Automating the Detection and Removal of Leaked Personal Data Using ChatGPT Agents

Every time you sign up for a membership card, fill out a real estate inquiry form, or create an account on an unfamiliar website, your information doesn’t just disappear—it gets harvested and sold by companies known as Data Brokers (simply put, companies that specialize in collecting individuals’ personal data and reselling it to third parties). Searching for and requesting removal from each site on your own is nearly impossible, as there are hundreds of such sites across the internet.

After reading this guide, you will know exactly: how to find the websites currently displaying your information, how to use ChatGPT to draft legally sound opt-out/removal request emails, how to track them until everything is resolved, and how to utilize agent mode (a specialized mode where ChatGPT can browse the web and fill out forms on your behalf) to cut down most of the manual effort. All prompts in this post come with a ready-to-use copy button, so there is no need to retype them.

1. Setting Expectations: What ChatGPT Can and Cannot Do

Before you begin, you need to understand one thing clearly: ChatGPT cannot “erase all traces of you from the entire internet.” No tool (including professional paid services) can guarantee wiping every website, database, and backup on the web. Understanding this limitation helps you set reasonable expectations and prevents you from getting discouraged along the way.

What ChatGPT truly excels at is acting as a process assistant: it helps you search faster, draft professional texts, and avoid missing any steps. Specifically, ChatGPT can:

• Find public pages that are likely displaying your personal information.
• Compile a list of websites, links, and the types of information appearing in each location.
• Locate contact pages, privacy policies, or data removal request forms.
• Draft removal request emails or messages with a professional tone and appropriate legal grounding.
• Help you build a tracking sheet: which websites have responded, and which have not.
• Set up recurring check reminders if your account has an automated task feature (called Tasks: simply understood as “setting a schedule for ChatGPT to automatically remind you of a task at a specific date and time”).
• Assist with direct browser actions if your account has the agent feature—simply understood as a mode that allows ChatGPT to open the web, click buttons, and fill out forms on your behalf, just as if you were controlling the computer, but done by ChatGPT instead. Section 6 of this document will detail how to enable and use this mode.

In short: ChatGPT is not an “internet eraser,” but it is an assistant that makes your data removal process faster, more organized, less prone to oversights, and, when needed, almost entirely automated using an agent.

2. When should you audit your personal data online?

You should set aside a session to check your personal information online if you fall into any of the following cases:

• You have received numerous spam calls, financial scam messages, or communications impersonating authorities.
• You have registered accounts across multiple e-commerce platforms, forums, or legacy apps that haven’t been used in a long time.
• You work in specialized fields (law, finance, journalism, systems administration) that require personal privacy protection.
• You are starting to look for a new job or preparing to launch your own business.

When searching, make sure to thoroughly audit the following four groups of information, ranging from less sensitive to highly sensitive:

1. Group 1 (General public information): Full name, social media profile pictures, professional bio on LinkedIn.
2. Group 2 (Secondary contact information): Secondary emails, forum usernames, old social media handles.
3. Group 3 (Direct contact information): Primary email, personal phone number, workplace address.
4. Group 4 (Highly sensitive data): National ID/Citizen ID numbers, home address, photos of identity documents, financial/health information, internal company data.

3. Security Setup and Safe Keyword Preparation

Before asking ChatGPT to search, prepare a list of keywords about yourself to get more accurate results. For example, a well-prepared set of keywords includes:

• Full name with accents and without accents (e.g., “Nguyễn Văn A” and “Nguyen Van A”).
• Personal or work email addresses you have used.
• Usernames/nicknames commonly used on social networks and forums.
• Company or school names combined with your full name.

Before entering any data, go to Settings → Data Controls on ChatGPT and turn off the “Improve the model for everyone” option. This action prevents OpenAI from using your information to train future public AI models.

4. Legal Basis: Decree 13/2023/ND-CP

If you simply message a website asking to “delete my information,” most will ignore it due to the lack of binding legal grounds. In Vietnam, collecting and displaying personal data without consent constitutes a violation of the law under Decree 13/2023/ND-CP on Personal Data Protection (effective since July 1, 2023) [1].

This serves as your essential “legal weapon” to include in every email or formal data removal request. A standard removal request must ensure three key elements:

• Accurate citation of legal documents: Decree 13/2023/ND-CP regarding the data subject’s right to request data deletion.
• A clear response deadline: Typically between 48 hours and 7 working days.
• Next steps if unaddressed: Establishing a bailiff’s deed (vi bằng) to record evidence or filing a complaint with the Authority of Information Security (Ministry of Information and Communications).

5. 10-Step Process for Manually Removing Personal Information

Below is the 10-step process in logical order. Each step includes specific actions, accompanied by standard command templates and prompts so you can perform them without requiring complex technical knowledge.

Step 1: Perform an initial self-check on Google using exact match syntax

Open Google and search using the phrases below. Always enclose them in double quotation marks so Google searches for the exact phrase rather than individual words scattered across the page:

"Your full name"
"Full name" "phone number"
"Full name" "email"
"your email"
"your phone number"
"your username"
"Full name" "company or school"
"Full name" filetype:pdf
"email" filetype:pdf
"phone number" filetype:pdf

For example: typing “John Doe” (with quotation marks) filters out thousands of noisy, irrelevant results compared to searching without quotes.

Step 2: Have ChatGPT Search by Keyword Groups

Paste the prompt below into ChatGPT after filling in your information. Click the Copy button to get the verbatim text:

Please help me find public search results on the Internet that may contain my personal information. The keywords to check include:
- Full name: [enter full name]
- Non-accented name: [enter non-accented name]
- Email: [enter email if you want to check]
- Username: [enter username]
- Phone number: [enter only if really necessary]

Please search by each keyword group, then generate a table including: website, link, type of information found, sensitivity level, and recommended next steps. Only include results with a high likelihood of relevance. If you are unsure whether it refers to the same person, please flag it as "needs verification."

Step 3: Categorize Results and Assess Risk Levels

Once you have the list of links, categorize them into 4 levels: Urgent (financial information, citizen ID card, address), Important (phone number, primary email), Moderate (old forum usernames), and Shared-name information that requires verification.

Step 4: Create a tracking sheet for removal requests

Use the prompt below to have ChatGPT generate a detailed tracking sheet. You can copy this table to Google Sheets, Excel, or Notion to manage the status for each website:

Based on the results found above, please create a tracking table for my information removal requests. The table should include the following columns:
1. No.
2. Website
3. Specific URL
4. Type of exposed information
5. Sensitivity level
6. Contact page or removal request form
7. Contact email (if available)
8. Content requested for removal
9. Processing status
10. Date request sent
11. Follow-up date
12. Notes

Each website should have a clear status: Request not sent, Sent 1st time, Responded, Successfully removed, Removal rejected, or Follow-up required after 7 days.

Step 5: Find the Contact Page or Data Removal Request Form

Each website usually has at least one of the following pages: Contact, Contact Us, Privacy Policy, Data Removal, Opt-out (requesting the removal of information from the system), Legal, Support, or Help Center. Ask ChatGPT to find them for you instead of manually checking each page.

For each website in the list, please find the contact page, privacy policy page, or personal data deletion request form. Create a table containing: website, contact page link, support email (if available), privacy policy link (if available), opt-out or data removal link (if available), and the appropriate method to submit a request.

If you cannot find the contact page, try: checking the website’s footer, looking for the “Privacy Policy” page, searching for email addresses like [email protected], [email protected], or [email protected], or looking up domain ownership details using a WHOIS tool (a public lookup tool that shows who registered a website address).

Step 6: Draft the information removal request email

This is the most critical step. The email should maintain a clear, polite, and substantiated tone. Absolutely avoid using threatening, insulting, or overly emotional language. Doing so often leads websites to refuse cooperation rather than resolving the issue faster.

Write an email for me requesting a website to remove my personal information. The tone should be clear, firm, yet polite. The content must include:
- I am the individual whose personal information appears at this link.
- Link to be removed: [paste link]
- Information to be removed: [specify type of information]
- Reason for removal request: personal information is publicly displayed, and I no longer wish for it to be public.
- Request the website to delete or hide this information from the web page and internal search results.
- Request a response within 7 business days.
- Do not include any unnecessary sensitive information.

If you want to use it right away without waiting for ChatGPT to draft it, here is a pre-made email template; you just need to fill in the blanks:

Dear Support Team,

I am writing to request the removal of my personal information currently being displayed publicly on your website.

Link containing the information to be removed: [paste link]

Information to be removed includes: [specify details, e.g., phone number, email address, physical address, personal profile, personal photos]

I do not consent to having this information publicly displayed. Please assist in deleting, hiding, or disabling public access to the aforementioned data.

If further verification is required to process this request, please reply to this email specifying the exact information needed. I kindly request a response within 7 business days of receiving this notice.

Sincerely,
[Your Name]

Step 7: Draft a short message when the website only has a contact form

Some websites do not provide an email address, only a contact form on the page. In that case, use a shorter message to easily fit into smaller text boxes:

Hello,

I would like to request the removal of my personal information appearing at the following link: [paste link]

Information to be removed: [specify type of information]

I do not want this information to continue being displayed publicly. Please assist in deleting or hiding this content and follow up with me once it has been processed.

Thank you.

When a firmer tone with legal citations is needed

“Firm” does not mean abusive, threatening, or unprofessional. A strong request still requires all five elements: a specific link, specific information to be removed, a clear reason, a response deadline, and a request for confirmation after resolution—the only difference being the addition of legal grounds in Part 4 and a more assertive, non-pleading tone.

Rewrite the personal data removal request email in a firmer tone that remains polite, professional, and non-threatening. The email must include:

1. Citations of Vietnam's Law on Cybersecurity and Decree 13/2023/ND-CP on personal data protection, clearly stating that collecting and displaying information without consent is a violation of the law.
2. A strict deadline: demand the complete removal of data within 48 hours of receiving the request.
3. A clear declaration: if the information is not removed after the deadline, I will establish a bailiff's report (evidence record) and file a complaint with the Authority of Information Security (Ministry of Information and Communications) and law enforcement authorities.

Draft both a Vietnamese version and an English version in case this is a foreign website.

Step 8: Use ChatGPT agent if this feature is available on your account

As explained in Part 1, an agent is a mode that allows ChatGPT to independently open websites, find contact pages, and fill out forms on your behalf. This is a powerful feature, but it must be used with caution, because when logging into a website or enabling additional applications, the agent may access sensitive data such as emails, files, or account settings. Part 6 of the documentation provides detailed instructions on how to enable this mode, along with a dedicated set of prompts that allow the agent to handle almost the entire process.

The agent can assist with: opening each website in your tracking sheet, finding the contact or Privacy Policy page, filling out contact forms if you permit it, preparing removal request contents in advance, submitting the request when the website allows it and you confirm, and recording the status after submission.

What you should not let the agent do automatically: Do not allow the agent to automatically enter passwords for important accounts, submit identity documents without your prior review, agree to unfamiliar terms and conditions, make payments for takedown services, send mass requests without your approval of the content, or access your personal email and cloud storage unless absolutely necessary.

Step 9: Monitor Responses After Submitting the Request

Submitting does not mean your work is done. You need to record: the submission date, the target website, the email or form used, the content sent, whether there is a ticket ID (tracking number provided by the website), the follow-up deadline, the website’s response, and the final status.

Suggested timeline so you don’t forget: after three days, check if you received a confirmation email acknowledging receipt of the request. After seven business days, send a first reminder email if there is no response. After fourteen days, send a second reminder. After thirty days, consider next steps such as reporting to the platform, requesting search engines to remove outdated results, or seeking legal counsel if the information is overly sensitive.

Write a follow-up email requesting the removal of personal information. I submitted the initial request on [date], but have not received a response. The tone should be polite yet firm, requesting a processing status update and a reply within 3 business days.

Step 10: Request search engines to update or remove outdated results

In some cases, the original website may have already removed your information, but Google or other search engines continue to display a cached version or an outdated snippet. When this happens: verify whether the original link has truly been removed, take a screenshot if the search results still display your information, use the search engine’s outdated content removal or update tool, and check back after a few days.

This website has removed my information, but search results still display the outdated snippet. Please guide me through the steps to request search engines to update or remove outdated results. Please write step-by-step for a non-technical person.

Tip: Schedule periodic checks: If your account has access to the Tasks feature (automated reminders), ask ChatGPT to remind you to check periodically so you don’t have to remember manually. If you don’t have this feature, you can still schedule reminders on Google Calendar or on your phone.

6. Automate the entire process using ChatGPT agent

If you don’t want to manually complete each step in Part 5, you can let the agent mode handle almost everything: automatically finding the page, filling out the form, and submitting the application. You only need to confirm sensitive steps. Here is a 4-step process specifically for the agent, which can run in parallel with or replace Part 5.

Easiest way to enable agent mode

1. Open the ChatGPT app or website, log in with a paid account: agent mode is currently only available for Plus, Pro, Team, or Enterprise plans, and is not yet available for free plans[2].
2. In the message input box, click the plus icon (+) or the tools icon next to the chat box.
3. In the list that appears, select “Agent mode” (or “Trợ lý hành động” if the interface is translated into Vietnamese).
4. Start a completely new chat, paste the prompt from Step 1 below, and send it.

If your account does not show Agent mode yet, your app version may not be updated; try updating the app or using it on a desktop browser.

Step 1: Scan for data leaks using an agent

Prepare your full name, past and current phone numbers and email addresses, location, or field of work. Open a new chat (with Agent mode enabled), paste the following prompt, and send it.

I want to conduct a comprehensive personal data security audit. Please act as a cybersecurity expert and digital detective. My information includes:
- Full name: [Enter full name]
- Phone numbers used: [Enter Phone 1, Phone 2]
- Email addresses used: [Enter Email 1, Email 2]
- Location/Field of work (if applicable): [Enter to help the AI filter duplicates]

Your task: Use your web browsing capability to scour the internet for all business directories, tax ID lookup sites, public forums, or data brokers that are displaying or unlawfully storing my information.

Output format: Generate a 3-column table: (1) Website name, (2) Type of my personal data exposed on it, (3) Direct URL to the website's "Contact", "Submit Complaint", or "Opt-out/Information Removal" page.

Step 2: Draft the legal ultimatum

In the same chat thread, paste the following prompt to have ChatGPT draft a data takedown request based on the list just found.

Based on the list of websites just identified, please draft a formal and serious Data Erasure Request template for me in Vietnamese (and an English version if foreign websites are involved). The letter must include:

1. Citation of the Vietnam Cybersecurity Law and Decree 13/2023/ND-CP on personal data protection, explicitly stating that collecting and displaying personal data without consent violates the law.
2. A strict deadline: Request complete removal of data within 48 hours of receipt.
3. A firm statement: If the deadline passes and the information is not deleted, I will secure a bailiff’s evidence record (vi bằng) and file formal complaints with the Authority of Information Security (Ministry of Information and Communications) and relevant law enforcement agencies.

Step 3: Activate the agent to process each site

Still in the same chat thread, paste the following prompt. The agent will sequentially open each link, automatically fill in the information, paste the letter content from step 2 into the reason field, and click the submit button.

Please enable full permissions for agent mode (Action Assistant). Your task is to process the list of websites compiled in step 1:

1. Access each website's contact/opt-out/takedown link.
2. Automatically fill in my personal information (Full Name, Phone Number, Email) into the corresponding fields on their form.
3. Copy the legal letter content from step 2 and paste it into the "Message/Reason for removal" field.
4. Click the "Send" or "Submit" button.

Special note: If any site requires email verification, notify me so I can click the confirmation link. If any site presents a CAPTCHA (image selection, anti-bot characters) that you cannot solve on your own, take a screenshot of that section, pause, and prompt me to solve it; once resolved, proceed with the remaining sites.

Warning: The agent may pause and ask for your confirmation before executing sensitive actions, such as clicking the final “Submit” button on certain websites. This is a built-in safety mechanism in ChatGPT, not an error. Stay close to your screen while the agent runs to provide timely confirmation when prompted, rather than leaving it running unattended in the background.

Step 4: Set up monthly recurring sweeps

Data brokers are stubborn. Many sites automatically scrape your information again just months after removing it. This final prompt asks ChatGPT to use Memory (long-term memory) and Tasks (scheduling feature) to automatically repeat the process every month.

Save this task to your long-term memory (Memory). On the 1st of every month, automatically rerun this scanning process once.

- For existing sites: Check if they have removed the data; if it hasn't been removed or if the information has reappeared, use the agent to send a firmer follow-up request.
- For newly discovered sites: Automatically send a new request.

At the end of each month, export a progress report showing which sites are "Clean" and which are still "Flagged Red".

7. Quick-Use Prompt Pack

If you don’t want to re-read the entire process every time you use it, here are four condensed prompts for the manual workflow that pack all the necessary details. Just click copy and paste into ChatGPT.

Search for public results on the Internet that may contain my personal information based on the following keywords: [full name], [unaccented name], [email], [username], [phone number if needed]. Please create a table containing: website, link, type of information found, sensitivity level, likelihood of relevance to me, and recommended action. If you are not sure it is the same person, mark it as needs verification.

For each website in the list above, find the contact page, privacy policy page, support email, or personal data deletion request form. Create a table containing: website, contact link, email if available, privacy policy link if available, opt-out or data removal link if available, and the appropriate method to submit the request.

Write me an email requesting the removal of personal information from a website. The tone should be clear, firm, but polite. The content must include: I am the individual whose information appears at this link, the link that needs removal, the specific information to be removed, the reason for the removal request, a request for a response within 7 business days, and avoid adding unnecessary sensitive information.

Please create a tracking table for personal information removal requests for me. The table should include: website, link, type of information, request submission date, status, follow-up date, next follow-up content, and notes. If the website does not respond after 7 business days, draft an appropriate follow-up email.

If you want to let an agent handle almost the entire process instead of doing it manually using the four prompts above, use the set of four agent prompts in Section 6.

8. Checklist and Common Mistakes to Avoid

Step-by-Step Checklist

• Search for your name, email, phone number, and username on Google using quotation marks.
• Use ChatGPT to assist in finding related results and filter out those that actually pertain to you.
• Classify the sensitivity level of each result, then create a tracking spreadsheet.
• Locate the Contact, Privacy Policy, or Data Removal page for each website.
• Draft a removal request email, submit it via email or a contact form, and log the sent date and message content.
• Check for responses after three to seven days, and send a follow-up if it has not been processed.
• Once the website has removed the content, check whether Google still displays the outdated result; if so, request a search engine update.
• Schedule periodic checks weekly or monthly to ensure nothing is missed.
• Do not provide personal identification documents unless you are certain the website is trustworthy.
• Do not pay any unfamiliar data removal services without thoroughly verifying their credibility.

Six Most Common Mistakes

9. When to Seek Legal Support

In most cases, you can handle the issue yourself using the process above, based on Decree 13/2023/ND-CP mentioned in Section 4. However, consider consulting a lawyer or relevant authorities if you encounter any of the following situations:

• The exposed information includes photos of identity documents.
• Your home address, phone number, or family details are made public.
• Sensitive images are posted without permission.
• There is fabricated, defamatory, or threatening content targeting you.
• The website refuses to take down the content despite the information clearly being your private data, even after citing Decree 13/2023/ND-CP.
• There are signs of fraud, extortion, or impersonation.
• Customer data or company confidential data is leaked.

10. A Shortened Workflow for Busy People

If you find the full guide above too long, here is a condensed twelve-step version—just follow them in sequence:

1. Open Google.
2. Search for your name, email, and phone number, always enclosed in quotation marks.
3. Copy suspicious links to a temporary storage space.
4. Paste them into ChatGPT and ask it to categorize their sensitivity level.
5. Ask ChatGPT to find the contact page for each website.
6. Ask ChatGPT to draft a takedown request email, citing Decree 13/2023/ND-CP if a firmer tone is needed.
7. Send the email or fill out the contact form, or let an agent do it for you as described in Section 6.
8. Log the date sent in a simple spreadsheet.
9. After seven days, if there is no response, ask ChatGPT to draft a follow-up email.
10. Once the website removes the content, check back to see if Google is still displaying it.
11. If it still appears, request the search engine to refresh its results.
12. Schedule a recurring check every week or every month.

11. Troubleshooting tips when the agent gets stuck

Here are practical experiences to keep you from feeling overwhelmed when doing it yourself, even for the first time.

How to handle an agent getting stuck on a Captcha

When the agent encounters a Captcha while browsing the web, it will automatically pause and notify you on the screen. At this point, simply solve the Captcha manually directly on the screen displayed by ChatGPT, then type in the chat box: “I have solved the Captcha, please proceed by clicking the Submit button”, and the agent will continue working through the remaining pages.

Manual Cross-Check After One Week

About a week after the agent finishes submitting all requests, go to Google yourself and search for exact-match phrases by enclosing them in quotation marks, for example: "Nguyễn Văn A" "0901234567". If Google no longer returns results from the previous junk sites, your campaign was a success.

• Turned off “Improve the model for everyone” in Data Controls before entering sensitive information.
• Always run prompts belonging to the same workflow within a single chat session so the agent correctly remembers the context and website list.
• Stay near your computer while the agent is running to confirm emails or solve Captchas when prompted.
• Check back on Google after a week to verify the actual results instead of relying solely on the AI’s report.

Read more

12. Frequently Asked Questions (FAQ)

Below are detailed answers to the most common questions regarding automating the process of auditing and protecting personal data: