Incogni: critics

[u/Itchy_Special_8209]

So, I’ve been testing Incogni recently to remove as much of the data the internet has about me as possible.

For context, I’m coming from a pretty long privacy journey. I own an iPhone and an Apple Watch, but my emails are stored on Proton Mail, which I also use for my VPN. Recently, I’ve also been using ChatGPT and Claude more and more, especially since I work as a software engineer in my 9-to-5, so at this point they’ve probably scanned my laptop completely.

I wanted to share some of my criticisms of Incogni.

For those who don’t know, Incogni is a company that helps you request the deletion of personal data held by data brokers and private databases using privacy laws such as the GDPR and CCPA. It is based in Amsterdam and owned by NordVPN.

My criticisms:

• Limited proof of removal: The dashboard reports the status of your requests, for example, whether they’ve been sent or processed, but Incogni doesn’t really know or show exactly what information each broker held about you or what was actually deleted.

• It doesn’t erase you from the internet: Your social media posts, public records, and search engine results are not handled by the service.

• You have to give them personal information, so you need to trust them: This can include your phone number, email address, name, addresses, and date of birth. They need this information before sending deletion requests to data brokers on your behalf.

• They have a relatively long retention policy: Service data may be retained for up to 24 months after cancellation unless you specifically request deletion. Support data can be retained for up to six years.

Did you use this service? Do you know good alternatives? (I feel like alternatives are mostly US-based but I might be wrong)

[u/0xKaishakunin]

Nope, it completely ignores the relevant darknet markets. Which, of course, will also ignore GDPR requests.

But I have sent some "GDPR horror letters" to some companies.

[u/Z1r0na]

I don't trust these companies to do it and I also find it funny how people expect this to work long term when essentially what they do can be summed up as: Hiring someone to roam the streets and go from person to person, showing them your photo and info and telling them to forget you even if they never knew you at all.

The closest I have is part of my antivirus suite (ESET) where as part of the package I have paid for they scan the dark web for data leaks and if my info is there they warn me about it. Info that they have from my existing account with them so I don't even need to make a new account with another company or give more of it out there.

[u/Incogni_hi]

Hey, really appreciate you taking the time to lay this out so thoroughly - these are fair points, and happy to address them.

On limited proof of removal: It depends on the type of broker. Private data brokers maintain their own databases of personal information that they collect to sell. Our current Authorization Form doesn't cover data access requests, as those are considerably more complicated than removal requests and usually involve strict identity verification (typically a copy of your passport or ID, which we deliberately don't collect). The upside is that when we submit a removal request, we ask the broker to delete all the personal data they hold on you, not just the specific details we include. That covers information you never shared with us. Brokers may keep a minimal record in a suppression list, which is what stops them from re-collecting your data later.

People search sites are different. Because their profiles are public, we can verify removals there, and your dashboard shows what data was removed from each one. On Unlimited plans, the Exposure Scanner also shows where your data was found online, beyond public search sites, and the Personal Risk Assessment tracks what's been removed and what's still in progress.

On not erasing you from the internet: We don't act directly on social media or search engines. That said, Incogni also covers public data brokers, commonly known as People Search Sites. These are the ones that publicly display personal information and often appear in Google and other search engine results. Removing your data from them indirectly reduces your visibility in search results and your overall online exposure, even though we're not acting on the search engines themselves. On Unlimited plans, Custom Removals also go beyond data brokers.

Regarding the need to share personal info: When we submit a removal request, we only include the minimum information needed for the broker to identify the correct person and remove the right record. That's essentially the same information you'd need to provide if you were submitting the request yourself.

On the retention policy: Service data is kept for up to 24 months after your subscription ends, unless you ask us to delete it sooner. Support data is kept for 6 years after a ticket closes. That period is based on the standard statute of limitations for legal claims, so we can handle historical account issues, prevent fraud, and deal with any legal claims. That said, you can request deletion of your personal data at any time, except where we're legally required to keep certain records, as outlined in our Privacy Policy.