What are ‘people search’ websites, like the ones allegedly in Vance Boelter’s notebook?

Authorities recovered a notebook from the SUV of the man accused of fatally shooting Rep. Melissa Hortman and her husband that included a number of online services to look up personal information.

The sites are sometimes known as “data brokers” or “people search engines.” The online services aggregate personal information such as phone numbers, addresses and family members and display it publicly on the web, according to an affidavit filed in U.S. District Court in Minnesota. The document outlines evidence to support the federal charges against Vance Boelter, who is accused of murdering Melissa and Mark Hortman, and shooting Sen. John Hoffman and his wife, Yvette.

“Boelter planned his attack carefully,” said acting U.S. Attorney for the District of Minnesota Joe Thompson, who announced federal charges against Boelter on Monday. “He researched his victims and their families. He used the internet and other tools to find their addresses and names, and the names of their family members.”

It remains unclear whether Boelter used these sites or other means to obtain lawmakers’ addresses.

Many data brokers aggregate data to sell to other businesses for marketing purposes, according to Rob Shavell, the CEO of DeleteMe, a subscription service that works to remove personal information from the web.

Others sell data directly to consumers via search engines. These “directories” link names to addresses, phone numbers and even relatives and home valuations. Some information is typically available for free, with more available for a price, Shavell said.

Ron Zayas, CEO of Ironwall, which works with businesses to remove personal information from the internet, emphasized that the data on these sites can come from anywhere.

Ordering an item online, signing up for an app or a rewards program or even seemingly offline activities like ordering a pizza generate data that companies can sell.

Public documents, like property records, can also end up on data broker sites.

Shavell said the average amount of personally identifiable information — such as an address or phone number — available online about an average DeleteMe customer has more than doubled over the past five years.

“They’ve just gotten better and better at getting our information,” he said.

Probably.

Most Americans’ information can be found online, Shavell and Zayas said. In the digital age, it’s difficult to avoid.

Zayas estimated that thousands of these sites exist.

“We’ll show a judge the 500 places where we were able to find their information. ... ‘Here’s your family, by the way. Not only is this your family, but here’s the ages of everybody in your family. Here’s what your aunt calls your uncle. Here is what their phone numbers are,’” Zayas said.

Most data brokers honor requests for an individual’s information to be deleted, Shavell and Zayas said. Some of the sites offer guides for how to request information to be removed.

But the number of sites out there — Zayas estimated around 5,000 — can make it difficult. And listings can and do pop up again after being deleted.

The shootings on Saturday sparked a national conversation about how readily lawmakers’ addresses are shared and why. But privacy experts said that these data brokers demonstrate that taking lawmakers addresses down from official sites may not be enough to keep that information private.

“You should take it down, just as a matter of rule,” Zayas said. “But the second thing is ... if you type in Zayas, if I’m not protected, you’re going to find my information, and you’re going to find it very quickly and very easily.”

Data brokering regulations are the “wild, wild West” according Shavell.

Bill McGeveran, dean of the University of Minnesota Law School, said that, unlike Europe, where it’s assumed that a person would need to give consent for their information to be collected or sold, the U.S. allows data brokers to do almost anything unless explicitly prohibited.

And outside of barring data brokers from creating credit reports, there are few limits on the data they can collect and sell.

Some laws do limit the sharing of information about certain people, such as judges and police officers.

Federally, the Anderl Act prohibits the distribution of personal information about judges. But judges still generally have to request protection.

And state restrictions are sparse. According to Bloomberg Law, as of April only 20 states had any legislation regarding data collection on the books. Only a handful of states guarantee people the right to remove their data from the web.

A Minnesota law that will guarantee residents the right to request information be deleted and to opt out of data selling will take effect July 31.

Because of this patchwork, McGeveran said, enforcement of the laws that do exist can be a challenge.

“A lot of the enforcement mechanisms are challenging, partly because other countries have one central privacy law that’s enforced by one central agency, and our privacy laws are all over the place.”