Spokeo, Inc. is a privately held people-search company founded in 2006 and headquartered in Pasadena, California. Its websites — Spokeo.com and sister brands including Thatsthem.com and Anywho.com — aggregate publicly available records into on-demand profile reports on named individuals, drawing on what the company describes as billions of consumer, property, court, and historical records plus data from more than 120 social networks. Reports are sold to consumers and, through a business service disclosed in its California data broker registration, GLBA-regulated credit header data is sold to qualified businesses and government agencies. Spokeo states it is not a consumer reporting agency under the FCRA; in 2012 it paid an $800,000 civil penalty to settle FTC charges that it had marketed profiles for employment screening without FCRA protections, and an FCRA accuracy class action against it reached the Supreme Court in Spokeo v. Robins (2016), decided on standing grounds. The company operates a self-serve opt-out and is registered in California's data broker registry.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2016-05-16]
In Spokeo, Inc. v. Robins (2016), a class action alleging Spokeo published inaccurate FCRA-covered information, the Supreme Court described Spokeo as operating a 'people search engine' and vacated the Ninth Circuit's standing ruling on procedural grounds — holding its Article III injury-in-fact analysis incomplete — and remanded without deciding the merits.
In June 2012, Spokeo agreed to pay an $800,000 civil penalty to settle FTC charges that it marketed consumer profiles to human resources, background screening, and recruiting companies without FCRA protections — the FTC's first case addressing the sale of internet and social media data for employment screening. The FTC also alleged Spokeo posted endorsements of its service written by its own employees while presenting them as independent.
The 2012 FTC matter (file 1023163) was filed by the Department of Justice on the FTC's behalf as United States v. Spokeo, Inc. (C.D. Cal., CV12-05001) and resolved by a consent decree imposing civil penalties and injunctive relief; a settlement is not an admission of a law violation.
Spokeo operates a self-serve opt-out that suppresses a listing from its public sites, and says it does not publish certain sensitive fields such as Social Security numbers. Its own opt-out page documents the friction: each listing URL must be opted out individually, and information may reappear as new public records are ingested.
Spokeo's homepage advertises the scale of its holdings — including 6 billion consumer records, 600 million court records, 130 million property records, and data from more than 120 social networks — which it combines into per-person reports covering contact information, address history, family and associates, and social media accounts.
Spokeo's privacy policy states that it aggregates eight categories of publicly available information into people-search listings — consumer indexes, phone directories, email databases, property records, public social network profiles, court records (including arrest, sex offender, and warrant data), business directories, and vital statistics — and states that it does not verify this information's accuracy.
Spokeo, Inc.'s California data broker registration lists five additional people-search brands operated alongside Spokeo.com — Freepeopledirectory.com, Thatsthem.com, Peoplewin.com, Anywho.com, and Family.me — with headquarters in Pasadena, California. The filing also states that Spokeo elects to register even though it considers its data exempt publicly available information.
Spokeo describes its own history on its About page — founded in 2006 as a social network aggregator, becoming a people search engine in 2010 — and identifies its CEO, Harrison Tang. It is a private company: no parent company, investors, or securities filings are disclosed on the site.
Spokeo's privacy policy reserves the right to transfer users' Personal Information to any successor in interest to its business, meaning data would follow the company through an acquisition or sale.
In its California data broker registration, Spokeo discloses that it collects and sells GLBA-regulated credit header information — identifying and contact information on adults — through a 'Spokeo for Business - Right Party Contact' service available to qualified businesses and government agencies.
Spokeo sells profile reports — including criminal records at additional cost — to the general public, while its sitewide footer disclaims consumer-reporting-agency status and instructs users not to use the site for FCRA-covered purposes such as employment or tenant screening.
Spokeo's privacy policy permits sharing users' Personal Information with advertisers and other third parties for targeted advertising on unaffiliated websites, naming Microsoft, Meta, Google, Quora, Pinterest, and X as examples of such companies.
In June 2012, Spokeo agreed to pay an $800,000 civil penalty to settle FTC charges that it marketed consumer profiles to human resources, background screening, and recruiting companies without FCRA protections — the FTC's first case addressing the sale of internet and social media data for employment screening. The FTC also alleged Spokeo posted endorsements of its service written by its own employees while presenting them as independent.
The 2012 FTC matter (file 1023163) was filed by the Department of Justice on the FTC's behalf as United States v. Spokeo, Inc. (C.D. Cal., CV12-05001) and resolved by a consent decree imposing civil penalties and injunctive relief; a settlement is not an admission of a law violation.
In Spokeo, Inc. v. Robins (2016), a class action alleging Spokeo published inaccurate FCRA-covered information, the Supreme Court described Spokeo as operating a 'people search engine' and vacated the Ninth Circuit's standing ruling on procedural grounds — holding its Article III injury-in-fact analysis incomplete — and remanded without deciding the merits.
Spokeo's cookie policy states that the site uses cookies, JavaScript tags, and web beacons (clear GIFs/pixel tags), placed directly or via third-party providers, and receives AMP IDs from Google; it notes that web beacons, unlike cookies, cannot be declined directly.
Spokeo's third-party privacy page states the site uses Google Analytics, Google's Remarketing and Display Advertising features, and additional ad networks such as Criteo, which set first- and third-party cookies to retarget visitors with Spokeo ads across other websites.
Spokeo's privacy policy states that it may use third-party session-analytics services such as Fullstory and/or Microsoft Clarity to collect usage information, and that it collects session and click-tracking data irrespective of a browser's Do-Not-Track signal.