensive privacy laws with deletion and opt-out rights, though most exempt publicly available data and have revenue or volume thresholds. MC Law's State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork sorts them, and Data Subject Rights Request Handling Checklist: A Practical Checklist shows how companies should process what you send. Data broker registries in Vermont (9 V.S.A. § 2446), Texas (Tex. Bus. & Com. Code ch. 509), Oregon (ORS 646A.593), and California can also serve as lists of whom to contact, and the California page lists registrants. Registration laws vary, and most do not by themselves create a right to deletion, so check each state's current rules.

Paid removal services

Paid services send opt-outs for you and re-check on a schedule. They are a fair trade for someone with more money than time, and for people who need continuing coverage. Before you buy, ask four questions: which brokers do they cover, how do they handle sites that demand ID, do they hold your data under a contract you can read, and what do they do when a listing reappears? An authorized-agent service is not a legal remedy, and none can guarantee removal.

Upstream: turn off the faucet where you can

Sites refill from sources: property records, voter files, licensing boards, marketing lists, and social media. You cannot delete a deed, but some counties and states let protected persons shield records, and you can tighten what you control. Use a mailing address or registered agent for business filings where permitted, opt out of marketing lists, and lock down social profiles. Protecting Your Personal Information: A Practical Guide and the Privacy Toolkit: Deletion Requests, Report Disputes, and Surveillance Responses give broader steps.

Then re-check on a calendar

Check at 45 days, 90 days, and then quarterly. Listings return because a new source file arrives or because a data vendor matches an old identity to a new record. Keep a one-page log. If a site that confirmed removal relists you, capture it: that fact helps any later complaint and any claim of willfulness.

Step 4: Safety situations

Survivors of domestic violence, stalking, and similar harm

If you are in this group, the order changes. Talk with a domestic violence advocate before you contact a site, particularly if the abuser may be watching for changes. Removal alone will not make you safe, and a confirmation email to a shared account can create new risk. Use a fresh email on a clean device.

Address confidentiality programs. Most states have one, giving a substitute address for government records and mail. California's is Safe at Home. Enrollment also opens legal tools. Under Cal. Gov't Code § 6208.1, a participant can serve a written demand with a sworn statement describing a reasonable fear for safety. A business that then knowingly and intentionally posts the home address or phone number on the internet faces an action for injunctive or declaratory relief with mandatory fees for a successful plaintiff, and the demand lasts four years. A separate provision reaches posting with intent to incite harm or to threaten, with damages of up to three times actual damages and not less than $4,000. Check your own state's equivalent, because terms differ.

Protective orders. An order against the abuser does not bind a data broker directly, but it can support a removal request and helps establish risk. See Domestic Violence and Protective Orders: Safety Planning and the Legal System, and for the procedure, Obtaining and Defending a Protective Order: A Practical Guide. The Domestic Violence Safety and Protective Order Checklist: A Practical Checklist is a good one-page companion.

Ask for priority handling. Many large sites have a channel for safety requests that can remove a listing faster than the general form. Our toolkit has a letter that discloses only what is needed. Do not explain your history beyond what the site requires, and send proof of program enrollment only if the program permits it.

Evidence still matters, but less. If you are in danger, removal comes first and a capture takes minutes. Do not delay your safety to build a case.

Judges, prosecutors, law enforcement officers, and their families

Daniel's Law statutes were written for you, but they differ sharply, and 2026 changed the picture.

Jurisdiction Mechanism Current status as of 31 October 2026
New Jersey, N.J.S.A. 56:8-166.1 Written notice by a covered or authorized person; 10 business days to stop disclosing; liability for actual damages not less than $1,000 per violation, punitive damages for willful or reckless disregard, fees, equitable relief; claims assignable In force. Atlas Data Privacy Corp. v. We Inform, LLC (N.J. Aug. 12, 2026) reads actual damages as having no mental state requirement. Facial challenge pending in the Third Circuit after the district court upheld the law in Atlas, 758 F. Supp. 3d 322 (D.N.J. 2024) on a negligence reading the state court has now rejected
West Virginia, W. Va. Code § 5A-8-24(e) No notice step; liability on disclosure Held facially unconstitutional in Jackson v. Whitepages, Inc. (4th Cir. Oct. 27, 2026)
Federal judges Daniel Anderl Judicial Security and Privacy Act of 2022, Pub. L. No. 117-263, §§ 5931 to 5939 Written-request mechanism; the Fourth Circuit described the federal approach as notice-based. Coordinate with the court's security staff
Other states Fourth Circuit's list includes Del. Code Ann. tit. 10, § 1923 (72-hour removal after written request), Haw. Rev. Stat. § 92H-2, Md. Code Ann., Cts. & Jud. Proc. § 3-2303, Mo. Rev. Stat. § 476.1304, and Okla. Stat. tit. 20, § 3016 Vary by covered class and clock; check the current text before relying on any of them. The opinion notes California's cited provision as repealed in 2026

If you are covered, these steps apply in most states.

  1. Send written notice to each site, stating that you are a covered person and identifying the information to remove. New Jersey requires the sender to say they are an authorized person and to ask that disclosure cease and the protected information be removed from the internet or wherever else it is available. Avoid a generic form if the statute has specific wording.
  2. Keep proof of receipt. A New Jersey clock runs from receipt. Certified mail or a monitored email address, with a log, gives you a date.
  3. Cover family in the household. New Jersey's covered person definition reaches immediate family living there.
  4. Limit what you ask for to what the statute covers. New Jersey's statute protects a home address and unpublished home telephone number. In Kratovil v. City of New Brunswick (N.J. June 17, 2025), the court read "address" to mean the exact street address, not the town. A journalist may report that you live in a particular municipality.
  5. Think before assigning. Companies like Atlas offer notice platforms and take assignments of claims. That may be efficient, but read what you give up, including control over settlement and any share of recovery, and remember the constitutional question is live.

Will Jackson undo these laws? Not on its own terms. The court struck West Virginia's law "[f]or that reason and only that reason" that it lacked the least restrictive design, pointing to notice as one narrowing method. New Jersey's statute has notice, though not fault, and the Third Circuit will address that directly. Whatever happens, notices remain useful: many companies comply regardless, and a court can treat a disregarded safety notice very differently from a mass mailing.

Step 5: Evaluating a claim without fooling yourself

Now suppose you want more than removal. Work through these questions in order, and stop when the answer is no.

Question 1: Was your identity used to sell something before payment?

The statutes reach advertising and commercial use, not the mere existence of a record. The strongest fact pattern comes from Lukis v. Whitepages Inc., 454 F. Supp. 3d 746 (N.D. Ill. 2020) and Krause v. RocketReach, LLC (N.D. Ill. 2021): a free preview with your name and identifying details, and a button leading to a subscription for access to anyone. Information visible only after purchase does not count in Illinois under Huston v. Hearst Communications, Inc., 53 F.4th 1097 (7th Cir. 2022). Compare the Ohio ruling in LaFleur v. Yardi Systems, Inc. (N.D. Ohio 2025), which found ownership mentions in free property reports incidental, on allegations that showed no commercial value in the names.

Question 2: Who, besides you, saw it?

This is the question most likely to end a case. The law as of this writing:

Practically: indexed pages, public profile URLs, and anyone who told you they saw it all help. The site's logs will decide it, and you will not see those until discovery.

Question 3: Are you in time?

State Period, as courts have applied it Clock
Illinois One year (735 ILCS 5/13-201), per Bonilla First publication, with no discovery rule, under Giovannelli v. Walmart Inc., 164 F.4th 1052 (7th Cir. 2026); a class suit by a plaintiff without standing did not toll in Dobija v. Accucom Corp. (N.D. Ill. 2026)
California Two years for § 3344 Single-publication rule: first public availability, subject to equitable exceptions, per Callahan v. PeopleConnect Inc. (N.D. Cal. 2023)
Ohio, Indiana, Washington, Nevada Check current authority Do not assume a generous period; get advice early
FCRA 15 U.S.C. § 1681p: generally two years from discovery, five from the violation Runs from the violation or your discovery of it

Do not rely on a pending class action to protect you without checking. Under American Pipe & Construction Co. v. Utah, 414 U.S. 538 (1974), a putative class suit can toll limitations for absent members, but Dobija shows how that protection can vanish.

Question 4: Have you or someone acting for you agreed to the site's terms?

If you have an account, even a free one from years ago, expect a motion to compel arbitration, and in some cases a consent defense. Check your old email for welcome messages. If a lawyer or relative made an account, the law is more favorable but not safe:

Drafting and Litigating Arbitrability: A Practical Guide has the general framework.

Question 5: What is it worth, and who pays to find out?

Statute Floor Individual economics
Cal. Civ. Code § 3344 Greater of $750 or actual damages, plus profits and prevailing party fees Thin unless damages are real. Note that fees run to the prevailing party, so a loss could cost you
765 ILCS 1075/40 Greater of actual damages and profits or $1,000, plus punitive damages for willful violation Thin; generally class-driven
Ohio Rev. Code § 2741.07 Elect $2,500 to $10,000, or actual damages Better on paper; commercial value is contested
Ind. Code § 32-36-1-10 Greater of $1,000 or actual damages Commercial value required for "personality" status
RCW 63.60.060 $3,000 civil penalty plus actual damages, after a 2026 amendment (previously the greater of $1,500 or actual damages) Recent pleading wins in Carrera, Sant, and LaRock
15 U.S.C. § 1681n (FCRA) $100 to $1,000 for willful violations, plus actual and punitive damages Stronger where a report caused a concrete loss

Note the fee clause. Section 3344 awards fees to the prevailing party, so filing a weak individual California case carries real risk.

The realistic paths are these. Join or stay in a class if one covers you. In Nolen, the class is California residents who never registered and never donated a yearbook and who appear in a yearbook first posted on or after December 18, 2018. If you get a notice, read it for the opt-out deadline. The Ninth Circuit noted that someone with significant actual damages can opt out and sue alone. Alternatively, complain to a regulator, which costs nothing and sometimes works. Or send a demand letter, particularly where facts are unusually good: a professional whose livelihood depends on her name, a person who suffered concrete harm, or a site that relisted after a confirmed removal. Responding to a Consumer Class Action Demand Letter shows how the other side reads such a letter.

Question 6: Is the real claim something else?

Worked example: Theo

Suppose Theo Marchetti, a contractor in Evanston, finds a preview page for himself in June 2026 on a hypothetical site, Brightpath Lookup. It is indexed by Google. A former client mentions having seen it when checking his license. The page says "Unlock Theo's history. Plans from $19.95." He has no account, and his wife does not either.

Theo's position looks reasonable on the first three questions. A preview sold a subscription, a third party saw it, and he has a witness. His clock matters: if the page went up in 2023, Brightpath will argue Illinois's year ran long ago, and Theo will need to argue that a material update republished the page, because Giovannelli applies the single-publication rule and rejects a discovery rule under the Illinois Act. He should preserve the client's message, capture the page, and get advice before July. Should he opt out first? Probably yes, after capture: damages for past use are not erased by later suppression, and Nolen says a defendant cannot moot a plaintiff's claim by suppressing the name after suit. A pre-suit removal does raise a different argument, though, about continuing harm and injunctive relief, so he should tell his lawyer before he does it if he is seriously weighing suit.

Worked example: Imani

Suppose Imani Reyes, a California resident, has a 2004 yearbook photo on a hypothetical genealogy site. Her daughter holds a paid account and showed her the page. Imani has never logged in. There is no pop-up on the page unless a non-subscriber hovers on it, and she does not know whether anyone has.

Her likely path is DROP or a site request, plus watching for class notices. Her claim on the current record has three weaknesses: limitations if the book went up long ago, no evidence of a viewer, and a possible argument from the daughter's account. That argument should fail unless Imani asked the daughter to search for her, because a daughter's membership does not make her Imani's agent. Standing in federal court could also be contested, as Callahan v. Ancestry.com Inc., 2021 WL 2433893 (N.D. Cal. June 15, 2021), shows. The sensible move is removal now, not a lawsuit.

Step 6: If you run a people-search site or sales-intelligence product

The other side of this field deserves a straight answer too. These are lawful businesses in many forms, and the First Amendment protects a good deal of what they do. Here is a sequence, in rough priority order.

1. Classify your data and your funnel

Draw the path from ingestion to payment. For each screen, ask: does an identifiable person appear before payment, next to a price or call to action? That screen is your publicity exposure, under Lukis and its successors. Note that a court may treat a paid product advertised through identifiable previews as a commercial use even for business contact data, as LaRock v. ZoomInfo Technologies LLC (W.D. Wash. 2025) and Green v. Datanyze, LLC (N.D. Ill. 2024) illustrate.

Options to weigh, with trade-offs:

Control Reduces Costs
Show only that a result exists, with no identifying details, before login Publicity claims under most theories Lower conversion and search traffic
Require a real permissible-use gate before detail appears Some FCRA and publicity risk Friction; gate must be honest
Remove price and upgrade language from pages showing a named individual The "advertisement" characterization May only move the fight to the next screen, given the sequence theory in Nolen
Stop indexing individual profiles Third-party viewing and Fry-style proof Major traffic loss
License, with consent, where feasible (for example, opted-in professional profiles) The consent element Coverage gaps

2. Decide if you are a consumer reporting agency

Decide deliberately, with counsel. If you are one, comply in full. If you are not, make your conduct match: block screening uses in your contracts, your product, and above all your marketing. Kidd rewards real policies. The 2023 FTC action shows what happens when disclaimers sit beside marketing that promises screening. If your data is sold to people deciding on credit, housing, or jobs, the FCRA's 15 U.S.C. § 1681b applies to the transaction.

3. Build a provable request pipeline

  • Daniel's Law intake. Treat notices as time-critical. Have a monitored address, automated logging of receipt time, a suppression process that reaches derivatives and vendors, and a mass-notice surge plan. In New Jersey, the state supreme court held that no mental state is required for actual damages, and it recognized that a company acting reasonably might still miss 10 business days. Plan as though that risk is yours, pending the Third Circuit.
  • DROP. If you meet Cal. Civ. Code § 1798.99.80, register, access the system at least every 45 days, delete and suppress on a continuing basis, and direct vendors to do the same. Prepare for the audits that Cal. Civ. Code § 1798.99.86 requires starting in 2028.
  • Other registries. Maintain a registration calendar for each state whose requirements you meet.
  • Safety channel. A human-reviewed path for domestic violence and stalking victims is the right thing to do, and it reduces the Cal. Gov't Code § 6208.1-type exposure.
  • Honest buttons. If it says "Remove," it needs to remove. The FTC's theory under 15 U.S.C. § 45 does not require a privacy statute.

4. Write terms for the people who actually sign them

Courts will enforce an arbitration clause against someone who actually assented, on a page that gave reasonably conspicuous notice, under Berman v. Freedom Financial Network, LLC, 30 F.4th 849 (9th Cir. 2022). They will not bind a stranger because a site says so. Carrera v. Whitepages Inc. (W.D. Wash. June 9, 2025) refused to compel on a "Got it" pop-up with no click evidence. Practical points: use a clear sign-up flow, log assent by user and version, ask for discovery in your first motion if you may need it (Carrera treated a late request as waived), and think through whether a consent-by-self-search clause helps or merely looks bad. For mass filings, see Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem, and for the motion, the Motion to Compel Arbitration Toolkit: Clauses, Declarations, and Appellate Strategy.

5. Decide what your logs will say

Event-level logs won the summary judgment motions in Hoffower and Wilson. In Nolen, by contrast, the record held no classwide evidence of who had been searched, and that gap helped push the case onto a common searchability theory. Set a retention policy deliberately, for legitimate reasons, and suspend deletion once a claim is reasonably anticipated. Be careful with a declaration that overstates what the logs prove: Hoffower turned on what the plaintiff could not dispute. Note the point from Dobija as well: your own investigators' test searches should be logged and distinguishable.

6. Choose the litigation sequence in advance

If you are sued, expect this order of battle, and plan for how each choice affects the next.

  1. Removal. The Class Action Fairness Act, 28 U.S.C. § 1332(d), usually gets you to federal court, but if you then win on Article III, the case may be remanded, so consider whether you want that fight. See Removing or Remanding a Class Action Under CAFA: A Practical Guide and Getting Into or Staying Out of Federal Court: A Practical Guide to Jurisdiction and Removal.
  2. Arbitration first. A motion to compel can be waived by litigating, and an interlocutory appeal is available under 9 U.S.C. § 16 only for a denial. In Boshears v. PeopleConnect, Inc., 76 F.4th 858 (9th Cir. 2023), the panel declined to review the immunity rulings in the same appeal. Send the arbitration motion with proof.
  3. Pleading motions. Expect limited success on Section 230, exemptions, and the First Amendment. In a Fed. R. Civ. P. 12(b)(6) motion, affirmative defenses win only when the complaint itself establishes them. Target limitations and non-persona statutes where you have a clean ground, and raise personal jurisdiction only with Briskin v. Shopify, Inc., 135 F.4th 739 (9th Cir. 2025) in mind.
  4. Anti-SLAPP, cautiously. The public-interest exemption in Batis v. Dun & Bradstreet Holdings, Inc., 106 F.4th 932 (9th Cir. 2024) and the loss of interlocutory appeals in Gopher Media LLC v. Melone (9th Cir. 2025) (en banc) have narrowed its value. See Filing an Anti-SLAPP Motion: A Practical Guide.
  5. Targeted early discovery on the named plaintiffs. Accounts, searches, who found what, and how the plaintiff was recruited, per Dobija and Knapke.
  6. Summary judgment on use and viewership. That is your strongest ground in Illinois and Ohio. In California, Nolen says summary judgment or trial is where the searchability question belongs, under Fed. R. Civ. P. 56.
  7. Class certification with evidence. Nolen rejected speculation: sample release forms that did not name the company and a few same-name pairs failed. Bring numbers. A motion raising the adequacy conflict in Nolen may be worth a look. Pleading and Attacking Standing in Federal Court: A Practical Guide and the Class Action Defense Toolkit: From Complaint Through Settlement Approval go further.

Suppressing a plaintiff's name after suit does not moot the claim, as Nolen holds. It may still be the right thing to do.

7. Check insurance early

Personal and advertising injury coverage in commercial general liability policies sometimes reaches claims based on use of a name or likeness, and exclusions for statutory violations or data matters are common. Give notice promptly, because a coverage fight is easier to manage from the start.

Worked example: a sales-intelligence vendor

Suppose a hypothetical vendor, Corvid Prospecting, offers free profile pages of professionals with a blurred email and a "Start free trial" button. It gets a demand letter under Washington's statute and, the same week, 2,400 Daniel's Law notices from one sender. Sensible moves, in order: put a litigation hold on logs and marketing; route the notices into the suppression process with timestamps and meet the 10 business days, filing any constitutional objections separately from compliance; ask outside counsel whether the free profile design should change now (the change is not an admission, and a good design decision should be judged on its merits); check whether any notices are defective, without using that as a reason to miss the clock; and notify the insurer. The publicity claim's defense will turn on the Washington exemptions in RCW 63.60.070, on which LaRock and Sant v. RocketReach LLC (W.D. Wash. 2025) gave defendants little at the pleading stage. Corvid should not expect an early exit.

A first-week timeline for an individual

Most of the work fits into one week, and it can be spread out if you need the breathing room. Lawyers rarely need to touch the first three days.

When What Who Cost
Hour 1 Safety screen; call an advocate if anyone may use the address to hurt you You Free
Hour 1 to 2 Capture pages and sightings without logging in You, or a friend who is careful Free
Day 1 Search old email for accounts; ask relatives about theirs; estimate when the page went up You Free
Day 2 File DROP if you live in California; write down your goal You Free
Days 2 to 4 Send opt-outs to the largest sites and their parents You, or a paid service Free to a few hundred dollars a year
Days 3 to 5 Send any safety demand or Daniel's Law notice, with proof of receipt You, with an advocate, agency, or lawyer Free to modest
Day 7 Talk to a lawyer if a deadline may be close, a report caused a loss, or a page has real professional consequences You Often a modest consult fee
Day 45 and day 90 Re-check, capture any relisting, and escalate You Free

Nothing on this table commits you to a lawsuit. It keeps that option open while you get on with removal.

Common mistakes

For individuals

  • Creating an account "just to see." It can trigger arbitration and consent arguments, and in Nolen four named plaintiffs dropped out over registered accounts.
  • Requesting removal before capturing the page, then having nothing to show.
  • Sending a full driver's license to a site you do not trust.
  • Assuming that a single opt-out covers affiliated sites, or lasts.
  • Treating your own screenshot as proof of an advertisement. Courts in Illinois, Ohio, and Indiana have said otherwise.
  • Waiting. A year goes fast in Illinois, and the clock may have started when the page first went up.
  • Assuming a class action covers you, without reading its definition.
  • Having your lawyer sign up for an account without talking about the consequences.
  • Filing a thin individual case in California without weighing the prevailing-party fee clause.
  • Handling a safety problem as a privacy-paperwork problem. Talk to an advocate.

For operators

  • Relying on a disclaimer that marketing contradicts.
  • Answering notices on a best-efforts timetable in a strict-liability state.
  • Moving to compel arbitration on a screenshot with no record of a click, and forgetting to request discovery.
  • Treating a Section 230 win in one court as the rule. The outlier is one decision.
  • Assuming that suppressing the lead plaintiff ends the case.
  • Letting logs lapse after a demand letter, or letting a declarant overstate them.
  • Counting on anti-SLAPP as an early exit in federal court in California.

When to get a lawyer involved

Removal alone usually does not need one. Consider getting advice when a safety issue meets a legal notice, when a report has cost you a job or housing, when you are a covered official dealing with a non-responsive site, when a page has real professional consequences, or before you sign any assignment of claims. An operator should get advice before launch and again before answering its first Daniel's Law batch. UpLaw (uplaw.us) is a free place to read the opinions cited here if you want to go to the source.

This guide is general information and is not legal advice for any specific situation. If your situation includes a safety concern or a deadline, MC Law is glad to help you sort out which step comes first.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits