My aunt has collected a pile of family history going way back. She asked me to help her get it in a form which we can share via the internet. I wrote a Silverlight app which works fine and is restricted to invited persons only.

One thing that I am concerned with is privacy. I just published all the info I received - birth date, middle names etc. Since then I wondered if that is a reasonable thing to do.

Should I hide certain info for living people? I know it's family but some members don't like having their details on the internet even when it is password-protected.

Is there any relevant legislation?

7 Answers 7


A quick, short and "dirty" answer is:

1) If the person is alive, just name and birth date, just mm/yyyy or even yyyy

2) If the person is recently deceased, everything but SSN, Drivers Licenses, Phone numbers or anything that could be actively in use by a living family member

3) If the person is deceased for a generation or two all the information you have

  • Remember the more information you post the more likely others will find it useful. Also the more likely those people can help you fill in missing information.

  • No matter if a person is deceased or not, never post anything you wouldn't want your worst enemy to get ahold of.

  • 7
    If the person is still alive, I'd restrict further to just birth YEAR as full date of birth is (too frequently for my liking) used as personal identification data by lots of organisations.
    – Andrew
    Commented Oct 10, 2012 at 12:19
  • 1
    Year without day, seems good, because of Phishing/Identity theft.
    – Warren P
    Commented Oct 10, 2012 at 22:03

The answer will be different depending on the country your webserver is in. It may also vary by the country of residence of you or a person mentioned, and by the country the site is being accessed from. So, in short, there are no easy answers!

The European Union, Canada, and Mexico (among others) have privacy laws that protect the personal information (such as birth date) of living people - the US is way behind the rest of the world for this.

The general rule in most countries is simply don't publish information that would identify a living person without their permission (there may be fines for ignoring this). Some countries require that permission to be given in advance in writing, in a specific form.

Even storing (rather than publishing) personal information requires registration as a "data controller" in some countries, but there's normally an exemption for "personal" use (when storing, not for publishing).

Password protecting helps, but just look at the "private" photos on sites like Ancestry to see what happens - somebody shares their "private" data with a relative, and that relative then publishes it online without any privacy at all.

Even with a passworded site, you're releasing the data to a group of people who may not have the slightest clue they should keep it private.

Personally I would not publish any information on a living person that would identify them - so maybe "private" and a birth year, to show somebody exists, but nothing more.

  • 2
    Anything relating to a "person" is "personal", but not necessarily "private". Every country has phonebooks, tax lists, and thousands of google "people" sites that can identify one person from another. Your name, birth, marriage, death, real estate, and other registrations are public record. Medical, financial, and credit records are private. If you have a police record, then your height and weight are public record, too :) Commented Nov 10, 2012 at 0:05
  • @RustyErpenbeck: This really just emphasizes what I was saying: it varies by country (and region). For example, real estate transactions are not public record in some countries (nor are police records), yet in other countries income tax records of everybody are published (and featured in newspapers). Even within one country like the US the availability of recent birth and marriage records varies widely. It's not possible to generalize what is public, and what is not, and what expectations of privacy are, from the current practices of one locality.
    – Rob Hoare
    Commented Nov 22, 2012 at 3:44

I do not believe in publishing all your data to your website.

I think you want to publish only summary information about the ancestral lines you're searching, the family names and places they come from. And list a few of the roadblocks you've encountered that you're trying to find.

The goal is to get someone to enter the family name they are researching in Google and for your website to come up in the search results. They'll go to your website and be able to evaluate if they think they might be related. If so, they'll contact you and you'll be able to cooperatively share data and learn from each other like two family researchers should.

You want to get possible relatives to contact you. You don't want them to find your data, take your data, and never be heard from again.

I've used this strategy on my personal web site. Over 15 years, I've had about 300 contacts from various people. About 50 of those turned out to be relations (many I didn't know of before) and 20 had done extensive research on their sides who I started sharing with.


Well, even if something is password protected, it's never going to be secure. First, there are hackers; that's the obvious threat. But the other issue is that many nontechnical people tend to use the same, dictionary-based password in many places, including email and banking websites.

In addition to that, some of this information in the family history could very well be the answer to someone's secret password reset question on one of these sites, and someone looking to capitalize on your relatives' bank accounts could conceivably use this information to their advantage.

There are laws about how businesses must treat certain sensitive data. For instance, an ecommerce retailer could be liable for storing credit card information that somehow gets into the wrong hands; however, this may not apply to you since you're not operating a business. That's not to say you couldn't be sued for negligence. I'd really advise speaking to an attorney about legal aspects, since none of us here are really qualified to give legal advice. ;)

At least with the SAAS (software as a service) providers, you know there are more people involved in maintaining the system than just you, but even then there's no guarantee that those developers are taking security of your data seriously.

The most secure data on computers is on those which are not connected to the Internet, so if this is really something that you're concerned about, you may want to consider using something that's not online.

  • 1
    I think you make a great distinction here. A lot of genealogy services allow the upload of GEDCOM files and give the option to anonymize living people by default. Furthermore, software that generates a GEDCOM file gives the option to anonymize living persons directly so that data never makes it into any upload. So your point here is that even if the details are anonymous, but still loaded in the file, it could be hacked, but most genealogists looking for this answer are probably only considering "what may I outright display publicly, intentionally", but fail to consider data breaches. Commented Aug 7, 2021 at 18:28
  • 1
    @RyanMortensen Things have changed a lot too since I originally posted this answer, due to regulations such as the GDPR. In Europe, businesses can be liable in terms of millions of dollars if they don't take responsibility for data security.
    – jmort253
    Commented Aug 17, 2021 at 4:33

In addition to everything already said here, I'd like to share my personal bad experience on this matter. After collecting some family information, I have carefully chosen a place to publish it on the web (SSL, password protected and editor invite-only). Other family members liked and supported it, until a cousin of my grandfather saw it. For some reason, in his part of the family sharing this kind of information was considered dangerous (historic reasons, some bad experience in the ex-USSR). As the result, though, because of this, I had very little information about him, he did not like even being mentioned in this form.

Basically, any information, which is connectible to living people, can be useful for 3rd parties. Therefore I would consider it safe to publish information about deceased people (still, password protected without invited people having the rights to share it), but otherwise be very careful and better talk to your family members, to get their OK.


My preference is to err on the side of maintaining privacy and security for living individuals. I therefore only show their places (gender and birth year only, no names, no other data at all) in the family tree; this includes individuals born within the last 100 years whom I do not know to be dead.

In addition, I do not publish any details at all -- not even their existence -- for individuals born from 1930 onwards. In my case, 1930 is a date chosen to exclude completely from publication all of my generation and the generations following, whether they are living or dead, but to allow me to publish information about my (deceased) parents. If I came from a longer-lived family, I would push the year chosen as the cut-off further back.

For individuals who are deceased and who were born before 1930, I publish all the data I have available, if it came from publicly accessible sources or (for information that came from private sources, such as family oral history) if I have explicit permission to publish it. And I would not censor any information I have discovered, even if I was asked to do so.

The only living individuals who I mention on my website are other researchers who I am thanking by name (again, if I have their explicit permission to mention them).

I don't password protect the data I do publish, as I want people to find it and because (as I've said) it's all publicly available or published by permission.

I should add that I'm in the UK.

  • 1
    Agree with all of this... with the rider adopt a 100-year rule
    – Andrew
    Commented Oct 10, 2012 at 13:08

In the UK, the Data Protection Act applies to information stored on living people. Those who process such data are obliged to register as a data controller with the ICO. I think it would be unethical to publish information without the individual's consent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.