The People-Finder Playbook

If you remember nothing else from this playbook, remember the number on this page.

The average internet user has 168 to 240+ online accounts. [1] [2] [3]

Not 8. Not 12. Not even 20.

Hundreds.

Most of us don't remember signing up for half of them. A 2024 NordPass study found the average person has 168 passwords, which roughly corresponds to 168 accounts [2]. A separate Surfshark study that same year put the average above 240 [1]. Either number is the same gut-punch: every one of those accounts is a place a person's data sits, indexed by search engines, exposed in data breaches, or quietly accumulating profile information.

Here is the fact that matters for the rest of this playbook. The internet has fragmented the average human identity across hundreds of silos. Most of those silos leak, through search engine indexing, breach databases, data brokers, public posts, and the simple habit of reusing usernames and email addresses.

What the numbers actually look like

• 5.45 billion people are online as of mid-2024 [4].
• The average user actively maintains 6.7 social media accounts [4]. Some studies put it at 5.54 [5], others at 7.6 [6]. The exact number depends on how you count, but every estimate lands between 5 and 8 active platforms.
• 50% of social media users still keep their profiles open and public [6]. Viewable by anyone, including people who have never met them.
• The average user's email address appears in at least 2 known data breaches [1].
• The average digital footprint generates ~1.2 TB of data per person per year [7].

When you multiply a public profile by 6 platforms, plus a couple of email breaches, plus a username reused across a dozen forgotten services, plus a profile photo that matches a geolocated image, the question changes. The question is no longer "can I find this person?" The question is "which version of them should I find first?"

The mental model: people are networks, not profiles

Here is the shift that will make you dramatically better at this.

A person is not a single LinkedIn profile. A person is a network of identifiers, a graph of loosely-connected nodes, where each node is one of the following:

• A real name (or several variants of one)
• A username (often reused)
• A phone number
• An email address
• A photo
• A geographic location
• An employer or school
• A writing style, voice, or topic interest
• A time zone (inferred from when they post)

The art of people-finding is walking this graph. You start at any one node, say, a username you found in a comment somewhere, and you follow edges to other nodes. The username leads to an Instagram account. The Instagram account has a bio with a city. The city narrows down the LinkedIn search. The LinkedIn profile confirms the company. The company tells you the email format. The email format lets you guess their work email. The work email appears in a data breach. The data breach reveals an old password and an old handle. And around you go.

The 4-Phase Framework in Chapter 3 is built around walking this graph. Each phase is a different kind of edge.

The obvious question: "Should I be worried about my own footprint?"

Yes.

The most useful exercise in this entire playbook is to run the same framework on yourself before you run it on anyone else. You'll see in real time what a stranger could assemble about you in 30 minutes. The privacy guides on the internet will start to feel less like theory and more like overdue homework.

I built a self-audit chapter near the end (Chapter 10) specifically for this. Run it. The reactions I get from people who've done this for the first time range from "oh, that's actually fixable" to "I need to burn this email address and start over." Both reactions are useful.