What a job search hands over
A CV lists where you've worked, for how long, where you studied and, often, where you live. A recruiter may ask for a photo of your passport or driving licence by email before the first call, and the call may be recorded. An interview platform may record your face, your voice and the room behind you while you answer questions against a countdown, and software may score the recording. A timed test logs your answers and how long each one took. Along the way you give your salary, your notice period, why you want to leave, and the name of the employer you're trying to leave.
More and more, you also prove who you are. Since February 2026 Greenhouse, whose software runs the careers pages of many employers, has offered identity checks run by CLEAR. You take a selfie and photograph a government ID; the selfie and the ID stay with CLEAR, and the employer gets a pass or a fail. Greenhouse says it has run more than 10.2 million fraud checks and flagged one candidate in four for review. CodeSignal, which runs coding tests, records video, audio and screen activity for the whole test and matches your photo ID to the face on camera. LinkedIn now shows recruiters who use its AI hiring tools whether a candidate is verified.
The FBI's alert of 13 October 2026, about North Korean IT workers getting hired under stolen identities, suggests employers ask for multiple forms of identification or live verification. The same alert warns that aggressive checks carry "unusually high risks of generating false positives that could harm legitimate employees and filter out qualified applicants." We wrote about where a selfie and an ID go after a check in You proved you were real. Where did the proof go?
Why it's hard to say no
People hand all this over when they can least afford to refuse. In September 2026, 1.9 million Americans had been out of work for 27 weeks or more, 27.1 percent of everyone unemployed. UK vacancies fell to 702,000, the lowest outside the pandemic since 2014. A Workday witness told a federal court that its recruiting software handled more than 356 million applications in 2024 and 27 million job offers. In September a 65-year-old IT program director told CNBC he had sent more than 600 applications since January. In the same piece, Tammy Wright, who has nystagmus, an involuntary movement of the eyes, said the AI interview software kept telling her to look straight ahead. "It was just demoralizing that I couldn't be treated like a human being," she said.
The Dutch data protection authority's guidance to employers says: "Applicants are in a dependent position in relation to you, which means they may experience pressure to give consent." Turning down a recorded or AI interview often means leaving the process, and many people aren't told what they're agreeing to. In a 2026 survey of 1,200 US job seekers by Greenhouse, which sells hiring software, 70 percent said they were never clearly told an AI would be evaluating them, and half of those who finished an AI interview never heard back.
Where it goes
Back to the employer you're trying to leave
On job seekers' advice forums, people describe recruiters sending their CV to the employer they're trying to leave, sometimes with the name taken off, which hides little when they're the only person there with that job title. A retired HR professional wrote that early in their career they regularly received recruiters' CVs of their own staff.
In Britain, the rules for recruitment agencies forbid this. An agency "shall not disclose information relating to a work-seeker to any current employer of that work-seeker without that work-seeker's prior consent," say the Conduct of Employment Agencies and Employment Businesses Regulations 2003, and it may not put anyone forward for a job without confirming they're willing to take it.
Into pools for jobs you never applied for
An application often outlasts the job. When the UK Information Commissioner's Office audited AI recruitment tools in 2024, it found some had kept candidates' data indefinitely to build large databases of potential candidates without their knowledge. One provider told candidates their profile would be kept for a year, then started the year again every time the profile was updated, so most of its database was kept indefinitely. France's regulator, the CNIL, says a pool of candidates built from a fake job advert can't be legitimate, and that a pool shouldn't be kept more than two years from the last contact. The Dutch authority says a rejected applicant's data should usually be deleted within four weeks, or a year with their consent.
Some listings may not be jobs at all. In July 2026 Texas opened an investigation into LinkedIn over listings shown to paying subscribers for jobs that may not exist, saying LinkedIn "does not independently verify the hiring status of most listings." The US Congressional Research Service says there are no official statistics on how many there are.
Hiring software is also starting to keep one profile of you for many employers. Mercor, which recruits experts through recorded AI interviews to train AI models for AI companies, is one; we set out what it says it keeps from a single interview, and what happened when it was breached, in a case study. On 13 October 2026 Workday announced a Candidate Profile that job seekers keep with Workday and reuse across employers, from early 2027.
Sold
Some of the file is for sale. Equifax's The Work Number holds the pay and job records that employers and payroll companies send it: about 209 million active and 813 million total records at the end of 2025, from more than four million organisations. Equifax sells access to "lenders, employers/background screeners and government agencies," and generally charges employers nothing to add their staff's records. Mortgage lenders suing Equifax over its prices allege that it pays some of those employers a share of its Work Number profits; the claims are undecided and the case is on appeal.
When CareerBuilder and Monster went bankrupt in 2025, a privacy ombudsman was appointed to review what would happen to users' data in the sale, and the job boards went to BOLD, which owns CV-writing services.
Used to train AI
The ICO's audit found that "the majority of AI providers had repurposed candidate personal information in their system to train, test, and maintain their AI tool," often after taking the names off. The ICO's view is that de-identified data is still covered by UK data protection law. LinkedIn has trained its AI on members' data, including CVs and answers to screening questions saved for future applications, on by default since 3 November 2025 in the UK, the EU and other places, and switching it off "does not affect training that has already taken place." Class actions filed against Mercor in April 2026 allege that it used recorded interviews to train AI models; Mercor disputes the claims.
We wrote about why taking the names off a copy no longer protects the person in it in De-identified does not mean what it used to.
Leaked
In June 2025 two security researchers logged into the system McDonald's used for job applications, run by Paradox, with a test account whose username and password were both 123456. By counting through ID numbers they could reach up to 64 million applications, with names, phone numbers, addresses and chats with the hiring bot. Paradox said only the researchers viewed records and closed the account the same day.
In January 2026 the CNIL fined France Travail, France's public employment service, 5 million euros. Attackers had taken over advisers' accounts in 2024 and reached the data of everyone registered in the previous 20 years, social security numbers included. At DISA Global Solutions, which runs background checks and drug tests for employers, intruders were inside the network for more than two months, and the company notified 3.3 million people, among them job candidates of its customers.
Mercor confirmed in March 2026 that an attacker had got into its systems through a compromised open-source tool, and in June it told the people affected that their personal information had been downloaded. One of the class actions quotes press reports that the stolen data included interview recordings, passport and driving licence scans and facial biometric data. A California recruiting firm, Cornerstone Staffing Solutions, was broken into in November 2025 and told people in September 2026; it couldn't tell which files were taken, so it wrote to everyone whose data was there.
Judged by software
Derek Mobley, a Black man over 40, applied for more than 100 jobs at employers that used Workday's software and was rejected almost every time, often within hours. His lawsuit alleges that Workday's AI screening discriminated by race, age and disability. In March 2026 the court let the age claim go ahead, and in September the plaintiffs asked for a class covering applicants screened by its tools. The claims are undecided. Researchers who studied one assessment company's data across 156 employers found some applicants were recommended for rejection by every employer they applied to, more often than chance explains.
In a 2021 test by MIT Technology Review, a reporter answered an AI interview in German, and one tool rated her English 6 out of 9. A UK graduate who asked banks for his data after two years of applications found that one had never watched his video interview, though he'd scored highly on its tests. In the EU, using AI to read candidates' emotions has been banned since February 2025.
Collected by fake jobs and fake recruiters
Some job ads exist to collect documents and money. Americans told the FBI they lost $362.9 million to employment scams in 2025, up from $70.2 million in 2023. The FTC's advice is that real employers won't contact you by an unexpected text, WhatsApp or Telegram message about a job, and that anyone asking you to pay to get a job is running a scam.
The cost of asking
A formal request to a company you've applied to can affect an application you have open with them, or one you make later. It shouldn't, and nobody should have to choose between their data and the job, but that's the reality. That imbalance of power is why this kind of profiling goes on: saying no is hard when it can cost you the job, and that's where you're most exposed.
You expect to be assessed by the people you met. Your interview and its recording going somewhere else, to people you don't know, profiled and shared who knows where, feels like a betrayal of trust, and we have strong reservations about it.
You can keep the cost down by choosing when to ask. A question before an interview costs almost nothing. While an application is open, limit what they do with your file rather than ask them to delete it. Once the job is decided, or once they've stopped replying, ask for a copy and then for deletion.
What to ask, and when
Before you hand anything over
Before a recorded or AI interview, send one short email: is it recorded, will software assess it, who will see the recording, and how long will they keep it. In Illinois an employer needs your written consent before AI analyses a video interview, and must delete it within 30 days of your asking.
Tell every recruiter in writing that your CV goes to no employer without your agreement each time, and never to your current employer. Before you send a copy of your ID, check that the company exists and is hiring.
In the US, you can see who has pulled your Work Number file in the past two years and freeze it for free. A freeze can slow a loan, a job or a benefits check while it's on.
While an application is open
Limit what they do with it. Ask them to keep your application only for the roles you applied for, not to share it with other employers or clients, not to use your recording, answers or scores to train or improve their tools, and to tell you how long they'll keep what's left. Interview platforms usually send requests back to the employer, so write to the employer and ask them to pass it on.
When it's over, or when they never replied
Ask for a copy of what they hold: the recording, the transcript, the scores and the notes. The CNIL says a candidate who asks for test results is owed the results and what's needed to interpret them. Then ask them to delete it, and to pass the deletion on to the interview platform and anyone else who got a copy. A request like this has a legal deadline even if your application never got an answer: a month in the UK and the EU, 45 days under California law.
Some of it will stay. California employers must keep application records, including automated-decision data, for four years, and US federal law requires a year. Their written answer is still worth having. If your CV or your interview turns up somewhere later, you'll have what they told you, in their own words, about what they held and what they did with it.
We keep that record for you. You add each company you've applied to, the recruiters and interview platforms included, and we work out what they likely hold and write the request, ready to send. You send it from your own inbox, their reply lands in yours, and we keep the list and the dates. Start your record →
