The Indeed Illusion: Tracing Where a Resume Actually Goes After It Leaves Your Hands

The first thing you do when you need a job is tell the internet everything about yourself. Your name. Your address. Every company you have ever worked for, every skill you have ever built, every degree you sweated through. You type it all into a resume and you hit upload, and you feel like you are doing something right. You are being proactive. You are putting yourself out there.

What you probably did not realize is that “out there” may mean considerably further than you imagined.

Indeed.com is, by almost any measure, the dominant force in online job searching. The platform draws more than 350 million unique visitors each month and hosts what it calls over 245 million sourceable profiles on its employer-facing Smart Sourcing product. It is the first stop for most people who need work, and it has been for over a decade. And inside that enormous machine, your resume is not simply a document you submitted to a company you wanted to work for. It is a data asset. It travels. It gets indexed, analyzed, scored by algorithms, shared with advertisers, made available to employers you never applied to, and in the worst cases, scraped wholesale by fraudsters who turn job searching into a pipeline for identity theft.

This is an investigation into where your resume goes. Not where you think it goes.

The Resume as a Business Model

Understanding what Indeed does with your data starts with understanding what Indeed actually is. It began in 2004 as a job aggregator, a search engine that crawled the web for listings and organized them in one place. Simple. Clean. Free for job seekers. That last part has never changed. What changed is how the company monetizes the tens of millions of users that freebie attracts.

Indeed¹ is owned by Recruit Holdings, the Japanese staffing conglomerate that acquired it in 2012. Recruit does not publish disaggregated revenue figures for Indeed specifically, but industry analysts consistently place its annual revenue in the several billion dollar range, driven almost entirely by employer-side products. Employers pay to post jobs at enhanced visibility. They pay for data products. And crucially, they pay to search the resume database.

Indeed launched its resume search product in September 2011, initially in beta and free, before rolling it out as a paid subscription the following year. In a 2011 press release, the company announced the service would give employers and recruiters “instant access to millions of qualified candidates.” There was no fanfare about consent. The announcement focused almost entirely on employer benefits: instant search, saved searches, daily email alerts whenever new resumes matching specific criteria appeared in the database.

The product has evolved since then into what is now called Indeed Smart Sourcing². The company markets it as a way to “search resumes and get a list of candidates whose qualifications, requirements, and preferences match the job criteria you’re looking for.”

According to Indeed’s³ own employer-facing materials, Smart Sourcing gives paying companies access to the full pool of 245 million sourceable profiles. That is not 245 million job applications. That is 245 million human beings who have uploaded their professional histories to Indeed, many of whom never consented to being searchable by companies they have never heard of.

“When your profile is set so that employers can find you on our site, you authorize Indeed to share the contents of your profile, including your resume, name and any other personal data that you may include in it, publicly on the site.” — Indeed Privacy FAQ

This is where things get thorny. Indeed’s own privacy documentation acknowledges the scope plainly. Setting a profile to “Employers Can Find You” means that “search engines and other third parties can copy it and make it publicly available elsewhere.” Then comes the line that should stop anyone cold: “Indeed does not control these third parties.”

In other words: the moment you flip that toggle, Indeed washes its hands of whatever happens to your data next.

Default Settings and the Consent Problem

The architecture of consent on Indeed is worth examining carefully, because the way default settings work has a profound effect on how many people end up in the searchable database without fully understanding it.

According to Indeed’s Privacy FAQ⁴, when a user first creates a profile, the platform recommends the “Employers can find you” option. The documentation describes the default state this way: “The default option recommended when you first see the prompt is ‘Employers can find you,’ but until you make a selection, your profile remains in the unspecified state.” It then says that once a user chooses to opt in or out, “this choice is final” and they cannot return to the unspecified state.

What this means practically: if you created an Indeed account years ago and uploaded your resume without paying careful attention to a settings prompt, there is a reasonable chance your profile is sitting in a searchable database that any company with a subscription can browse through. Not companies you applied to. Not companies you have ever heard of. Any company.

People have noticed. Scroll through Reddit’s r/recruitinghell or r/jobs, and you will find threads going back years from users who discovered their resumes floating around in ways they did not authorize. One recurring complaint involves receiving unsolicited recruiter outreach for jobs in cities they never searched for, industries they are not in, or roles wildly below their experience level. The volume and specificity of these contacts suggests algorithmic sourcing, not coincidence.

A Hacker News⁵ thread from May 2024, linking to one such Reddit discussion, drew a telling comment from a user called burningChrome. After applying to a couple of roles on Indeed for the first time, they described receiving up to a dozen emails a day from recruiters in India, many at “sketchy” companies that barely existed online. “Those two interactions alone confirmed that Indeed most likely had sold my information to either scammers or extremely sketchy recruiting companies who were making money selling their own lists to other recruiting companies,” the commenter wrote.

“To this day, I’m still deleting and blocking these companies, YEARS after deleting my account on Indeed.”

A separate Hacker News commenter named “junto” added context:

“There are a number of services that provide recruiter tools for scraping potential candidate contact data into their CRMs. So if you ever share your details with a recruiter on LinkedIn, and they scrape it, then other recruiters who also use these services now also have access to your number. I was puzzled how recruiters were getting my number. I’d only shared it with a few recruiters two years previously.”

These accounts are anecdotal. But the pattern they describe is consistent with how Indeed’s own platform is designed to work, and with what its terms of service openly permit.

What the Terms Actually Say

Few people read terms of service. That is not cynicism; it is simply an observable fact of digital life. The documents are long, written in legal language, and surrounded by prompts designed to rush you past them. But what Indeed’s terms say, once you sit with them, is worth understanding.

Indeed’s⁶ US Privacy rights page addresses the question of whether it sells your data with notable candor. Under the California Consumer Privacy Act, “selling” personal data is defined broadly to include sharing data with third parties for “monetary or other valuable consideration.”

The page states:

“Indeed shares your personal data with third parties for a variety of reasons, including helping people find more relevant jobs, help employers find relevant candidates and optimizing advertising. These third parties include employers, affiliates and/or marketers.”

Advertising. The word sits there quietly. Indeed shares your job search behavior, your application history, your engagement patterns, with advertising partners. Your job search activity does not stay on Indeed. It influences the ads you see across the internet. If you are employed and quietly looking for a new position, your search behavior on Indeed can signal your employment situation to marketers on entirely different platforms.

A 2026 attorney-reviewed analysis from ToS Watchdog⁷ gave Indeed a consumer fairness score of 48 out of 100, graded D. The analysis flagged the advertising data sharing explicitly, noting that “your job search behavior influences the ads you see across the internet, potentially revealing your employment status to other platforms.” It also noted that Indeed’s data retention practices mean the platform keeps your information for years after you stop using the service, and that even after account deletion, some data may be retained for “legitimate business purposes.”

The consent mechanism for opting out of this advertising data sharing exists, but it is not prominent. You can change your privacy settings or call Indeed’s CCPA request line. The process is not impossible, but it requires you to know the problem exists before you can address it. Most people do not.

“The ‘make resume public’ feature should be used carefully, especially if you’re employed and job searching confidentially.” — ToS Watchdog analysis, 2026

The Glassdoor Merger and the Consolidation of Profiles

Indeed’s data footprint expanded significantly with its relationship with Glassdoor, the review site that Recruit Holdings acquired separately. The two platforms have been progressively integrated, creating what amounts to a unified job seeker identity that crosses both sites.

Glassdoor’s⁸ own help documentation confirms that users can opt to have their resumes discoverable through Indeed’s Resume Search and Instant Match features. This means that your Glassdoor profile, which may include company reviews you wrote, salary information you shared, and interview experience notes, sits in the same ecosystem as your Indeed resume. The data points reinforce each other, building a more complete picture of you as a worker than either platform alone could construct.

Recruit Holdings’ HR Tech Privacy Center, which governs data sharing between affiliated brands, explains the mechanics: the Indeed⁹ family of companies shares data across its affiliated platforms to provide core products and services. The notice is transparent, in the sense that it appears in official documentation. It is not transparent in the sense that most users have any intuitive sense of what “affiliated companies” means in practice, or that their Glassdoor salary disclosure is connected to their Indeed application history.

AI and the New Appetite for Resume Data

Then there is the question of artificial intelligence. Indeed has been explicit about its use of AI across its platform. Its AI and Automated Employment Decision Tools FAQ describes a range of applications: job recommendations generated by analyzing seeker profiles, candidate summaries generated by AI for recruiter review, AI-powered matching that predicts which job seekers an employer might want to contact. It also acknowledges that resume data feeds these models. “We use your personal data, including profile information and activity data to find suitable candidates for internal roles,” the recruitment privacy policy states.

This matters because training machine learning models on personal data raises questions that existing privacy law was not designed to answer cleanly. When your resume is used to train a matching algorithm, you have not simply shared your data with an employer. Your data has become a structural component of a commercial AI product. You do not own any stake in that product. You were never asked whether you consented to your career history being used this way. The question of whether that constitutes a form of data exploitation is one that regulators are only beginning to grapple with.

Indeed’s Hiring Lab research arm has acknowledged using resume data for analytical purposes as well. In its data FAQ, the Hiring Lab notes that it uses “information from resumes that job seekers have uploaded to Indeed’s resume database” for research, adding pointedly that this research is “not restricted to advertisers on Indeed.” The research is published publicly. Aggregated and anonymized, the company says. But the raw material that makes the research possible is the personal history of millions of individual job seekers.

The Fraud Pipeline: When Scrapers Get Your Resume

The risks that sit above the waterline of official policy are troubling enough. What lies below, in the gray and black markets that feed on job seeker data, is worse.

The Federal Trade Commission’s¹⁰ 2025 data report showed that consumers reported losing more than $12.5 billion to fraud in 2024, a 25 percent increase over the prior year. Within that figure, job and employment agency scams were one of the fastest-growing categories: reports tripled from 2020 to 2024, and losses jumped from $90 million to $501 million in that same period. The FBI received 20,044 employment scam reports in 2024 alone. These are not abstract statistics. Behind each one is a person who uploaded their resume in good faith and ended up worse off for it.

Fraudsters target job boards specifically because the data on offer is so rich. A resume contains your name, your address or at minimum your city, your email, your phone number, your employment history, and frequently your educational credentials. That is the foundation of a functional identity. With it, someone can open a credit card, file a fraudulent tax return, or impersonate you to other employers or even to your current payroll department to redirect your salary.

Indeed¹¹ prohibits scraping in its terms of service, and its technical infrastructure fights automated access through robots.txt directives that block bots from key areas of the site. But prohibition and prevention are not the same thing. Sophisticated scraping operations use residential proxy networks, human-mimicking browsing patterns, and rotating identities to circumvent these defenses. The legal landscape around scraping publicly available data, following the HiQ v. LinkedIn ruling in the US, is genuinely murky in ways that make enforcement inconsistent.

What is more, not all resume exposure comes through technical exploits. Some of it happens through legitimate channels that job seekers do not fully understand. When you apply for a job posted by a third-party employer on Indeed using Indeed Apply, your profile data, including your resume, is transmitted to that employer. That employer may use an applicant tracking system operated by a separate company. That ATS company has its own privacy policy and its own data practices. Your data has now passed through at least three entities, each with their own terms, and the trail is essentially invisible to you.

Indeed’s own API documentation acknowledges the complexity. It instructs integration partners that “job seeker applications and data remain completely separate and cannot be pooled, commingled or shared across your clients, systems, or platforms.” This is a rule handed to third parties. Whether every third party follows it is a different question entirely. Indeed acknowledges it cannot guarantee what employers do with your data once they receive it.

“Profiles set so that employers can’t find you are only made available to those to whom the job seeker has submitted an application or provided their resume. When you apply to jobs or share your Profile with Employers, your Profile might be copied and published even if it is set to ‘Employers Can’t Find You’.” — Indeed Privacy FAQ

The Scale of the Exposure and the Regulatory Gap

It is worth pausing on the numbers to let them land properly.

Indeed has 245 million sourceable profiles available through Smart Sourcing. That is more people than the entire adult population of the United States. The platform says it connects employers and job seekers 65,000 times per day. Eighty-two percent of online US job seekers use the platform, according to Comscore data cited by Indeed itself. This is not a niche product serving a corner of the labor market. This is the infrastructure that most employed Americans have used at some point in their careers.

At that scale, the privacy implications are not theoretical. They are systemic. A vulnerability in Indeed’s systems, or a sufficiently motivated malicious actor among its paying employer subscribers, or a lax third-party ATS partner, would not expose thousands of records. It would expose millions.

Precedent for this kind of breach exists elsewhere in the job market. Researchers investigating what they called “ResumeLooters” documented a breach of job portals in Asia that accessed millions of private profiles, as reported in 2024 threat intelligence analyses. The operation used SQL injection and XSS attacks against vulnerable job sites to harvest candidate data at scale. The playbook is established. The targets are obvious. The potential for catastrophic exposure on a platform the size of Indeed is not hypothetical.

Here is the honest problem: the law has not caught up with what job boards actually do with data, and it may not catch up quickly.

The CCPA in California gives residents the right to know what personal data is collected, to request deletion, and to opt out of the sale of their data. Indeed has built compliance mechanisms for all of these. But compliance is not the same as privacy protection. A company can be fully CCPA-compliant and still operate a data business that most of its users would find troubling if they understood it clearly.

The GDPR in Europe imposes stronger protections, including requirements around lawful bases for processing personal data and data minimization principles. Indeed, operating globally, maintains GDPR compliance frameworks and relies on standard contractual clauses for international data transfers. European users have, at least on paper, more robust rights than American ones. But enforcement of GDPR against large US tech platforms has been inconsistent, and the regulator bandwidth to pursue every potential violation is limited.

What does not yet exist, in any jurisdiction I am aware of, is a legal framework specifically designed for the job board context: a set of rules that accounts for the particular vulnerability of someone who needs work, who cannot reasonably refuse to participate in the dominant platforms of their labor market, and who has no meaningful alternative to sharing sensitive personal data with a commercial company in order to access economic opportunity. The consent model that undergirds most privacy law assumes that the person consenting has genuine choice. When you need a job and Indeed controls 82 percent of the online job seeker market, the extent to which your consent is freely given is a philosophical question worth asking.

In official documentation and public communications, Indeed presents itself as a responsible steward of job seeker data. The company points to technical security measures, including blocking over 80 million malicious login attempts in the second half of 2020 alone, a bug bounty program that pays researchers to surface vulnerabilities, and regular removal of fraudulent accounts and job postings.

It also points to privacy controls that give users meaningful options. Job seekers can set their profiles to unsearchable. They can request deletion of their data. They can opt out of data sharing with non-affiliate advertising partners. The company runs a dedicated Privacy FAQ, a US privacy rights page, and a separate HR Tech Privacy Center.

These things are real. Indeed has invested in user-facing privacy infrastructure. The question is not whether that infrastructure exists. The question is whether it is sufficient, and whether the default settings and business incentives of the platform are aligned with job seeker interests or with employer-customer interests.

Indeed did not respond to a request for comment on this article.

The Job Seeker’s Dilemma

I have used Indeed. Most people in the workforce have. You open it the way you open Google, because it is the first thing that comes to mind and because it has everything in one place. And there is genuine value there. The platform has helped countless people find work. That is not in dispute.

But I found myself, while reporting this piece, thinking about a particular kind of person: the one who is employed right now, quietly unhappy, who uploads a resume on a Sunday evening hoping to see what is out there. They probably did not read the terms. They probably clicked through the default settings. And now their professional history is sitting in a database that their current employer’s recruiter could, in theory, find with a subscription and a search.

This is not a paranoid scenario. It is exactly what the “Employers Can Find You” feature is designed to enable. The ToS Watchdog¹² analysis put it plainly: “The ‘make resume public’ feature should be used carefully, especially if you’re employed and job searching confidentially.” It recommended that users delete their account after finding employment if they want to minimize data retention. That is the privacy advice available to job seekers on the world’s largest job board: use it and then delete yourself from it.

The harm from fraud is more concrete. The FTC data is unambiguous. Job and employment agency scams cost Americans $501 million in 2024. They cost consumers their credit scores, their identities, their savings in some cases. And the fertile ground for those scams is the rich, detailed personal data that job seekers deposit on platforms like Indeed every day, trusting that it will be handled with care.

Protecting Yourself: What Actually Works

Given the current regulatory and commercial reality, the burden of protection falls largely on individual job seekers. That is unsatisfying but it is true. Here is what makes a practical difference.

Set your profile to “Employers Can’t Find You” unless you have a specific reason to be discoverable. Apply directly to jobs you identify rather than making yourself passively searchable. When you apply, your data goes to that employer regardless of your visibility setting, but at least you retain more control over who can browse your history.

Use a dedicated email address for job searching that is not connected to your personal or financial accounts. This limits the damage if that email ends up in a data broker’s list or a fraudster’s harvested database. Never include your home address on an Indeed profile; your general location is sufficient for most job searches.

Be skeptical of recruiter outreach you did not expect, particularly if it comes from companies with thin online footprints, arrives via unusual channels like WhatsApp or Telegram, or asks quickly for documentation like copies of your ID or Social Security number. Those requests have no place in a legitimate recruiting process before a job offer is made.

And when a job search is over, delete the account. Not just the profile. The account. Submit a formal data deletion request under CCPA if you are in the United States. There is a phone line for exactly this purpose: 800-616-6535. Use it.

There is a structural issue here that protective measures for individuals cannot solve. When a platform becomes so dominant that opting out of it is effectively opting out of the job market, the conventional privacy framework, built on individual consent and individual choice, does not function as designed.

The information asymmetry is real and significant. Indeed has detailed knowledge of what it does with your data. You have terms of service that almost no one reads, privacy settings that require navigating to find, and a vague awareness that something happens to your resume after you click submit. That gap between what the company knows and what you know is where the exploitation lives, even when the exploitation is technically legal.

What would change this? Regulatory requirements for plain-language disclosure at the point of upload, not buried in a FAQ. Default settings that protect privacy rather than maximize data collection. Explicit opt-in consent before resume data is made available to any third party, not just broad authorization buried in terms. Audit rights that let job seekers see exactly who has accessed their profile and when.

None of these are radical ideas. They are the kind of baseline protections that exist in other data-sensitive sectors. The job market, and the personal data that flows through it, deserves the same.

Until that day arrives, the best advice I can offer is also the most uncomfortable: assume the resume you upload is going somewhere you did not intend. Because based on everything the terms say, and based on everything the people who have been on the receiving end of what follows have reported, that assumption is very likely correct.

Sources

1. Indeed.com, www.indeed.com/news/releases/indeed-announces-acquisition-by-recruit-co-ltd. Accessed 20 Oct. 2026. ↩︎
2. Indeed, Indeed.com, www.indeed.com/employers/smart-sourcing. Accessed 4 May 2026. ↩︎
3. “Find Employees” Indeed for Employers, www.indeed.com/hire/find-employees. Accessed 20 Oct. 2026. ↩︎
4. “FAQ: Indeed’s Approach to Privacy” www.indeed.com/legal/privacyfaq. Accessed 14 May 2026. ↩︎
5. “Can confirm Indeed is selling user information” Hacker News, news.ycombinator.com/item?id=40539575. Accessed 20 Oct. 2026. ↩︎
6. “Your U.S. Privacy Rights” www.indeed.com/legal/ccpa-dns. Accessed 8 Aug. 2026. ↩︎
7. “Indeed ToS Review 2026 | Fairness Score 48/100 (Grade D)” ToS Watchdog, terms.law/ToS-Watchdog/job-platforms/indeed/. Accessed 20 Oct. 2026. ↩︎
8. Glassdoor, help.glassdoor.com/s/article/Candidate-Sourcing-for-Employers?language=en_US. Accessed 20 Oct. 2026. ↩︎
9. “FAQ: Indeed’s Approach to Privacy” Indeed.com, www.indeed.com/legal/privacyfaq. Accessed 20 Oct. 2026. ↩︎
10. 12 Mar. 2024, www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024. Accessed 20 Oct. 2026. ↩︎
11. “Terms of Service” www.indeed.com/legal. Accessed 20 Oct. 2026. ↩︎
12. “Indeed ToS Review 2026 | Fairness Score 48/100 (Grade D)” ToS Watchdog, terms.law/ToS-Watchdog/job-platforms/indeed/. Accessed 20 Oct. 2026. ↩︎