The Individual

The lowest-resource adversary, one determined person with free tools, and how to shrink what they can find

State of Surveillance Editorial Team

⚠️ Educational Purpose

This page explains what a lone adversary can find so you can defend against it. The goal is your own threat modeling and self-OSINT: understanding what someone could find about you, then reducing it. Nothing here is a how-to for targeting other people. Techniques are described at the level needed to defend, and every capability links to a primary source.

TL;DR: The lowest-resource adversary is one motivated person with free, public tools. From your open profiles, a reused username, a single photo, and a people-search lookup, a stranger can assemble your city, workplace, contacts, and sometimes your home. Look yourself up first, then lock down profiles, strip photo metadata, use unique usernames, and opt out of people-search sites. The paid tiers above this one add money and manpower, not new magic.

You do not need a nation-state budget to be surveilled. In 2019, an estimated 1.3% of U.S. residents age 16 or older, about 3.4 million people, were stalked in a single year, and 80.1% of them were stalked with technology rather than in person alone.[1] The person doing it is usually not a hacker. It is an ex-partner, a former friend, a doxxer, or a stranger who fixated on you, working with the same free search tools anyone can open in a browser. This page maps what that one person can find, shows you how to run the search on yourself, and explains how to shrink the result.

What one person can find out about you

A lone adversary trades money for patience. They cannot subpoena your phone company or buy a private-investigator database, but they can read everything you have left in public and connect the pieces. Most of the raw material is information people posted themselves.

Public social profiles

Open social accounts are the starting point, because people volunteer so much on them. A nationally representative Pew Research study of teen social-media users found that 91% posted a photo of themselves, 71% posted their school name, 71% posted the city or town where they lived, 53% posted their email address, and 20% posted their cell phone number.[2] Adults are not more careful. Each of those fields is a lead a stranger can act on.

What this exposes:

  • Your face and appearance, from profile and tagged photos
  • The city or neighborhood you live in
  • Your school, employer, or the places you spend time
  • Contact points such as an email address or phone number
  • Your routine, relationships, and who you are close to

Username reuse

People tend to pick a username from a small personal set and reuse it across unrelated sites. Peer-reviewed research presented at the Privacy Enhancing Technologies Symposium, tested on a real-world dataset of 10 million usernames collected from eBay and Google Profiles, showed that a significant portion of separate profiles can be linked together through the username alone.[3] A single distinctive handle can tie your professional account to a hobby forum, a dating profile, or an old blog you forgot about.

Reverse image and face search

A photo is not just a picture. Google's own image-search feature lets anyone upload a photo and get back visually similar images, exact copies at other sizes, and the specific web pages where that image appears.[4] Face-search engines go further. PimEyes, a facial-recognition search tool open to the general public rather than restricted to police,[5] can take one photo of a face and locate other photos of that person across the open web, including images the person never posted. When The New York Times tested it on a dozen of its own journalists, PimEyes found photos of every one of them, including images where the face was partly hidden by sunglasses or a mask, or turned away from the camera.[6]

Photo metadata and geotags

Smartphone photos routinely embed GPS coordinates, along with the date, time, and sometimes a device identifier, in hidden EXIF metadata. The Electronic Frontier Foundation documented how this pinpoints location: in one case the FBI used the GPS coordinates in a photo's EXIF metadata to trace it to a specific house in Australia.[7] U.S. military OPSEC guidance warns that geotagged personal photos hand a viewer your home address, commute pattern, and daily routine, and cites a public figure who inadvertently revealed where he lived by posting a phone photo of his car at his home.[8] A stalker viewing your vacation or pet photos can use the same mechanism.

What this exposes:

  • The exact coordinates where a photo was taken
  • Your home, if you photograph objects there
  • Patterns of where you are, and when, across many images

People-search sites

People-search and data-broker sites do the aggregation for the adversary. When the FTC took action against Spokeo, it described how the company collected personal information from hundreds of online and offline data sources, including social networks, and merged it into detailed personal profiles.[9] For the cost of a subscription, a stranger can pull much of what is scattered across your profiles, public records, and past addresses into a single report, without any technical skill.

Run this on yourself

You cannot reduce an exposure you have not seen. The most useful thing you can do is become your own adversary for an hour: run the same free searches a stalker would, from a logged-out browser, and write down everything that comes back. Start with these:

  • Search your full name in quotes, then add your city, employer, or school to narrow it
  • Reverse-image search your current profile photo to find everywhere it appears
  • Search each username you use, across search engines and directly on other platforms
  • Search your phone number and email address, which are common people-search inputs

A people-search site is the fastest way to see the aggregated version of yourself. Running one on your own name shows you the profile a stranger would buy.

💰 Affiliate Disclosure

We participate in Spokeo's affiliate program. Using our link to run a search on yourself supports this site's educational work at no extra cost to you. Our guidance never changes because a link pays, and we show you how to remove your data below.

Look yourself up on Spokeo →

Know the legal limits. A people-search site is not a background-check service you can act on. The Supreme Court described Spokeo as a "people search engine" that, from a name, phone number, or email, returns a person's address, phone number, marital status, approximate age, occupation, finances, and shopping habits. [10] But these sites are not registered consumer reporting agencies, so using their data to screen a job applicant, tenant, or borrower is unlawful under the Fair Credit Reporting Act. The FTC fined Spokeo $800,000 in 2012 for marketing profiles to employers, [9] and fined TruthFinder and Instant Checkmate $5.8 million in 2023 for the same kind of violation. [11] Looking yourself up is a legitimate use. Looking up someone else to make a decision about them is not.

Then lock it down. Once you have seen what is exposed, remove it. Start with our Spokeo opt-out guide and the people-search opt-out master list. To automate removal across hundreds of brokers, see our reviews of Optery and Incogni.

How these techniques work

Each capability above has its own mechanics, and understanding them makes the defenses obvious. These guides go deeper without turning into a targeting manual.

Defend against the individual

The same footprint that makes you findable is one you can shrink. None of this requires special tools, only a deliberate pass through your own accounts.

  • Lock down profiles. Set social accounts to private, prune old public posts, and remove your city, employer, phone, and email from public fields. Assume anything public can be screenshotted and kept.
  • Strip photo metadata. Turn off camera geotagging, and remove EXIF data before posting. Most platforms strip it on upload, but files you send directly, or host yourself, may keep it.
  • Use unique usernames. Break the thread between accounts by not reusing one handle everywhere, especially between a real-name account and an anonymous one.
  • Watch what photos reveal. Backgrounds, street signs, mail, and reflections can place you even without metadata. Check a photo before you post it, not after.
  • Opt out of people-search sites. Remove your aggregated profiles, and keep them removed, because the data reappears over time.

For a full pass, follow our guide to auditing your digital footprint, which walks through each of these in order.

💰 Resources can buy up a tier

Everything here is the floor, not the ceiling. This adversary is defined by using free, public tools, but the moment money enters, the same person moves up a tier. A funded stalker can hire a private investigator, pay for the investigative databases and breach dumps the next tier relies on, or buy a subscription to run bulk people-search reports. When you model your own risk, ask not only who is interested in you, but how much they are willing to spend. If your adversary has a budget, read The Organized Group next.

Frequently Asked Questions

What can one person find out about me for free?

A surprising amount. From your public social profiles, a stranger can collect your photos, the city you live in, your school or workplace, and sometimes your email or phone. A reused username can link your separate accounts. A single photo can be reverse-image searched or run through a public face-search engine. Photos you post may carry GPS coordinates in their metadata. People-search sites bundle much of this into one profile.

Should I look myself up first?

Yes. Searching your own name, usernames, photo, phone, and email shows you what an adversary would see. You cannot reduce what you do not know is exposed. Start with your name in quotes, a reverse-image search of your profile photo, and a people-search lookup, then work through removing what you find.

Is it legal to use people-search sites?

Looking yourself up is legitimate. Using data from a people-search site to decide whether to hire, rent to, or lend to someone is unlawful under the Fair Credit Reporting Act, because these sites are not registered consumer reporting agencies. The FTC has fined operators for marketing their profiles as employment or tenant screening tools.

How do I remove my information from people-search sites?

Each site has its own opt-out process. Start with the Spokeo opt-out guide and the people-search master list. Because the same data reappears, an automated removal service such as Optery or Incogni can keep hundreds of brokers cleared over time.

Do the higher adversary tiers use different techniques?

The baseline techniques are the same. What money and manpower add is scale and access. A funded stalker can hire a private investigator, buy paid investigative databases, or purchase breach data. The free techniques on this page are the floor, not the ceiling.

Sources

  1. Bureau of Justice Statistics. "Stalking Victimization, 2019." February 2022. bjs.ojp.gov
  2. Pew Research Center. "Teens, Social Media, and Privacy." May 21, 2013. pewresearch.org
  3. Perito, Castelluccia, Kaafar, Manils (INRIA). "How Unique and Traceable are Usernames?" Privacy Enhancing Technologies Symposium 2011. arxiv.org
  4. Google. "Search with an image on Google." Google Search Help. support.google.com
  5. Washington Post (Drew Harwell). "This facial recognition website can turn anyone into a cop or a stalker." May 14, 2021. washingtonpost.com
  6. The New York Times (Kashmir Hill). "A Face Search Engine Anyone Can Use Is Alarmingly Accurate." May 26, 2022. nytimes.com
  7. Electronic Frontier Foundation. "A Picture is Worth a Thousand Words, Including Your Location." April 2012. eff.org
  8. I Marine Expeditionary Force (Maj. Rocky Williams). "Geotags invade privacy and OPSEC." January 7, 2011. dvidshub.net
  9. Federal Trade Commission. "Spokeo to Pay $800,000 to Settle FTC Charges Company Allegedly Marketed Information to Employers and Recruiters in Violation of FCRA." June 12, 2012. ftc.gov
  10. Supreme Court of the United States. "Spokeo, Inc. v. Robins, 578 U.S. 330." 2016. law.cornell.edu
  11. Federal Trade Commission. "FTC Says TruthFinder, Instant Checkmate Deceived Users About Background Report Accuracy, Violated FCRA While Marketing Reports for Employee and Tenant Screening." September 2023. ftc.gov