How to audit your digital footprint

A digital footprint audit is a structured look at what the internet says about you, followed by a decision about each thing you find: keep it, fix it, hide it or remove it. You do not need special software. You need a private browser window, a notes file and a few evenings.

This guide follows the same order as our self-audit checklist, so you can tick items off as you go.

Set up before you search

Open a private or incognito window and sign out of your main accounts. Search engines tailor results to your history and location, and you want to see roughly what a stranger sees. If you can, repeat the most important searches on a second search engine; results differ more than people expect.

Start a simple log. A spreadsheet with four columns works well: what you found, where, what you want to do about it, and the date you acted. You will refer back to this log for months, especially for data-broker opt-outs that need rechecking.

Search yourself the way a stranger would

Begin with your full name in quotation marks. Then add context a stranger might use: your city, your employer, your school, your profession. Go through at least the first three pages of results for each search, and switch to the image and news tabs too.

Next, search for the identifiers that link your accounts together:

• every email address you have used in the last ten years
• your mobile number, written with and without spaces or dashes
• your usernames and gamer tags, especially any you reused across sites
• your home address, if you are comfortable typing it in

Usernames deserve the most attention. A handle you used on a forum at nineteen and on a professional portfolio at thirty connects those two lives for anyone who searches it. Write down every place each handle appears.

Finish this step by setting up a free search alert for your name, so you hear about new results without repeating the whole exercise.

Make a list of your accounts

Most adults have far more accounts than they remember. Three sources will surface most of them:

1. Your inbox. Search for words like "welcome," "verify your email," "confirm your account" and "reset your password." Do this for each address you use.
2. Your password manager or browser. Saved logins are a ready-made account inventory.
3. "Sign in with" connections. Check the security settings of your Google, Apple, Microsoft and Facebook accounts for third-party apps you signed into with them.

Mark each account as active, unused or unknown. Unused accounts are the main target for cleanup, and our guide to deleting or deactivating old accounts covers how to close them properly.

Check for data breaches

A breach notification service checks your email address against databases of leaked accounts. Have I Been Pwned is the best-known free one, and several password managers include a similar check. The results tell you which services lost data that included your address, and sometimes which kinds of data leaked.

For every breached service that you still use, change the password. If you reused that password anywhere else, change it there too. That reuse is how one old breach turns into a hijacked email account.

Lock down the accounts you keep

Once you know what you are keeping, go through each account's privacy and security settings:

• Turn on two-factor authentication, starting with email. An authenticator app or a passkey is stronger than codes sent by text message.
• Update recovery phone numbers and email addresses. An old number that now belongs to someone else is a way into your account.
• Hide your birthday, phone number and home town from public view. These answer many security questions.
• Review who can see old posts. Several platforms offer a one-click option to limit the audience of past posts.
• Remove apps and games connected to the account that you no longer use.

Look at photos separately

Photos leak more than text. Run a reverse image search on your main profile pictures to see where else they appear; a copy on an unknown profile can be an early sign of impersonation. Check whether your phone adds location data to photos, and turn that off for the camera if you post often. Ask friends to remove or untag photos you are uncomfortable with. Most people agree when asked directly.

If you publish photography or art, our guide to protecting your images and creative work covers copies and takedowns.

Deal with data brokers

If you live in the United States, people-search sites probably list your age, current and past addresses, phone numbers and relatives. They are worth handling as their own project because each site has its own opt-out process and listings often reappear. Our guide on removing your info from people-search sites explains how to work through them.

Shape what remains

Some results will stay no matter what you do. The best response to an old or unflattering result is often a newer, accurate one. A current professional profile, a simple personal page or a portfolio tends to rank well for your name and pushes stale material further down. See personal branding without oversharing for how to do this without publishing more than you need to.

For results that are harmful rather than embarrassing, such as your home address next to threats, intimate images shared without consent, or your ID numbers, search engines have removal request forms. Google's "Results about you" tool, for example, lets you ask for results containing your phone number, home address or email to be removed from its search results. That removes the result from Google search only; the page itself stays online unless the site owner takes it down.

Repeat it once a year

Put a reminder in your calendar for a year from now, and run the audit again sooner after a job change, a breakup, a move or news of a big data breach. The second audit is much faster than the first because your log tells you exactly where to look.

Common questions