Being trolled online is an unfortunate part of life for celebrities in the age of social media. But actor Tiffany Haddish has taken a more direct approach toward handling this epitome of 21st century problems, according to a recent Los Angeles Times profile. In response to increasingly negative comments she’s gotten online, she’s “created a fake Instagram account where an alter ego named Sarah will go in and ‘destroy’ anyone hating on her by deploying details from their personal lives”:
“I’ve learned how to find people’s information — like I pull up the credit report, police records. You can do that for $1.99,” Haddish says. “Sometimes, I get so mad that I’ll get they phone number and I’ll just call them.”
She registers the disbelief on my face.
“Oh, I have called people, honey,” she says. “They be shocked that I called. They’ll be like, ‘I can’t believe you even saw that.’ You did a whole video, b—! You made a full, five-minute video! On the internet, people think they can just say whatever and you not gonna say anything. I try my best not to, but I’m a human being.”
On the one hand, I can’t necessarily say I blame Haddish for wanting to fight back against the nastiness people can send her way — but I also can’t say that her methods sit well with me. Her digital vigilantism is an extremely unsettling reminder of how much personal information we all have floating out there on the internet. Moreover, it highlights what a determined person with cash to spare can dig up, especially if their motives are more nefarious than Haddish’s.
The internet is filled with what are called “data brokers” — companies that purchase the breadcrumbs of personal information that we leave strewn across websites and willingly upload onto apps daily. They can then sell off that data to whomever wants to put up the money, including advertisers, marketers, health insurers, employers running background checks, and, worryingly, just about anyone who will pay. Haddish most likely used what’s known as “people search data brokers” — or “white pages” websites — which as she noted can compile things like police records and credit reports for individuals.
It’s a system that’s ripe for abuse, as researcher Justin Sherman wrote for Lawfare last year. Stalking — and potentially doxing — is made simple with information that once required having to travel to a physical location but now is being digitized and made available for sale. Most semi-legitimate and/or reputable sites have an option for requesting your information be removed, but it can be deeply tedious to go through the hundreds upon hundreds of brokers to hit them all. As then-staff writer Kaveh Waddell wrote in The Atlantic in 2017: “Trying to scrub your identity from the internet is like trying to drain a bucket of water with an eyedropper, while a dripping faucet slowly fills it back up again.”
Stalking — and potentially doxing — is made simple with information that once required having to travel to a physical location but now is being digitized and made available for sale.
There are some services that offer to undertake a mass purge for subscribers, seeking out clients’ information and requesting its removal. But that’s not a perfect solution: Some brokers won’t allow third parties to request information be removed; any data that’s removed can be put right back into place later; and these removal services can’t monitor all of the data brokers out there effectively. Gennie Gebhart, the Electronic Frontier Foundation’s activism director, compared the process to a “high-stakes Whack-A-Mole” when talking with CNET last year, adding “there’s always going to be something they miss.”
Some states have passed laws that require users to provide their knowledge and consent before companies are allowed to sell their data to third parties. California, where Haddish lives, has the most comprehensive of these laws: The Delete Act, which goes into effect fully in 2026. The law will allow residents “to either ask data brokers to delete their personal data or forbid them to sell or share it, with a single request,” according to The Verge.
Like most states, though, California has public record carve-outs in its privacy laws that would allow data brokers to keep listing anything that someone could reasonably gather from “publicly available information.” It’s a superficially sensible metric, one that allows for journalists for example to continue using digitized records for reporting. But, as Lawfare’s Sherman points out, “even though a court record may be ‘public’ already, the personal information from it was not previously available online, linked to a person (and a profile of them), and for sale by a private company with its own autonomy over whether or not to vet buyers.”
The complexities of the matter, and how clearly the issue can transcend state lines, means that the matter should be taken up federally sooner rather than later. The good news is that the Consumer Financial Protection Bureau is in the process of drafting new rules to potentially rein in some of the industry’s worst abuses. The House also recently passed a bill focused specifically on data brokers selling sensitive information to foreign adversaries. But for now, that means that there’s still little oversight preventing someone with a bone to pick with you from shelling out a little bit of money to learn reams of information about your past — and potentially find yourself in a very testy phone call with Haddish on the other end.
