The 20-minute privacy audit

By MercPrivacy · Published 2026-07-30 · Updated 2026-08-05

Search your own number, mine your inbox for breach notices, set three standing opt-outs, and map where your number lives publicly. Twenty minutes that end in a prioritized fix list.

Most people have never once searched their own phone number. They wonder where the calls come from, assume the answer is unknowable, and never spend the twenty minutes that would replace the wondering with a list.

This is that twenty minutes. Nothing to buy, no accounts to create, no tools beyond a browser and your own inbox. The output is a short, prioritized list of what to fix — which beats a vague sense of exposure every time.

One rule before the timer starts: this is an audit, not the repair. When you find something, write it down and keep moving. The fixing comes after, in priority order.

## Minutes 1 to 5: search yourself like a stranger

Open a private browsing window so your logged-in history does not shape the results, and run four searches:

- **Your ten-digit phone number, in quotation marks.** The single most revealing query you will run today. Every place it appears — people-search sites, old ads, forum posts, business directories — is a place dialers and list-builders can find it. - **Your name plus your city.** This is the people-search query. Note every listing site that holds a profile on you; [what those profiles contain](https://mercprivacy.com/knowledge/what-a-data-broker-knows) is usually more than people expect. - **Your email address, in quotation marks.** Where it appears publicly is where scrapers harvest it. - **Your street address.** See what a stranger holding only that can learn.

Do not stop to opt out of anything yet. You are building inventory: site names, what each shows, whether it is current.

Two refinements if you finish early: repeat the number search with your previous phone number if you changed it in recent years — old numbers stay attached to your name in stale records and still identify you — and repeat the name search with your previous city. The stale versions of you are worth knowing about, because brokers merge them into the current one.

## Minutes 6 to 10: what your inbox already knows

Search your email for the notices you filed away and forgot:

- **Breach notices.** Search terms like security incident, unauthorized access, and data breach. Each notice names what leaked; if your phone number or email was in one, part of your current call volume likely traces to it. Move them all to one folder — they are dated evidence of where your data escaped. - **The subscription sprawl.** Skim the senders in your promotions folder. Every company mailing you holds at least this address, usually more. You do not need to unsubscribe from everything today; you need a sense of how many hands hold it.

While you are in the inbox, notice whether one email address does everything — banking, shopping, newsletters, logins. A single address everywhere means every list it lands on can be joined against the others, which is exactly how profile-builders like it. You do not have to fix that today; write it down as a future project.

> Twenty minutes of looking beats a year of wondering where the calls come from.

## Minutes 11 to 15: set the standing opt-outs

Three registries take a few minutes each and keep working after you forget them:

1. **Prescreened credit offers.** Stop them at [optoutprescreen.com](https://www.optoutprescreen.com) or by phone at 888-5-OPT-OUT. This is the official channel for the credit-bureau prescreen lists, and it closes a dependable data feed. 2. **Marketing mail.** Set preferences at [dmachoice.org](https://www.dmachoice.org) to trim catalog and offer volume at the source most mailers actually check. 3. **The Do Not Call registry.** Registration at [donotcall.gov](https://www.donotcall.gov) is free and permanent, and telemarketers must honor it once your number has been on it for 31 days. It will not stop scammers — nothing stops people already breaking the law — but it converts legitimate-company calls into violations with consequences, which is exactly what makes it useful; the details are in [the registry explained](https://mercprivacy.com/knowledge/do-not-call-registry-explained).

## Minutes 16 to 20: find where your number lives on purpose

The last five minutes are for the exposures you created and forgot:

- **Business listings.** If you run a business from a personal cell, that number is published by design. Consider a separate or forwarding number for the public one. - **Marketplace and classified posts.** Old for-sale listings with a phone number in them stay indexed long after the couch sold. - **Resumes and directories.** An old resume PDF sitting on a forgotten site is a durable public copy of everything a caller needs. - **Social profiles.** Check whether your phone or email is set to public visibility; profile contact fields are a standard harvest.

For each one, decide: keep, remove, or replace with a number you do not mind burning.

Business owners get one extra line item: state filings and license records publish whatever contact details you registered with, and those records are heavily harvested. You cannot always remove them after the fact, but you can usually choose what goes into them going forward — an office line instead of your cell, a business address instead of your kitchen.

## Now prioritize by call volume

Fix things in the order that quiets the phone:

1. **People-search listings.** They aggregate everything else and republish it, so suppression there cuts many downstream copies at once. The opt-outs are free; [the process and its quirks are here](https://mercprivacy.com/knowledge/how-people-search-removal-works). Put a re-check on the calendar, because removals lapse. 2. **The standing registries.** Already done in minutes 11 to 15; they keep paying quietly. 3. **Public placements of your number.** Replace or retire them as you can. 4. **Old content.** The ancient forum post matters least. Fix it last, if ever.

Twenty minutes in, you know your exposure better than most people ever learn theirs. Put the audit itself on a schedule, too — quarterly is plenty. The second run takes ten minutes instead of twenty, and comparing it against the first tells you whether your exposure is growing, shrinking, or merely changing shape.

## If the list ran long

A long audit list is exactly the workload we exist to carry — the suppressions, the sibling sites, the re-checks, the records. [Stephanie](https://mercprivacy.com/stephanie) can tell you instantly and free whether your situation is a DIY afternoon or something worth handing off, or call (830) 587-5011.