I Tried to Delete Myself From the Internet

It started as a curiosity

I was sitting at my desk one evening, doing what cybersecurity professionals probably should not admit to doing, Googling myself. It wasn't out of vanity but out of professional paranoia. I wanted to know what the internet knew about me. What I found made me put my cup of tea down and stare at the screen for a very long time. My full name, general location, Phone numbers, links to social media accounts, my past articles and photos I did not remember posting. All of it assembled, organised, and displayed by websites I had never visited, never signed up for, and never given permission to exist.

I sat there and felt something I did not expect to feel. Violated, not hacked nor breached, just exposed. Quietly, legally, systematically exposed by an internet that had been watching me the entire time I thought I was just living my life. That night I made a decision. I was going to try to delete myself.

What followed was one of the most educational, frustrating, and quietly terrifying experiences of my professional life.

What I Thought Would Happen

I want to be honest about my assumptions going in because I think most people share them. I assumed it would be inconvenient but manageable. A few forms to fill out, few accounts to deactivate, few emails to send requesting removal. A weekend project, maybe.

As a cloud security analyst, I understand, better than most, how data moves through systems. I know about APIs and databases and data pipelines and the infrastructure behind the platforms most people use without thinking about. I still underestimated it, significantly.

The Audit

Before I could delete anything, I needed to know what existed. I started by mapping my digital footprint, every account, platform and every service that had my data. I used my primary email address to search for accounts. I Googled every variation of my name, my old usernames, my phone numbers. The list I ended up with was twenty-seven items long. Twenty-seven and I am not someone who uses technology carelessly. I am someone who thinks about this stuff professionally. Someone who has given talks about data privacy. Someone who knows, intellectually, that everything online leaves a trace. Still, twenty-seven.

There were accounts I had created as a teenager and completely forgotten. Services I had signed up for once to access a free resource and never returned to. Shopping platforms from countries I had visited briefly. Newsletters I had subscribed to during a phase of my life that felt like it belonged to a different person entirely. Every single one of them had my data, some had my payment information and browsing history, sitting quietly in a database belonging to a company I had no memory of.

What the Data Broker World Actually Looks Like

Beyond the accounts you knowingly created, there is an entire industry vast, largely invisible, and completely legal dedicated to collecting, aggregating, and selling information about you without your knowledge or direct participation.

Data brokers, People search sites, Information aggregators. They go by many names and they operate by hoovering up publicly available information from social media, public records, electoral rolls, property registries, court documents, and countless other sources and packaging it into profiles that are sold to anyone willing to pay. Like Advertisers, Employers, Insurance companies, Landlords, Private investigators and other data brokers. Sometimes, the ones that keep security professionals awake at night, stalkers, Abusers, Scammers, people who want to find you, and who can now do so with extraordinary ease and minimal cost.

The Removal Process and Why It Is Designed to Exhaust You

The process of removing yourself from data broker sites is deliberately difficult. Each site has its own removal process, some require you to submit a form. Some require you to create an account on the very site you are trying to remove yourself from, which feels like a particular kind of irony. Some require a photo ID to verify your identity before they will remove your identity from their database. Some require a written request by email or a phone call.

All of them take time, many of them have waiting periods up to forty-five days in some cases before removal is processed. Several of them will re-add your information after a few months, sourced from new public data, requiring you to go through the process again. I spent eleven hours over three weekends working through removal requests. Eleven hours for a cybersecurity professional who knew exactly what she was looking for, exactly where to look, and exactly what to say in the requests. For someone without that knowledge? The process is essentially designed to be abandoned and that is the point.

What This Feels Like From the Inside

I want to step out of the professional frame for a moment and tell you what this experience actually felt like. It felt like walking through your own house and discovering that every room had a window, and that people had been looking through those windows for years, and that some of them had been taking notes.

It felt like realising that there's a version of you that exists on the internet which is not the version you curated and consciously built. It is an assembled portrait made of fragments from every system you have ever touched, every form you have ever filled in, every platform you have ever joined held together by companies whose names you do not know, serving purposes you were never told about. It felt, frankly, like a violation and I say that as someone who knows, better than most, that this is how the system works. Knowing it intellectually and experiencing the full scope of it are completely different things.

What I Could Not Delete

Of the 27 items I identified, I deleted seven accounts entirely and deactivated five. The remaining items were more complicated.

Some platforms did not offer a clear full-deletion option. They offered deactivation instead. The account disappeared from public view, but that did not necessarily mean the underlying data had been erased. It could still be retained, restored later, exposed in a breach, or transferred if the company was acquired.

Other platforms were required to retain certain records, including transaction histories and identity-verification information, for legal or regulatory reasons. The precise retention periods depended on the type of data and the jurisdiction.

Some of the services had also changed ownership since I originally joined them. The company now controlling my information was not necessarily the company to which I had first given it, and its privacy policy was not the one I remembered accepting.

Then there were the platforms that simply did not respond.

I sent the request. I followed up. I checked again.

I am still waiting.

What I Learned and What You Can Actually Do

I did not fully delete myself from the internet. I am not sure it is possible but I came out of the process significantly more protected than I went in and with a clarity about what actually matters.

This is what I would tell anyone who wants to take back some control:

• Start with an audit, not a panic. Google yourself. Search your name, your phone number, your old usernames. What you find will be uncomfortable. That discomfort is information and information is the beginning of control.

• Prioritise the platforms that have the most sensitive data. Old email accounts. Services with payment information. Platforms with identity documents. These are the highest risk items on your list, start there.

• Request removal from data broker sites. It is tedious and takes time. Do it anyway, particularly for the sites that list your home address and phone number. Tools like DeleteMe or Privacy Bee can help automate some of this if you do not want to do it manually.

• Review your privacy settings on every active platform. Who can see your posts? Who can search for you by phone number or email? What data is being shared with third-party advertisers? Most platforms default to maximum data sharing. You have to actively choose otherwise.

• Use different email addresses for different purposes. One for personal use. One for shopping and newsletters. One for professional profiles. This limits cross platform data aggregation, it makes it harder to build a complete picture of you from multiple sources.

• Check app permissions on your phone. Every app that has access to your location, contacts, camera, or your microphone is potentially collecting data it does not need. Revoke what does not make sense.

• Accept that you cannot do this once and be done. Data removal is not a task, it is a practice. New data gets added. Old removal requests expire. Acquired companies bring new policies. This requires periodic attention, not a one-time weekend project.

The Bigger Question

I want to leave you with something that goes beyond the practical steps. We talk a lot in cybersecurity about threats, external actors, malicious hackers, organised crime and those threats are real. But the quieter, more persistent erosion of your privacy is not coming from a hacker in a dark room. It is coming from systems that operate in plain sight, within the law, with your passive consent encoded somewhere in a terms of service document you scrolled past on a Tuesday morning.

The internet did not just change how we communicate. It changed who owns the story of who we are. Right now, your digital identity, the assembled portrait of your addresses, your habits, your relationships, your history exists in databases you have never seen, maintained by companies you have never heard of, available to buyers you will never know about.

You did not choose that but you can push back against it. Not perfectly or completely, but meaningfully. And in a world where your data is someone else's product, meaningful is more than enough to start with.