You cannot remove yourself from a broker nobody has named.
Every firm in this market says it removes your data from data brokers. Almost none of them will tell you which brokers, how they know, or what happens to the ones you have never heard of. CODEX is our answer to that question: a standing index of the entities that collect, trade, and monetize personal information, graded rather than merely listed.
Removal is only as good as the map behind it. A firm working from a public opt-out list will clear the surfaces everyone knows about, report a number, and leave the rest of the ecosystem holding the same records. CODEX exists so that our removal work is aimed at the entities that actually hold a client's data, including the ones that have never been written about, and so that the research we publish rests on something countable.
Taxonomy extends the FTC's 2014 framework · Graded, not merely listed · Maintained continuously
What is actually in it.
The index grows in three directions at once: new entities, new types of data, and new sources for data already known. The third is the one nobody expects and the one that matters most.
entity profile
hundreds of tags
location to biometrics
Counts move. They are stated as of the last publication rather than rounded up permanently.
Five kinds of company, one ecosystem.
Calling all of them data brokers hides the thing that matters, which is what each one does with a record once it has it. Different behavior means a different removal instrument and a different level of risk to a client.
Searchers
People search, background check, public and criminal records, ancestry, employment, real estate. The surfaces a stalker uses because they are free.
Screeners
Credit bureaus, alternative credit, payday lending, risk and social media screening. Records here decide outcomes, so accuracy failures do real damage.
Data providers
The wholesale layer: location, biometric, demographic, property, automotive, social. They rarely have a consumer-facing name, which is exactly the problem.
AdTech
Identity graphs, analytics, attribution, retargeting, exchanges, DMPs. The bidstream that broadcasts a phone's location to hundreds of bidders every auction.
Monetizers
Social platforms, job boards, dating, banking, telecom, retail, search, publishers. Companies whose main business is something else and whose side business is you.
A list says who exists. A grade says what to do.
This is the part of CODEX that took the longest and the part that no opt-out list has. Every entity is evaluated along several axes, because two companies holding the same field are not the same problem when one obtained it with consent and the other has already leaked it.
Is anything actually binding on this holder, and if so which regime?
What did the person whose record this is actually agree to?
How much of it is right, and does being wrong make it safer or more dangerous?
Can the holder say where every field came from, or not?
How long does this record stay useful to somebody who wants to find a person?
How much work is it for someone hostile to get this, right now?
Many of them are the same company.
This is why removal repopulates and why an index beats a list. A cluster of people-search sites that look like competitors is frequently one operator behind several domains, sharing one record store.
Submit removals to four of the five domains and the record comes back, because the fifth is where it actually lives and the other four were only windows onto it. A firm working from a list of brand names will file four requests, report four successes, and have changed nothing.
CODEX tracks ownership, corporate relationships, shared infrastructure, and the traffic between entities. That mapping is what lets a removal be aimed at the holder rather than at the storefront.
The same mapping has a second use. When a regulator wants to know whether an unregistered operator is running a dozen surfaces under different names, or when a court needs the corporate chain behind a listing, the connections are the evidence.
New entities also arrive by referral. Anyone who finds a broker we do not have can send it to ReportBroker@obscureiq.com, and it gets assessed and tagged like any other.
Three things rest on the index.
CODEX is infrastructure rather than a product. It is the reason three visible parts of the firm can make the claims they make.
The engagement
Exposure Discovery maps where a client's data actually sits, and Exposure Reduction files against the holders rather than the storefronts. Both are aimed by the index.
The library
The Research Hubs and the Command Briefs are drawn from it. When we publish a count, it comes from somewhere countable, and the methodology is stated with the number.
Regulators and counsel
Identifying entities likely in breach of registration or consent law, prioritizing by risk indicators such as already leaked or sludge-grade accuracy, and quantifying categories that do not have a name yet.
What CODEX is not.
An index that overstated itself would be worse than no index, so the boundary is stated the way a finding is.
It is not complete, and it never will be
Entities appear, rebrand, merge, and go quiet continuously. The index is maintained rather than finished, and a count is true as of a date rather than in general.
It does not hold anyone's personal data
CODEX is an index of the companies, not of people. It records what an entity collects and how it behaves. It is not a copy of what they hold.
Grades are assessments, not certifications
Every axis is a judgment made from observable behavior, disclosures, filings, and breach history. It is stated with the confidence it deserves and it is revisable when the entity changes.
It is not a self-serve database
There is no public search box and no subscription. It is put to work inside engagements, published from in the library, and made available to regulators, counsel, and researchers on request.
Ask what it says about you.
The useful version of this conversation is not about the index. It is about which of these entities currently hold you.
Exposure Discovery answers that specifically, entity by entity, with the removal instrument for each one named alongside it. A confidential call comes first and it is short.
Regulators, counsel, and researchers who want to work with the index directly should say so on that call, and journalists should say what they are working on.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.