The Scale of What’s Being Shared
Most of what’s documented here comes from the Incogni 2026 report and a 2024 academic study — both of which found that the overwhelming majority of job and freelance platforms share or sell user data with third parties, often in ways users don’t expect. The Incogni audit, which evaluated nine major platforms against 17 privacy criteria, found that 90% of job search and networking platforms sell user data including resume contents, cover letters, and uploaded applicant documents to third-party businesses. The 2024 academic study examining 16 job-search websites found that 87.5% leaked user activity to third parties, with Google and Meta appearing as the most common recipients on 12 of the 16 sites studied.
Private-sector job sites shared personal information with an average of 5.3 third-party services per platform; one site transmitted user data to nine separate outside companies. The 2025 study of 16 gig-work platforms found that 15 shared personally identifiable information with unrelated third parties, with 14 sharing users’ full names and 12 sharing email addresses. Two platforms shared reversible hashes of Social Security numbers with verification services, creating additional exposure points.
The researcher Pam Dixon of the World Privacy Forum warned as far back as 2006 that job seekers face “considerable risk of having their confidential information improperly sold, shared or used for profiling purposes” — a warning that remains relevant nearly two decades later.
Why This Hits WFH Workers Differently
For someone working from home, the line between personal and professional identity is already thin. Your home address might appear on invoices, your personal phone number might be the one you give clients, and your primary email is likely the account you use for everything from contract negotiations to password resets. When a freelance platform shares that data with data brokers or advertising networks, it’s not just your work persona that’s exposed — it’s your actual life.
Traditional employees have an IT department, a corporate VPN, and an HR team handling data protection. Freelancers and remote workers are their own security team, and the platforms they rely on for work often have revenue models that depend on extensive data sharing — not on protecting the people who use them.
The Incogni companion survey of 1,000 job platform users found that more than one-third believed platforms only shared their data with prospective employers. Nearly half admitted to skimming privacy policies rather than reading them, and 40% never delete profiles they create on job platforms. One-quarter could not recall which platforms still held their data. These aren’t careless people — they’re busy professionals who assume a job site is doing what a job site should do.
The Data Broker Pipeline — and What It Means for Your Resume
When you upload a resume to a platform, the data doesn’t sit still. Resumes and cover letters containing home addresses, employment histories, educational credentials, salary expectations, and sometimes immigration status are shared with third-party services as a condition of using the platform. Many platforms claim they do not “sell” user data while simultaneously allowing hundreds of outside entities access to detailed user profiles through broad consent agreements — a distinction that matters for regulatory classifications but does little to change how the practice functions in reality.
All investigated platforms except LinkedIn had privacy policies written at a college-graduate reading level per the Dale-Chall readability formula. The average policy required 35 minutes to read in full. When the document explaining your data rights is deliberately hard to understand, that’s a design choice.
Data brokers scrape public business registrations, domain WHOIS records, professional profiles, and social media to build detailed profiles that link your home address, phone number, and real name to your professional identity. The FTC’s 2014 report on data brokers — still the most comprehensive federal document on this topic — emphasized the industry’s opacity and the difficulty consumers face in understanding or controlling how their data is used. The data broker market is projected to reach $250 billion, with an estimated 1,500+ data points collected per person.
What the Better-Rated Platforms Actually Do
Not every platform treats user data the same way. The Incogni audit ranked Snagajob, FlexJobs, and Glassdoor as stronger performers for user privacy protections. Snagajob led the group with top marks for user data collection handling and strong tracking category performance, and researchers found no major transgressions associated with Snagajob such as lawsuits, regulatory actions, or data breaches. FlexJobs ranked favorably in additional considerations evaluating privacy factors beyond core data collection and tracking. Glassdoor was recognized for a relatively accessible privacy policy and user-friendly privacy resources, though it still sells user data and shares with advertising partners.
The most privacy-invasive platforms according to the audit were ZipRecruiter, Monster, and LinkedIn — penalties largely driven by the Transgressions category covering regulatory fines, lawsuits, and data breaches. LinkedIn was fined 310 million euros ($335 million) by the EU’s lead privacy regulator in late 2024 for targeted advertising practices. In April 2026, two separate class action complaints were filed against Microsoft for allegedly illegally scanning users’ browsers to determine installed extensions, described by a German LinkedIn user advocacy group as “one of the largest corporate espionage and data breach scandals in digital history.”
What This Means for Small Businesses and Freelancers
Large enterprises working with LinkedIn Talent Solutions or Indeed’s managed services can negotiate data-processing agreements, audit rights, and deletion requirements. Small businesses using standard self-service accounts have no such leverage. A small company posting ten jobs annually with 50 applications per opening collects approximately 500 detailed personal records yearly — and based on the Incogni findings, much of that information is likely shared with multiple third-party services as a condition of using the platform. The Identity Theft Resource Center reports that notification and response expenses average several hundred dollars per compromised record.
A Realistic Privacy Setup for the Independent Worker
You don’t need to become a privacy expert to reduce your exposure. The steps that make the biggest difference are straightforward and most freelancers can implement them in an afternoon.
Separate Your Work Identity
Create a dedicated email address for all freelance platforms and client communications. Use Google Voice for a free secondary phone number that forwards to your personal phone, or consider a paid service like OpenPhone for professional features like voicemail transcription and business hours. Never list your personal phone number on invoices, contracts, or public profiles.
Get a Business Address
A P.O. Box costs around $15–30 per month at USPS. Virtual mailbox services like iPostal1 or Traveling Mailbox provide a real street address for $10–20 per month and can forward mail to you. Use this address on invoices, contracts, and business registrations — never your home address.
Use an EIN Instead of Your SSN
Get an Employer Identification Number from the IRS — it’s free and takes minutes. Use this EIN on W-9 forms instead of your Social Security number. Send W-9 forms through encrypted methods, not regular email.
Lock Down Platform Settings
Review privacy settings on every platform you use. Uber: Settings > Privacy to control data sharing. DoorDash: Account section for privacy preferences. Upwork: Privacy Settings under profile to manage visibility. Turn off optional data sharing, marketing communications, and data sales features wherever available.
Use a VPN on Public Networks
When working from coffee shops, coworking spaces, or any public Wi-Fi, a VPN encrypts your internet traffic and prevents interception. ExpressVPN is a reliable option that works across devices.
Enable Two-Factor Authentication Everywhere
Turn on 2FA for every account — especially email, freelance platforms, banking, and cloud storage. Use an authenticator app like Authy or Google Authenticator rather than SMS when possible, since SMS codes can be intercepted via SIM swap attacks.
We’ve covered similar ground in our guide to remote work security, and the same principles apply: separate accounts, encrypted devices, and regular cleanup of old profiles.
What’s Coming Next (and What’s Not)
European regulators have expanded enforcement actions against companies using personal data for advertising, profiling, or other purposes beyond the original service context. The EU Platform Work Directive, which must be implemented by member states by December 2, 2026, mandates algorithm transparency and stronger data protections for platform workers, including the right to contest automated decisions affecting earnings or account status.
In the United States, no federal law specifically addresses gig worker data privacy. Comprehensive state privacy laws in California, Virginia, Colorado, Tennessee, and others give residents the right to access, delete, and opt out of the sale of personal data — rights that apply to data collected by gig platforms operating in those states. Multiple state attorneys general have launched investigations into data broker practices that resemble the sharing models used by many employment platforms.
The FTC’s ongoing commercial surveillance and data security rulemaking could significantly reshape how employment-related data is collected, shared, and sold. But for now, the burden remains on the individual worker to understand what they’re trading and to take practical steps to limit exposure.
The platforms aren’t going to stop collecting data — that’s their business model. But you can decide how much of your professional life stays in their ecosystem. A separate email, a virtual mailbox, a VPN on public Wi-Fi, and a regular habit of deleting old profiles won’t make you invisible. They will, however, make it meaningfully harder for your work history to become someone else’s product.