Incogni has documented privacy procedures, account security features and a public independent assurance report. Those are useful reasons to consider it, but they do not make handing over personal information a risk-free decision. The practical question is whether its permissions, data handling and evidence meet your expectations.
This guide examines official documents checked on November 10, 2026. It evaluates the published evidence; it does not claim a hands-on security test or access to Incogni’s internal systems.
Why a data removal service needs your information
A removal request has to identify the right person. Otherwise, a broker cannot reliably distinguish your record from someone else’s. That creates a trade-off: you provide identifying details to a service so it can ask other organizations to stop processing them.
Incogni’s onboarding guide asks for your name, residential address and account email, with additional information including date of birth and phone number. US profiles require a phone number. Check the fields shown for your location before submitting your details. See Incogni’s setup instructions.
Provide accurate information relevant to the records you want removed. Inventing an address for privacy reasons defeats the matching process. If you are uncomfortable supplying a particular detail, ask why it is needed rather than entering a substitute.
What does the authorization form allow?
According to Incogni, the authorization permits it to contact data brokers, request removal and complain to relevant data protection authorities when brokers refuse. That is a defined purpose, rather than unrestricted permission to act in every part of your life. Its help page also says changes to primary profile details require a new form. Read the actual document presented during registration, as well as the explanation of its scope.
Before signing, check that the name and address are yours, the requested authority concerns privacy requests, and you understand which company will act for you. Keep a copy with your subscription records. These checks are useful for any service that sends legal or administrative requests in your name. When several adults share a subscription, the Family setup guide explains how each person completes their own account and authorization.
Does Incogni sell or share your data?
Incogni’s privacy policy says it does not sell personal information. It also describes sharing information with covered brokers and selected website owners to process removal requests. Other recipients include payment, hosting, support, marketing and analytics providers, plus affiliated companies. The policy describes safeguards for transfers outside the European Economic Area.
The distinction matters: a promise not to sell information does not mean no third party receives it. Assess the purpose of each transfer and whether it fits the service you want. A privacy policy that names recipients is evidence you can examine; it is not proof that every operational risk has disappeared.
| Question to ask | What to examine |
|---|---|
| Who receives my identification details? | The removal process and named recipient categories in the privacy policy. |
| Who can access support messages? | The support provider and the details you choose to include in a ticket. |
| What happens if I stop subscribing? | Account closure, retention and privacy-rights procedures, separately from billing cancellation. |
| Am I comfortable with the arrangement? | Your own willingness to delegate requests and share identifying information. |
What the Deloitte report covers
The public Deloitte Lietuva report is dated August 6, 2025 and provides limited assurance as of July 18, 2025. It covers specified assertions about broker coverage, removal confirmations, recurring requests, request volume and whether customer data was sold during 2024. It is a dated assessment, not continuous certification of every future removal.
The report explicitly excludes broader security testing, encryption testing and evaluation of overall privacy-law compliance. Treating it as a comprehensive cybersecurity or GDPR audit would overstate its scope. Read the original independent limited assurance report, rather than relying on an audit badge alone. When assessing your own subscription, focus on interpreting the removal results in your account as well as understanding what an assurance report establishes.
Account security: what you can control
Incogni states that it uses encrypted transfers and has completed a SOC 2 Type 2 examination. These are claims in its security documentation; this review has not independently inspected the underlying SOC report.
One concrete feature you can use is authenticator-based two-factor authentication. Incogni’s 2FA instructions explain how to enable it from your profile and save recovery codes. Use a unique password and store those recovery codes somewhere you can access if your phone is lost.
Protect the associated email account too. When a message asks for additional information, open your dashboard independently and verify the request. Avoid sending an unsolicited identity document simply because a message mentions data removal.
How to decide whether the trade-off works for you
Incogni may fit if you want ongoing administrative work delegated and accept the necessary data sharing. Handling requests yourself may fit better if you want direct control over each recipient and can maintain your own records. Our guide to removing personal information for free introduces that alternative.
Make the decision around your actual exposure: identify the records that concern you, check whether the service covers them, and decide what evidence would count as progress. A privacy service should help answer a specific problem. It should not require you to assume that a favorable security claim means every online risk has been solved.
Once you are comfortable with the permissions and data handling, compare the current plans with the work you want to delegate. If you have specific exposed pages in mind, check what Custom Removals covers before choosing a plan.
