Minnesota shooting targeting political figures renews calls for online privacy laws in the US

The desk of state Representative Melissa Hortman at the Minnesota Capitol in St Pauly. Photo / Joshua Lott, the Washington Post

When police searched the Ford Explorer that belonged to the suspect in last weekend’s fatal shooting of a Minnesota lawmaker and her husband, they found in a notebook with the hand-scrawled names of more than 45 Minnesota state and federal officials, according to a criminal complaint in the case.

Next to the name of the slain lawmaker, state Representative Melissa Hortman (Democrat), was her home address.

Authorities also found in those notebooks the names of 11 “people-search” websites - such as Intelius, Spokeo and TruePeopleSearch.com - that offer users the ability to look up the addresses, phone numbers and other personal information of just about anyone for a small fee.

Those sites typically bring together information from various types of public records to compile profiles on people, often without their knowledge or consent.

Whether the suspect, Vance Boelter, used those sites to track down assassination targets has yet to be proved.

Hortman, it turned out, also published her home address on her campaign website, as the New York Times reported. And state Senator John Hoffman (Democrat), whom authorities allege Boelter shot and severely wounded on the same night, published his address on his legislative website.

Photos included in the criminal complaint against Vance Boelter show people-search sites that are used to look for personal information. Photo / US District Court for the District of Minnesota, the Washington Post

Still, the details in the complaint have drawn fresh scrutiny to people-search sites and other data brokers - and given new impetus to calls to regulate them.

“The horrific assassinations in Minnesota are a heartbreaking reminder of the real-world dangers that come with having our personal information readily available online,” US Representative Lori Trahan (Democrat-Massachusetts) said in an emailed statement. “Every American, not just elected officials, deserves the right to privacy, safety, and security.”

In April, Trahan partnered with senators Bill Cassidy (Republican-Louisiana) and Jon Ossoff (Democrat-Georgia) to reintroduce the Delete Act, which would allow Americans to submit a single request to the Federal Trade Commission to have their private information removed from the databases of every registered data broker.

Today, opting out requires tracking down, contacting and often uploading personal information to each site one by one, and even then there is no legal guarantee that they will comply - or won’t simply re-add your information later.

“No one should have to beg a data broker to remove their home address from the internet,” Trahan said. “They should be able to click a button.”

Senator Ron Wyden (Democrat-Oregon) told Wired this week that he would also like to see new regulations on data brokers in light of the Minnesota shootings. “Every single American’s safety is at risk until Congress cracks down on this sleazy industry,” he said.

Some state and federal regulations have already taken aim at data brokers.

Data brokers are a broad category that includes not only people-search sites but also companies such as Equifax and Experian, which collect data on consumers’ credit history, and Acxiom, which packages data on customers for personalised advertising, among other things.

The US lacks a comprehensive digital privacy law, and bipartisan efforts to pass one have stalled in Congress in recent years amid heavy lobbying and disagreements over key provisions. Still, there have been efforts at both the state and federal level to rein in data brokers’ practices or give people the right to opt out.

Those include California’s state-level Delete Act, which passed in 2023 and is gradually being implemented. The Washington Post wrote in February about a lawsuit the state filed against a data-harvesting company that will test the law’s teeth.

In the final weeks of President Joe Biden’s Administration, the federal Consumer Financial Protection Bureau proposed a rule intended to stop data brokers from selling people’s information to bad actors. President Donald Trump’s acting director of that agency, Russell Vought, withdrew that proposed rule last month, deeming it no longer “necessary or appropriate”.

Even where the will exists, people-search sites in particular have proved thorny to regulate.

While 19 US states have passed data privacy laws in recent years, few if any of them give people the right to opt out of people-search services, said Matt Schwartz, policy analyst at the non-profit Consumer Reports.

That’s because, unlike data brokers that track people’s purchasing habits or web browsing histories, people-search websites typically aggregate information that is publicly available in some form.

That can include voter registration records, property records, driving records, criminal records and marriage records. Some combine that information with other information about people that they find online, as an FTC website explains.

Even California’s Delete Act, which Consumer Reports supported, includes exemptions for information deemed “publicly available”, Schwartz said. Lawmakers in a few states, including Connecticut, have recently looked at narrowing that definition or restricting how public records can be combined with other types of personal information.

In the meantime, Consumer Reports offers a free app, called Permission Slip, that draws on existing state privacy laws to help people get their information removed from a wide range of companies and data brokers.

There is a precedent for attacks on lawmakers leading to tougher privacy laws.

In New Jersey, the 2020 fatal shooting of a federal judge’s son prompted lawmakers to pass “Daniel’s Law”, named after the victim. It prohibits the publication of home addresses and phone numbers of lawmakers and certain other public officials who have asked that their information be kept private.

Daniel’s Law doesn’t protect private individuals, however. Justin Sherman, a privacy expert and non-resident senior fellow at the Atlantic Council, sees that as a major shortcoming, given that cyberstalking disproportionately targets vulnerable people, especially women of colour and LGBTQ+ people.

“This should be for all people,” he said.

Data brokers and other industry groups, meanwhile, have challenged it in court, arguing that it violates the US First Amendment.

While there are legitimate reasons for public records to be accessible, Sherman said, that shouldn’t prevent people-search websites from being regulated.

“Having a public record in a filing cabinet somewhere for a journalist or watchdog group to retrieve is not the same thing as a private company digitising it, aggregating it, linking it by name to you and your family, and posting it online for sale for $2,” he said.

Francis Grubar, a spokesman for Trahan, said he believes the federal Delete Act would cover at least some aspects of how people-search websites operate.

He noted that the act was included in last year’s bipartisan privacy package before it stalled. But he has said he’s seen “no sign” it will get traction this year under new Republican leadership in the House Energy Committee.

That committee’s chairman, Representative Brett Guthrie (Republican-Kentucky), did not respond to a request for comment.