How to Find and Shrink Your Digital Footprint

What your footprint is made of

Splitting it into layers matters because the fix for each is different. Deleting an account does nothing about a data broker listing, and an opt-out does nothing about a password that leaked in 2019.

• Accounts you created: social profiles, forums, shopping sites, old apps. Many are forgotten but still online.
• Content you published: posts, reviews, photos, code, comments.
• Data others hold about you: data brokers, people-search sites, public records, mentions by friends or employers.
• Leaked data: records from data breaches that circulate long after the incident.

The audit below follows the same identifiers an investigator would use: your email addresses, usernames and phone number. Looking at yourself the way an outsider would is the fastest way to see what matters.

Step 1: List your identifiers

Write down every identifier you have used, not just the current ones:

• Every email address, including old school, work and "throwaway" addresses
• Every username or handle, including variations like johndoe_dev, johndoe and john.doe
• Current and previous phone numbers
• Name spellings, nicknames and maiden names

Your password manager is a good source, since it remembers sites you have long forgotten. So is your inbox: search it for "welcome", "verify your email" and "your account".

Step 2: Search your email addresses

Email links the most accounts, so start there. For each address, check three things.

• Where it is registered. TraceFind's email search checks 296 sites for an account registered to the address. Each hit is an account you still use, can delete, or did not create, which is worth investigating.
• Which breaches include it. The lookup covers more than 16 billion breach records from multiple sources, with the date of each breach and the data types exposed. How to check if your email was in a data breach explains how to read them.
• What it links to. TraceFind also shows public details of a Google account linked to the address, a reminder of how much one address can connect.

Step 3: Search your usernames and phone number

Run each handle through the username search. It checks about 1,000 of the most-used sites, health-checked daily so broken sites drop out instead of producing false hits, and extracts profile fields such as name, bio and avatar where a site exposes them. Look specifically for:

• profiles that show your real name next to a handle you thought was anonymous
• the same avatar across sites, which links accounts as reliably as a shared name
• bios that mention your employer, city or school

Then search your phone number with the phone search. It shows whether the number is linked to WhatsApp, Telegram, Signal, Facebook or Instagram, along with carrier and line type, and lists web pages where the exact number appears. Those pages are often old classified ads, club member lists or business directories you can ask to update.

Where to spend your time first

You will end up with a long list, and not every item is worth the same effort. Leaked passwords and forgotten accounts are cheap to fix and carry real risk. Data in old breaches is expensive to touch (you cannot) and mostly stale. Rank before you start.

Step 4: Deal with data brokers and people-search sites

Data brokers compile profiles from public records, marketing data and other sources, and people-search sites publish them. They are a major part of most people's footprint, especially in the US.

1. Find your listings

   Search your name with your city in a regular search engine and note the people-search sites that list you.

2. Use each site's opt-out

   Most have one, usually linked in the footer as "Do not sell" or "Opt out". Keep a record of the date and the confirmation.

3. Use your legal rights

   In the EU and UK, the GDPR gives you the right of access (Article 15) and the right to erasure (Article 17) in many cases. Several US states, including California, give residents rights to know about and delete personal information held by businesses.

4. Repeat

   Brokers refresh their data, and removed listings can come back.

Google also offers a "Results about you" tool to request removal of search results containing your contact details. It removes the search result, not the page itself, so combine it with opt-outs at the source.

Step 5: Delete or lock down old accounts

Work through the accounts from steps 2 and 3 and sort them into three groups.

Pay special attention to accounts that publish location or routines. Fitness apps are the usual example; our fitness app privacy guide covers the settings worth changing. If you write code, check what your Git commits expose with the tips in the GitHub OSINT guide.

Step 6: Breach hygiene

You cannot remove your data from breach collections once it is out. What you can do is make it useless.

• Change any password that appeared in a breach, and every other site where you reused it. Attackers try leaked pairs on many sites, which is called credential stuffing.
• Use a password manager so every site gets a unique, random password.
• Turn on two-factor authentication, preferably an authenticator app, security key or passkey rather than SMS, for email, banking and social accounts first.
• Watch for targeted phishing. Breaches that exposed your name, phone number or address make convincing scam messages easier to write.
• Use email aliases for new sign-ups, so a future breach exposes an alias you can switch off.

Keep it small over time

A calendar reminder to repeat the email, username and phone searches every few months is the low-tech way. The automatic way is a TraceFind monitor: it re-runs a search on a schedule and alerts you when something new appears, such as a new breach. Each check costs 5 credits and is refunded when it finds nothing, and you can keep up to 20 monitors.

Before signing up somewhere new, ask whether the service really needs your main email address and real phone number. The smallest footprint is the one you never create.

Frequently asked questions