Data Brokers Are Selling Your Old Tweets: How to Check and Opt Out

Where broker data comes from

Three sources feed the profiles.

• Licensed feeds. Historical firehose access was sold by data vendors for years, and large parts of those dumps are still sitting on disk.
• Scraping. Public profiles get harvested continuously. This is why a deleted post can still sit inside a dataset that was copied months earlier.
• Record stitching. Public records, voter files and breach dumps get matched against a handle. The match is the product. Anyone can read a tweet; linking it to your legal name, address and employer is what brokers charge for.

What actually shows up in a profile

Profiles vary, but the same fields keep appearing:

• Handle mapped to a legal name, plus every name variation found in public records
• Former and current cities, inferred from geotagged posts and check-ins
• Employer, scraped from job announcements and LinkedIn cross-references
• Phone numbers and email addresses recovered from old contact posts
• Relatives and associates, assembled from shared addresses

Address and employer are the two fields that cause the most trouble, because they turn an online argument into a physical-security problem.

How to check whether you are listed

A short routine covers most of it.

1. Search your handle in quotes. Then search your legal name plus your city.
2. Run your oldest email address, the one you used to sign up for everything in 2012. That address links profiles across sites.
3. Run your phone number in quotes. Aggregators index it even when you never posted it.
4. Check the three or four largest people-search sites by hand. They cross-list each other, so clearing the biggest ones removes most of the surface.

Do this logged out of every account. Logged-in results are personalised and hide exactly the listings you are looking for.

The four broker types and their routes

Type	What it holds	Route to removal	Realistic time
People-search sites	Name, address, phone, relatives	Per-site opt-out form, often per-profile	24 hours to 2 weeks
Marketing data vendors	Inferred interests and segments	Data-subject request under GDPR/CCPA	30 to 45 days
Social data resellers	Raw post archives	E-mail request; no standard form	Often no response
Background check firms	Employment and address history	Consumer reporting dispute process	30 days by statute

The background check category is the one people overlook. Those firms are regulated as consumer reporting agencies in the US, which means you have a statutory dispute right and a deadline they have to respect. That is a much stronger position than asking a marketing vendor nicely.

The opt-out loop that works

Removing a listing is not a one-time action. Treat it as a loop.

1. Submit the opt-out for every profile that matches you. Take a screenshot of the confirmation.
2. Wait the stated period, then search again. A meaningful share of removals fail silently the first time.
3. Recheck quarterly. Brokers re-acquire from the same feeds, so listings reappear, especially after a move or a job change.
4. If a site has no opt-out and no address, file with your state attorney general or data protection authority. A regulator letter gets answered when an email does not.

What this does not fix

Opting out of brokers does not remove the underlying post, and it does not stop future scraping. It shrinks the assembled profile, which is the part that hurts. Pair it with source deletion and you remove both the raw material and the index that points at it.

About digital-footprint-health.shop

digital-footprint-health.shop runs a 100% on-device footprint check: load your X archive, and it parses locally to produce a 0-100 health score plus a list of the phone numbers, emails and addresses in your old posts. Knowing exactly which details leaked tells you what to search for on broker sites. Start with the free check, read which tweets to clean first, or see the phone number check.