Skip to content

Demo site. Fictional data; nothing is sent to anyone. Open the guided demo

UltoPulto
Try the scan

Privacy for journalists

Short answer

Reporting can attract people who look for a journalist's home address, phone number or family in order to intimidate them. Press-safety groups advise finding out what is public about you before a difficult story runs, removing what you can from people-search sites and search results, tightening your accounts, and talking with family. Removal requests reduce what is easy to find. They do not replace a newsroom safety plan.

Published
Last reviewed

General information, not legal advice. This page has not yet been reviewed by a lawyer; check the linked primary sources before relying on it.

Key takeaways

  • The Committee to Protect Journalists (CPJ) advises looking up your own name and data in every search engine.
  • People directories draw on public databases, so a listing is likely to reappear unless the source changes.
  • Deletion rights in California and the UK can be used against data brokers. They are not absolute.
  • Assess your risk first. Not every journalist faces the same threats.
  • UltoPulto for Teams is planned, not built.

What is the problem?

A byline is public by design. A home address, a personal phone number and the names of relatives are not part of the job, yet they can often be found. Doxxing is the publication of those details to intimidate.

Both CPJ and Freedom of the Press Foundation publish guidance for journalists who expect their personal information to be searched for and published. The aim is not invisibility. It is to separate your public work from where you live.

How does it happen?

  • People directories. CPJ explains that these sites take personal information from public databases, and that a removed listing is likely to reappear unless it is removed at the source. See data brokers.
  • Search results. A search on your name can return links that show personal data such as a home address.
  • Old accounts and posts. Freedom of the Press Foundation suggests taking an inventory of the places you have posted over the years.
  • Family and friends. Other people's posts can reveal your details. CPJ recommends talking with them about what you want kept private.

What laws may apply?

The rights below are general privacy rights, not press-specific ones, and they depend on where you live.

  • California. Under the CCPA, residents can ask businesses to delete personal information collected from them. Businesses must respond within 45 calendar days, extendable to 90. Residents can also use DROP, the state's free platform, to tell registered data brokers to delete their information. Brokers have had to start processing those requests since 1 August 2026.
  • United Kingdom. UK GDPR gives a right to erasure. The ICO says organisations must respond within one month, and that the right is not absolute.
  • Stalking. US federal law (18 U.S.C. 2261A) makes it a crime to use electronic communications, with intent to harass or intimidate, in a course of conduct that puts a person in reasonable fear of death or serious bodily injury or causes substantial emotional distress.

What you can do yourself

These steps are free and do not need UltoPulto.

  1. Assess your risk before a sensitive story: who might react, and what would they look for?
  2. Look up your name, address and phone number in several search engines.
  3. Opt out of people-search sites yourself. Freedom of the Press Foundation points to a free opt-out list maintained by a journalist.
  4. Ask search engines to remove results that show your personal data, such as your home address.
  5. Review the privacy settings and old posts on every social account.
  6. Turn on two-factor authentication and use a password manager.
  7. Talk with family and friends about what they publish about you.
  8. If you live in California, file a free request on DROP.

What UltoPulto can do

  • Run an Exposure Scan that checks people-search sites and known breaches for your details.Built
  • Send removal and suppression requests to people-search sites and data brokers, written for the law that applies where you live.Built
  • Re-scan on a schedule and re-check sources after a request, to confirm removal and catch re-listing.Built
  • Keep an evidence trail on every case, follow up after the legal deadline, and draft a regulator complaint for you to review and sign.Built
  • Real delivery of requests: a request is sent only once our team has verified the recipient's privacy contact. Until then it stays a draft.In rollout
  • UltoPulto for Teams, for newsrooms and other employers.Planned

What UltoPulto cannot do

  • We cannot remove news coverage, court records or other public records at their source.
  • We are not a digital security service. We do not secure devices, accounts or communication with sources.
  • We cannot respond to threats as they happen. If you are in danger, contact the police and your newsroom.
  • We cannot guarantee that a listing stays down. If one comes back, its status changes to reappeared and the cycle restarts.

Sources

  1. 1Digital Safety KitCommittee to Protect JournalistsNon-profitOpened 2026-10-04
  2. 2Digital Safety: Remove personal data from the internetCommittee to Protect JournalistsNon-profitOpened 2026-10-04
  3. 3Ask a security trainer: Expecting doxxing?Freedom of the Press FoundationNon-profitOpened 2026-10-04
  4. 4California Consumer Privacy Act (CCPA)California Department of Justice, Office of the Attorney GeneralGovernmentOpened 2026-10-04
  5. 5Delete Request and Opt-out Platform (DROP)California Privacy Protection AgencyGovernmentOpened 2026-10-04
  6. 6Right to erasureInformation Commissioner's Office (UK)GovernmentOpened 2026-10-04
  7. 718 U.S. Code § 2261A, StalkingLegal Information Institute, Cornell Law SchoolLawOpened 2026-10-04

Questions

Should I remove my data before or after a story runs?

Before, if you can. Freedom of the Press Foundation advises removing your information from data broker sites when you anticipate negative attention, and California says it can take up to 90 days to see a status update in DROP.

Why does my address come back after I opt out?

CPJ explains that people directories take personal information from public databases, so a listing is likely to reappear unless the information is removed at the source. Check again from time to time.

Do I need a paid removal service?

No. Press-safety groups mention both paid services and free manual opt-outs.

Does removing listings protect my sources?

No. It reduces what strangers can learn about you. Source protection needs separate practices, such as end-to-end encrypted messaging, which CPJ's Digital Safety Kit covers.

Does UltoPulto have a newsroom plan?

Not yet. UltoPulto for Teams is planned and not built.