Many modern “people” pages on the web are powered by hidden JSON feeds or lightweight APIs. Even if you get a visible profile page edited or hidden, your details can quietly reappear because the underlying JSON feed still contains your data and refreshes the page. This guide explains what these feeds are, how to find them, and how to submit effective removal requests so your information is deleted at the source—not just masked on the surface.
What Are Hidden “People” JSON Feeds?
Websites often separate data from design. A public-facing profile page displays your information, but the real source may be a machine-readable file or endpoint—often JSON—that the site uses to populate many pages automatically. These can be:
- Public JSON endpoints that list people in a directory (e.g., /people.json, /team.json, /directory.json, or paginated variations like /people?page=2&format=json).
- Per-person JSON files often placed under predictable paths (e.g., /people/john-doe.json).
- JSON-LD scripts in page source that include structured profile data using schema.org markup.
- Search/back-end APIs providing JSON results for user lookup (e.g., /api/people?q=doe).
Because these feeds are designed to drive the visible page, removing your details from the HTML alone is not enough—if the JSON feed isn’t cleared, your info can repopulate or remain accessible to scrapers.
Why These Feeds Matter for Your Privacy
- Persistent exposure: Feeds refresh pages automatically, so deleted data can reappear after a periodic sync.
- Data broker ingestion: Scrapers and aggregators target JSON because it’s clean, structured, and easy to parse.
- Search engine indexing: Some JSON endpoints get indexed or cached, making your information discoverable even if the visible page is removed.
- Change blindness: You may think you “fixed” a page, only to find your details still live in the feed itself.
How to Confirm a Profile Page Is Powered by a JSON Feed
You don’t need to be technical to spot common patterns. Use this step-by-step approach:
- View page source: Right-click the profile page and choose “View Page Source” or press Ctrl/Cmd+U. Search for terms like “.json”, “people”, “directory”, “api”, “schema.org”, or “application/ld+json”.
- Check Network activity: In your browser’s developer tools (Network tab), reload the page and filter for “fetch” or “XHR”. Look for requests ending in .json or routes like /api/people or /search?format=json.
- Look for JSON-LD blocks: In page source, search for “application/ld+json”. If present, open it and look for your name, email, phone, job title, or address.
- Probe common endpoints: If allowed, try visiting likely endpoints such as /people.json, /directory.json, /team.json, or /api/people. Do not attempt anything intrusive—simply checking public paths is sufficient.
- Check sitemaps and robots.txt: Visit /sitemap.xml or /robots.txt for hints about directories or feeds that list people profiles.
Document What You Find
When you identify a JSON feed or block of JSON-LD that includes your personal information, capture clear evidence. This helps support an effective removal request:
- Take screenshots showing the visible profile page and, separately, the JSON feed or JSON-LD containing your data.
- Copy the exact URLs of the profile page and any JSON endpoints.
- Save timestamps and short notes describing which fields contain your data (e.g., phone, email, home city).
- Record request headers/paths from the Network tab if you found API calls. You don’t need technical details beyond the URL and purpose.
Prioritize What Needs Removal
Target the sources that are most likely to repopulate your details:
- Main directory feed (e.g., /people.json) that populates many profiles.
- Per-person JSON (e.g., /people/john-doe.json) tied directly to your page.
- Search or autocomplete APIs that reveal your info via query.
- JSON-LD in the page source that search engines may parse.
Ask for removal or redaction at each source. If the site only edits the visible page and leaves the feed intact, your data may return.
Make a Targeted Removal Request
When you contact the site, be precise, polite, and specific about the JSON sources. Your message should contain:
- Identity confirmation: Provide proof you are the person named (e.g., a photo ID with sensitive numbers covered except your name, plus a link to the profile page). Only share what’s necessary.
- URLs to remove or redact: List the exact profile URL and all related JSON endpoints you discovered.
- Specific fields: Name the fields that expose you (e.g., email, phone, address, employer, job title, date of birth).
- Clear request: Ask for permanent removal or redaction from the JSON feed(s), API endpoints, and any cached copies. Request search de-indexing where appropriate.
- Retention and recurrence control: Ask them to prevent repopulation from upstream sources and to confirm if your data is sourced from partners or data brokers.
Sample Email Template
Subject: Request to Remove Personal Data from JSON Feeds and Profile Page
Hello [Site/Company],
I’m requesting removal of my personal information from your website and the JSON feeds or APIs that power it. My profile appears at: [Profile URL]. I also found these related JSON sources that include my data: [List JSON/API URLs].
Please remove or redact my name and the following fields from all related JSON feeds, APIs, and pages, and prevent repopulation: [List fields]. If my data is sourced from third parties, please share the source so I can request removal there as well.
Kindly confirm when the changes are complete and whether any caches or search indexes have been cleared.
Thank you,
[Your Name]
Where to Send Your Request
Most sites publish multiple contact paths. Use more than one channel to increase your chances of a timely response:
- Privacy or data protection email: Look for privacy@, security@, dpo@, or compliance@ in the site’s policy pages.
- Support form: Submit a ticket via the “Contact” page, attaching your documentation.
- Legal address: For stubborn cases, send a registered letter referencing applicable privacy laws in your region.
- Regional rights requests: If you’re covered by specific laws (e.g., GDPR, CCPA/CPRA, Virginia CDPA), use the site’s published data rights portal or form for deletion or opt-out.
Strengthen Your Request with Applicable Rights
Even if you’re outside strong-privacy jurisdictions, many organizations honor reasonable deletion requests. Where applicable, reference your rights:
- Access and deletion: Ask for confirmation of what data is held about you and request deletion or redaction.
- Opt-out of sale/sharing: If the site shares data with third parties or data brokers, request an opt-out.
- Data sourcing: Request the sources of your data, so you can remove it at the origin as well.
Check for Repopulation and Caches
After a site confirms removal, verify the fix:
- Revisit the JSON URLs: They should return no data about you, an error, or anonymized content.
- View page source again: Confirm that JSON-LD blocks no longer contain your details.
- Clear your cache and use a private window: Ensure you’re not seeing an old local copy.
- Use a crawler cache check: Search for site:example.com “Your Name” and check cached results. If caches persist, ask the site to purge their CDN and request removal from search engines using their URL removal tools.
If the Site Doesn’t Respond
- Follow up politely after 7–10 business days, reiterating the specific JSON sources and legal rights (if applicable).
- Escalate to a supervisory or legal contact listed in the privacy policy.
- File a complaint with a relevant authority (e.g., data protection regulator) if you’re covered by regional privacy laws.
- Document everything—timestamps, messages sent, screenshots—so you can show a clear history of requests.
Reduce Upstream Repopulation
Even after a successful removal, your details may reappear if a partner or data broker continues to send updates. Take these steps:
- Ask the site for data sources: Request the names of vendors or feeds that provided your data.
- Opt out at data brokers: Remove your info from major brokers and people-search sites that often seed directories.
- Lock down public profiles: Review social media privacy settings, old resumes or bios on past sites, and any public CSVs, PDFs, or Google Sheets that might include your info.
- Set up monitoring: Periodically search your name, phone, and email to catch reappearances quickly.
Technical Clues Non‑Experts Can Use
You don’t need to write code to spot JSON feeds. Focus on these recognizable signs:
- URL patterns: Words like api, people, team, directory, staff, members, alumni, users, or contributors in the path or filename.
- Query strings: format=json, ?json=1, ?_format=json, or endpoints ending in .json.
- Structured data blocks: application/ld+json sections in page source containing your details.
- Autocompletes/search bars: Typing a few letters and seeing instant results suggests an underlying JSON API.
Redaction vs. Deletion: What to Ask For
If total deletion isn’t possible (e.g., legitimate directory of current staff), consider alternatives that still protect you:
- Redact contact fields: Remove email, phone, and address while leaving a name-only entry if required.
- Generic titles: Replace exact job titles with a non-identifying label or “Former staff.”
- Shortened IDs or slugs: Replace unique usernames, IDs, or slugs with randomly generated placeholders.
- Noindex/noarchive: Request meta tags or robots rules that discourage search engine caching and indexing.
Keep Your Financial Identity Monitored
Exposure in JSON feeds can lead to targeted phishing, account takeovers, or synthetic identity attempts over time. In addition to removal, consider ongoing monitoring of your credit and identity signals. A dedicated service can alert you to unexpected changes, new accounts, or suspicious inquiries that may follow public exposure. For a practical overview of privacy-aware credit and identity monitoring, see this resource on credit and identity protection.
Pro Tips That Speed Up Results
- Be exact with URLs: Include full links to feeds and the profile, not just the domain.
- List fields by name: Use the site’s own labels (e.g., “telephone”, “email”, “addressLocality”) to avoid confusion.
- Mention recurrence risk: Explain that the JSON feed is repopulating the profile so they address the root cause.
- Request confirmation: Ask the site to confirm which endpoints and caches were updated.
- Set a reasonable deadline: Polite timelines (e.g., 10–14 days) help your request get prioritized.
Frequently Asked Questions
Will removing the profile page automatically remove the JSON feed?
Not necessarily. Many sites remove the page but leave the feed intact. Always verify the JSON endpoints and request removal at the source.
Can search engines index JSON feeds?
Yes. Some JSON endpoints are accessible and get crawled or cached. Even if they aren’t prominently linked, scrapers and crawlers can still find them.
Is JSON-LD the same as an API?
No. JSON-LD is a structured data block embedded in a page, while an API is a separate endpoint. Both can expose the same personal details, and both should be addressed in your request.
What if the site says it must retain my record?
Ask them to redact sensitive fields, remove unique identifiers, and implement robots noindex/noarchive for any required public entries. Also request that they disable or restrict any JSON endpoints that expose your data.
How long should I wait before following up?
Seven to ten business days is a fair window. If there’s no response, follow up, then escalate via additional channels outlined in the privacy policy.
A Quick Checklist
- Identify the visible profile page.
- Locate related JSON feeds, APIs, or JSON-LD in source.
- Capture screenshots, URLs, and timestamps.
- Submit a targeted removal/redaction request to privacy and support contacts.
- Ask about data sources to prevent repopulation.
- Verify removal on the page and in all JSON endpoints.
- Request cache/CDN purges and search de-indexing if needed.
- Monitor periodically for reappearance.
Conclusion
Hidden “people” JSON feeds are often the true source of your online profile details. If you only change the visible page, your information can quietly repopulate or remain accessible to scrapers. By learning how to locate these feeds, documenting exactly where your data appears, and submitting a precise request that targets the underlying JSON, you can remove your details at the root and reduce the odds of re-exposure. Follow up, verify that caches and search results are cleared, and keep an eye on upstream data sources to stop the cycle of repopulation before it starts.
Good to Know
If a site’s public profile page for you still shows updated details after you thought it was removed, the site is likely re-pulling from a hidden JSON feed or API. You have to target the source feed, not just the visible page.