Where ThatsThem and Nuwber Actually Get Their Data
One question decides how much any line on either site is worth: who created this record, and can anyone still be asked for it? Nuwber answers that question publicly, in its own words, and we quote them below. ThatsThem’s server returned an automated security block to every request we made, so we describe what we read and refuse to guess at the rest. Both outcomes teach the same lesson about reading a profile.
The one-question version
Every field on an aggregator profile has exactly one birthplace, and there are only four candidates: a record an institution created because something happened, a form the subject filled in themselves, a file handed over by another company, and a value the site worked out for itself. Which of the four it is decides whether the line can ever be checked. A recorded deed can be pulled again at the county that recorded it, with an instrument number and a date on it. A field that arrived through a supplier has no office standing behind it and nowhere to go back to, however confident the typeface. Nuwber publishes its own two-part account of where its data comes from, and this page quotes it word for word rather than characterizing it. ThatsThem could not be read at all from a scripted request, so nothing here is asserted about what that company collects.
Watch: reading a profile backwards to its source
A short walkthrough of the one question that sorts a useful field from a decorative one.
Where the data starts
Four places a line on a profile can be born
Origin is a different question from accuracy and from age. It asks whether anybody, anywhere, still holds the original.
Start with the tier that behaves. An institution created a record because an event occurred. A deed is recorded when property changes hands; a case is indexed when somebody files; a license exists because a board issued one. Nobody consulted the subject about being listed, and that is precisely why the entry is useful — a third party with a job to do created it, wrote a date on it, and works in an office whose function is to keep it. The office is the whole point. A field born here can be walked back: name the index, name the instrument, name the day. What qualifies as a public record in the first place is covered in our guide to how public records work and what they contain; here we care only about what the tier implies once a field is already on the screen in front of you.
The second tier is anything the subject typed into a form themselves. A warranty card. A shipping address at checkout. A rewards-program sign-up. A finance application at a dealership. These are transaction artifacts, and their peculiarity is that the person is the author. That cuts both ways. It can be fresher than any government record, because someone updates a delivery address the week they move while a deed only changes when they buy or sell. It can also be casually wrong in ways an official filing never is: a temporary address, a parent’s house, a work address given to keep post away from home, a deliberate throwaway. Nobody checked it, because nothing depended on it being true.
The third tier is a field that arrived from another company. Readers underestimate this one badly. When a supplier hands over an entry that began life at a county recorder, the recorder is the ultimate source but not the proximate one — and what falls out in the handoff is exactly the machinery that made the record checkable. The instrument number goes. The recording date becomes an ingestion date or vanishes. The index that would let you find it again was never part of the payload. You are left holding an assertion stripped of its apparatus, which is a different object from the record it descends from.
The fourth tier is not a source at all: values the site computed. Possible relatives, likely associates, an age range, a confidence label. These are outputs of a matching process running over the first three tiers. They can be entirely correct and they are still not evidence, because there is no custodian to appeal to — asking where a possible relative came from returns you to the algorithm, not to a document. Treat the fourth tier as a lead worth testing, never as a fact worth acting on.
What Nuwber says about its own sources
The company answers the question directly on its own help site. It repays close reading, because the two buckets it names do not behave alike.
Asked where it got a person’s information, Nuwber’s help center names two. The first, quoted verbatim: “Publicly Available Information Sources including phone directories, the internet, social network profiles and any other source available to the public. This information may include addresses, street names, cities, states and ZIP codes.” The second, also verbatim: “Third-Party Data Suppliers who may find publicly available information from a variety of sources such as phone directories, government public records, and businesses a consumer may have interacted with (i.e. car dealers or real estate agencies).” Those are the company’s words about its own sourcing, quoted as its statement rather than adopted as verified fact — no outsider can audit anybody’s supply chain, and this page will not pretend to have done so.
Read structurally, the two buckets sit in different tiers. The first describes collecting directly from things anyone can see, which at least leaves the origin nameable even when it is thin. The second is the relayed tier, and the phrase that matters inside it is the company’s own: businesses a consumer may have interacted with. A car dealership and an estate agency are not records offices. Whatever reaches a file by that route started as something a person wrote on a form during a transaction — second-tier data arriving third-tier, with two removes between the profile and the hand that wrote it.
Nuwber’s homepage separately publishes what it believes it can show, and that list is a useful exercise in tier-sorting. In the company’s own order: full names and aliases, date of birth, phone numbers, email addresses, address history, property history, business details, professional licenses, financial records, criminal records, judgments, liens and bankruptcies. Property history, professional licenses, judgments, liens and bankruptcies are custodial by nature — each has an office that created it and can be asked again. Contact points are not. The company’s own first bucket names phone directories and social network profiles, and a directory is a compilation rather than something an office made and keeps — so those entries reached the file by one of the other three routes and carry the weight of that route, not of the inventory they are listed in. Why a particular number is missing from a particular site is a separate question and is not the one asked here.
One label on that inventory deserves a second look. “Financial records” covers two very different things. A judgment, a lien, a bankruptcy and a recorded mortgage are financial facts that exist as public filings, made by clerks, indexed, and available to anyone who asks the right office. An account balance, an account number and a transaction history are not, and the next section explains why federal law treats the two groups so differently. We make no claim about which sense is intended; the label is the company’s and we did not find it defined anywhere we could read. The same homepage also publishes scale figures — 301 million people, 118 million addresses, 340 million phone numbers, 305 million email addresses, 442 million social profiles and 28 million businesses — which are claims about coverage rather than about origin, and answer a different question from the one asked here.
For a reader whose interest is their own file rather than somebody else’s, the same help center states that the company “offers the ability for consumers to opt out through an easy process”, and our separate walkthrough of auditing your own data-broker footprint covers the mechanics across the whole industry. That is a different task from this one and we will not duplicate it here.
What we could not read at ThatsThem — and will not guess
An honest page about where data comes from has to include the part where the door was shut.
We approached ThatsThem the way we approach every source: an ordinary request, certificate verification left switched on, no browser automation and no attempt to route around anything. Every path we asked for returned the same short response carrying an HTTP 403 status — the homepage, the privacy policy and the opt-out page alike. Its complete text: “Security Check. JavaScript Required. Please enable JavaScript to continue. Checking your browser. This is an automated security check. Please wait while we verify your request.”
That is a fact about our request and it is nothing more than that. Bot filtering is entirely ordinary, it is not evidence of anything at all, and a site that serves human visitors perfectly well may still decline a scripted client — a rule this firm applies to government hosts too, where a 403 is never counted as a broken link. So we make no statement whatsoever about what ThatsThem collects, from whom, under what agreements, or how any of it is licensed. We did not read it, therefore we do not say it. A hedge laid over an unread source is a citation somebody invented, and there is no version of that we are willing to publish about a company we have named.
What survives the closed door is the part that was never company-specific in the first place. The four tiers are properties of the category rather than of any one operator: they describe how consumer data comes to exist in the United States, which is why the same reasoning works on a site nobody has heard of. If a profile displays a recorded instrument, an office holds it regardless of who is displaying it. If it displays an email address, no office ever held it, whoever is displaying it. You can grade a field without knowing a vendor’s supply chain, and that is the entire value of reasoning from origin. Whether the resulting entries are correct is a separate axis altogether, taken up in our study of how accurate online people-search sites really are — a field can be impeccably sourced and thoroughly out of date at the same time.
What each origin can carry, and where you go back to
Four rows for the four tiers, and the one this firm actually works in.
| Where the line came from | What it can honestly carry | How you get back to the original |
|---|---|---|
| A custodial record we pull ourselves | The event, the date it was recorded, and the office that recorded ittraceable | We name the index and the filing so you can pull it again yourself |
| A government record relayed by a supplier | The same event, minus the instrument number and the recording date | Re-pull it at the office; the supplier was never the source |
| Something the subject entered on a form | What was true at that counter, on that day, for that purpose | Only the person, or the business that took the form, can confirm it |
| A field bought in from another aggregator | That some other file said so, once | Nowhere. There is no original left to return to |
| A value the site computed | A match score, set in the typeface of a fact | No office holds it. Test it; never rely on it |
| The one question | Who holds the original? There are four possible answers — an office, the person, another company, or nobody — and only the first two can ever be confirmed. | |
The rows are not a ranking of truthfulness so much as a ranking of recoverability. A form-entered address can be the most current line on the page and still be unconfirmable by anyone but its author; a recorded deed can be twelve years stale and still be the most solid object in front of you. Most of what we do under skip tracing and public-records research is the work of moving a finding up this table — taking a line that arrived relayed or computed and either seating it on a custodial record or saying plainly that it could not be seated.
Federal law sorts data by where it came from too
The idea that origin decides what a record is, rather than its contents deciding, is not a framing we invented. It is written into the statutes.
The Gramm-Leach-Bliley Act defines the financial data it protects by derivation. Under 15 U.S.C. § 6809(4), “nonpublic personal information” means personally identifiable financial information “provided by a consumer to a financial institution”, “resulting from any transaction with the consumer or any service performed for the consumer”, or “otherwise obtained by the financial institution”. Subparagraph (B) then states that the term “does not include publicly available information”. And subparagraph (C) does the thing worth noticing: a grouping of consumers is covered if it “is derived using any nonpublic personal information”, and is not covered if it “is derived without using any nonpublic personal information”. Identical output, opposite legal status, and the only difference between them is where the inputs came from.
That is the statutory form of this page’s argument, and it carries a practical consequence for reading a profile. It is why a recorded lien, a docketed judgment and a bankruptcy filing turn up on consumer sites while a balance, an account number and a transaction history do not: the first group are filings anybody can request, the second are a bank’s information about its own customer. It is also why we never obtain the second group. Our asset work reads what has been recorded or filed, and nothing on this site is an offer to look inside an account.
The Driver’s Privacy Protection Act draws its line the same way but attaches the duty somewhere specific. Under 18 U.S.C. § 2721(a) it is “a State department of motor vehicles, and any officer, employee, or contractor thereof” that shall not knowingly disclose personal information obtained in connection with a motor vehicle record, except as the section goes on to permit. The obligation runs on the body holding the record and the people who handle it. That is why they got it from the DMV is usually the wrong inference to draw from a vehicle-flavoured field — and why Nuwber’s own supplier sentence, quoted earlier, is worth re-reading: it points at car dealers, and a dealership is a business a person transacted with, not a motor vehicle record.
The definitions section repays a look as well. 18 U.S.C. § 2725(3) defines “personal information” as information identifying an individual, “including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information”, and says expressly that it “does not include information on vehicular accidents, driving violations, and driver’s status”. The protected set is therefore narrower than most readers assume, in two directions at once. None of this is a list of what a people-search site may lawfully display — that inventory belongs to our separate page on the legal limits of these sites — it is a tool for the opposite job: ruling an origin out, so that you know the field must have arrived some other way and can grade it accordingly. For how the trade is structured overall and who buys from whom, see our overview of how the data broker industry collects and sells information.
Six fields, and where each one probably started
The tier test applied to the lines people actually ask us about.
The address only one site has
An address appearing on exactly one profile is usually either a custodial record the other site has not ingested, or a form-entered address from a single transaction. The tell is whether anything else on the page is tied to it — an instrument, a filing, a parcel. If nothing is, you are looking at one company’s copy of one form.
The identical number on both
Agreement between two aggregators is weaker than it looks, because it is so often the same upstream row read twice. Independent confirmation means a second record type, created by a different party for a different reason — not a second site rendering a purchased field in a different color.
The relative with another surname
Relative and associate blocks are fourth-tier almost by definition: computed from shared addresses and shared identifiers rather than from any document of relationship. A marriage license, a probate filing or a deed naming two grantees is a record. A possible relative is a match score wearing a label.
The employer from three jobs ago
Employment rarely enters through a custodial route at all, because no office records where you work. Where it appears it has usually descended from a form, a professional listing or a purchased marketing file, which is why it manages to be oddly specific and years out of date simultaneously.
The property line naming a county
Usually the best field on the page, because it points at its own custodian. A parcel identifier, an instrument number or a recording date tells you which office to ask, and what that office hands back is the record itself rather than somebody’s transcription of it.
The email nobody has opened since 2016
No public body registers an email address, so an email on a profile is self-supplied or commercially sourced by definition. Nothing in the chain has any mechanism for learning it was abandoned. Treat it as a lead about identity, never as a lead about location.
How we work a profile backwards to its origin
Four steps, run field by field rather than page by page.
Name the field, not the profile
We never accept or reject a page as a whole. Each line is sorted on its own, because a single profile routinely mixes a recorded deed with a purchased marketing row and prints them in the same font.
Ask which origins are even possible
Some fields have one plausible birthplace, some have four. Ruling origins out is usually faster than proving one in, and it is the step that reveals whether verification is available at all before anyone spends money on it.
Go to the custodian where one exists
If a field could have come from an office, we go to that office and read the record ourselves — index entry, instrument, filing date — instead of repeating what an aggregator displayed about it.
Report the tier alongside the answer
Every finding says what it rests on and how firm that footing is. A confirmed custodial record and an uncorroborated relayed field are both useful; they are not the same thing, and a report that blurs them is worse than no report.
The lines we hold on work like this
On a page about data sources these are not decoration. They are most of what separates this work from scraping.
People Locator Skip Tracing is a skip-tracing and public-records research firm — not licensed private investigators. We run no surveillance, we follow nobody, and we describe ourselves as investigators neither to a client nor to a records clerk. Every file opens with a written, stated permissible purpose before any research begins: serving process, enforcing a judgment, administering an estate, reuniting a family that wants reuniting, or a comparable lawful reason. And we obtain records as ourselves. We do not pretext. No calling a landlord, an employer, a utility or a relative in a false character to shake an address loose; no impersonating a subject to a company holding their file. Pretexting is not a technique held in reserve for hard cases — it is not in the kit.
For the same reason the previous section matters, we do not obtain the contents of anyone’s financial accounts. No balances, no account numbers, no transaction histories, no credentials. That material is a financial institution’s information about its customer, and it is not available to us by any route we would be willing to use.
We are not a consumer reporting agency, and nothing we produce is a consumer report. Our research must not be used as a factor in deciding whether to grant credit, hire or fire, underwrite insurance, issue a license or other government benefit, or rent a unit to somebody. Those are covered decisions under 15 U.S.C. § 1681b(a) of the Fair Credit Reporting Act, and they require a consumer reporting agency, carrying the notices, accuracy duties and dispute rights that come with that status. If that is the decision in front of you, engage a screening agency instead; we will say so and decline the work rather than take it.
We decline any assignment whose object is to reach a person who has taken steps not to be reachable. If you are afraid of the person you are trying to find, the people who can actually help are law enforcement and a domestic violence advocate, and a court can issue and enforce a protective order without your having to locate anybody yourself. A client’s account of a situation is not on its own sufficient reason for us to proceed. This page also deliberately contains no analysis of which of the four origins is hardest for a person to suppress, because that sentence would be a stalking manual in a research costume — it is precisely the paragraph we refuse to write. A reader worried about their own exposure should begin with our guide to seeing what people-search sites publish about you.
Everything above is general information and not legal advice. We read each cited provision in the United States Code and quoted it as it stands, but how any of it applies to your circumstances is a question for a lawyer admitted where you are. Nothing here creates a professional relationship or predicts what a court would decide.
Who needs to know where a field came from
The people for whom an untraceable line is not merely unsatisfying but unusable.
Service-of-process teams
An affidavit is only as sound as the address behind it. Whether that address sits on a recorded document changes which door you try first.
Collections and recovery
One relayed address shown by three vendors is one address, not three. Sorting origin is how you stop buying the same row repeatedly.
Probate and heir work
Heir searches run on records that name people for a reason. Computed relative blocks are exactly where heir searches go wrong.
Litigation paralegals
Naming a party puts an address into a pleading. A field you cannot trace to a custodian is a field you cannot defend when service is challenged.
Reporters and fact-checkers
Publishing a fact means being able to say where it came from. An aggregator field with no custodian behind it will not survive that question.
People reading their own file
Knowing which tier a line fell out of tells you who to ask to correct it, and whether there is anybody who can.
If you are not yet sure whether your question needs a quick lookup or a full trace, our comparison of skip tracing against people search sets out where each one stops.
A sourced finding, or a straight answer that it could not be sourced
Every address we hand back arrives with what it rests on: the record type, the office holding it, and the date printed on the document. Where all we could reach was a relayed or computed field, we say so in those words instead of dressing it up. Standard turnaround on a locate is within 24 hours. If a finding cannot be seated on something you could go and check for yourself, we tell you that plainly and you are not billed for a result we would not stand behind. That has been the standard since we began this work in 2004.
Questions about where the data starts
Where do ThatsThem and Nuwber actually get their data?
Nuwber names two sources on its own help site: publicly available information it gathers directly, and third-party data suppliers who draw on directories, government public records and businesses a consumer has dealt with. We quote that statement as the company’s own rather than as verified fact. ThatsThem returned an automated security block to every request we sent, so we make no claim at all about its sourcing.
Does a people-search site get addresses from the DMV?
That is usually the wrong inference. The Driver’s Privacy Protection Act places its duty on a state department of motor vehicles and its officers, employees and contractors, not on downstream publishers. Where something vehicle-flavoured appears on a profile, the likelier path runs through a transaction — Nuwber’s own supplier sentence names car dealers — and a dealership is a business somebody transacted with, not a motor vehicle record.
Why do two sites show the exact same phone number?
Frequently because it is one upstream row being displayed twice. Two aggregators agreeing is not two confirmations; if both bought the field from the same supplier, you have one piece of evidence rendered in two color schemes. Real corroboration means a second record type, created by a different party, for a different reason, at a knowable date.
What does it mean when a field has no source I can check?
It means the field can be a lead but never a conclusion. If no office holds the original, nobody can be asked to confirm or correct it, and any decision resting on it rests on an assertion. That is not the same as saying it is wrong — unverifiable and false are different things — but it does cap how much weight the line can carry.
Are possible relatives based on any actual record?
Usually not. Relative and associate blocks are typically computed from shared addresses and shared identifiers rather than read from any document of relationship. Records of relationship do exist — a marriage license, a probate filing, a deed naming two grantees — and they are custodial, dated and checkable. A computed relative is a match score presented in the same typeface as a fact.
Why can these sites show a lien but not a bank balance?
Because federal law sorts financial data by how it was derived. A lien, a judgment, a bankruptcy and a recorded mortgage are public filings that anybody can request from the office that made them. A balance, an account number or a transaction history is a financial institution’s information about its own customer, which sits on the other side of the Gramm-Leach-Bliley definition. We obtain the first kind and never the second.
Can you tell me what ThatsThem specifically collects?
No, and we will not guess. Every request we made to that site returned a 403 status with an automated security-check page, so we read nothing there. Bot filtering is ordinary and implies nothing about a company. Rather than dress an assumption up as research, we describe how the category is structured and say openly which door was closed to us.
How fast can you tell me where a field came from?
Standard turnaround on a locate is within 24 hours, and the origin question is answered in the same pass rather than as an extra. Send the profile you are looking at and the decision you have to make with it; you get back which lines can be seated on a custodial record, which cannot be, and what remains genuinely unknown.
Find out what a field is actually resting on
Send us the profile in front of you and the decision you have to make with it. You will get back which lines sit on a record somebody still holds, which ones do not, and what it would take to close the gap. Prefer to scope it first? Put the question to us before you order anything.
Start a sourced locate
