Privacy Exposure Reduction for Family Offices

exec-b9ea9163-9652-4764-a06a-98e4384e8a77

The question usually arrives in the same form. Someone in the family has found their home address on a people-search site, or a foundation grant has turned up in an article, and the office is asked to make it stop. The instinct is to buy a removal service. That is often a reasonable purchase eventually, and it is almost always the wrong first move, because it addresses the least durable part of the exposure.

Exposure reduction is not one job. It is three, and they behave differently. Some disclosure is legally required and permanent. Some data is discretionary and removable, but only on a maintenance cycle that does not end. And separately from either, there is the question of what someone can do with the information once they have it. That last category is the cheapest to close and the most durable once closed, which is why it should come first, and it is the one a removal subscription does not touch.

Close the uses before chasing the data

Two federal mechanisms block two specific uses of an exposed identity: opening credit in someone’s name, and filing a tax return as them. Both are free, both last indefinitely, and neither appears in an IT services contract.

The first is a credit freeze. The Federal Trade Commission is plain about the mechanics. There is no cost to place or lift a freeze, it “lasts until you lift it,” and while it is in place “nobody can open a new credit account in your name.” Placing one means contacting all three nationwide bureaus separately. It is also available for children: the FTC advises requesting a free freeze for a child under 16. A fraud alert is a weaker instrument by design. It asks businesses to check with you before opening a new credit account rather than preventing the account from being opened, and it requires contacting only one bureau.

The second is the IRS Identity Protection PIN. Anyone with a Social Security number or ITIN who can verify their identity is eligible to enroll, and parents and legal guardians can request one for a dependent. The number is valid for one calendar year and a new one is generated annually. Once someone is enrolled, “an incorrect or missing IP PIN will result in the rejection of your e-filed return.” That is the operational point. An IP PIN is not a service that notices a fraudulent filing afterwards. It causes the fraudulent filing to fail. The paper alternative, Form 15227, is restricted by adjusted gross income, so for this audience the practical route is enrollment through an IRS online account.

Neither mechanism is exotic, and in our experience, both are commonly skipped, because they are individual acts rather than institutional ones. The office cannot batch them. Each person verifies their own identity with each bureau and with the IRS. We advise treating that as a scheduled project with a named owner and a defined population, rather than as advice passed along in a meeting. The same applies to the annual handoff the IP PIN creates: someone has to make sure the family’s tax preparer holds the current year’s number before filing, and that is an office responsibility rather than an assumption.

Defining the population is the part most often done loosely. The list that matters is not the household roster. It is everyone whose credit or tax identity, if compromised, would create a problem the office would be asked to solve. That usually means the principal and spouse, minor children, adult children who remain financially connected, and in some structures the trustees and officers whose names already appear in public filings.

The recurring work, and what deletion rights deliver

Broker data is a real exposure and a different kind of problem, because removal is not a state you reach. It is a cycle you maintain.

California’s Delete Act produced the furthest-reaching deletion mechanism now operating in the United States, and its design makes the point. The state’s Delete Request and Opt-out Platform lets a consumer submit a single request to the agency that reaches every registered broker, and registered brokers must access the platform “at least once every 45 days” beginning 1 August 2026. That is a substantial improvement on filing individually with hundreds of companies. It is also, by construction, a polling loop: requests are honored on a cycle, by the brokers who are registered, for a consumer whose California residency the agency has verified first. Families with residences and domicile in several states will find the coverage uneven.

The scope is also wider than the people-search sites a family tends to notice. The Consumer Financial Protection Bureau publishes a list of consumer reporting companies that runs well past the three nationwide bureaus into check and electronic funds transfer screening, tenant screening, insurance, employment and volunteer screening, and telecommunications and utilities. Under the Fair Credit Reporting Act, “all consumer reporting companies are required to provide you a copy of the information in your report if you request it.” Our view is that for a family whose concern is account opening rather than borrowing, the check-screening and telecommunications files are frequently more relevant than the credit file, and they are almost never requested.

The location question deserves precision rather than volume. The FTC has brought and settled cases against data brokers over precise location data, including a finalized order prohibiting X-Mode Social and its successor Outlogic from sharing or selling sensitive location data. What that establishes is that precise location data has been collected and sold at scale and has attracted federal enforcement. It does not establish what any particular broker holds about any particular family, and it should not be presented as though it does.

What cannot be removed

The most consequential disclosures about a wealthy family are often the ones no service can suppress, because a statute requires them.

Private foundations are the clearest case. The IRS requires exempt organizations to make their annual returns available for a three-year period, and the contributor rule is unusual: “With the exception of private foundations, an exempt organization is not required to disclose the name and address of any contributor to the organization.” A family giving through its own private foundation is therefore publishing donor names and addresses in a document designed to be found. County property records behave the same way, as do officer and trustee listings in state entity filings.

This is not a security problem with a security answer, and we do not present it as one. It is a structuring question, and the only point at which it is inexpensive to influence is before the structure exists. When a family is deciding how to make a gift, hold a residence or organize an entity, the public-disclosure consequence is worth raising alongside the tax and governance questions, with counsel. Raised after the filing, it is mostly wasted effort. What the office can still do is narrower and worth doing: know exactly what is published, so that nobody is surprised by it and so that permanent disclosure is not confused with the removable kind.

Why this stalls, and who should own it

The work rarely stalls because anyone disagrees that it matters. It stalls because it sits between functions. Credit freezes look like financial administration. IP PINs belong with the tax preparer. Broker removal looks like a security purchase. Public filings sit with counsel. Nobody holds the whole picture, so each piece is handled by whoever happened to notice it.

Our recommendation is to give the whole question one owner, usually the COO or whoever is already accountable for the family’s operational risk, and to give that person a short standing record: who is covered, which blocks are in place for each of them, when the broker cycle was last run, and what is published that cannot be withdrawn. Review it annually and after anything that changes the public record, such as a property transfer, a new entity, a foundation filing, or a family member reaching an age at which their financial identity becomes worth attacking.

Holding that record current as circumstances change is the kind of standing responsibility ongoing advisory exists for, and the first discovery pass fits naturally inside a risk assessment.

Buying help without buying the wrong thing

Removal services are legitimate, and for a family with meaningful exposure they are worth paying for. The evaluation criteria matter more than the name on the invoice.

Ask which categories of broker a service actually covers, and whether coverage reaches beyond people-search sites into the specialty reporting files. Ask how often removals are re-checked and what happens when a record reappears, because it will. Ask what the service does not do, and confirm the answer includes credit freezes, IP PINs and statutory filings, since a service implying otherwise is describing something it cannot deliver. Ask what becomes of the identity data the family has to hand over so that removals can be requested on their behalf, and where it is held.

Annapurna sells neither monitoring nor removal, which is why we are comfortable saying that most families should complete the free mechanisms before spending anything on the paid ones. The order is not a budget question. The free mechanisms are permanent, and the paid ones are a subscription to a cycle. Most family offices have already been told what belongs on this list. What has been missing is the sequence, and the name of the person responsible for working through it.