I Asked 100 Companies for My Data. I Got Deletion Notices Instead
California residents have a legal right to access the data that companies collect about them. Actually exercising that right is a burdensome nightmare.
In a recent experiment, a reporter requested personal data from 100 companies under the California Consumer Privacy Act (CCPA). The CCPA grants consumers the right to access, delete, and request a copy of their personal information from large companies that collect it. The researcher focused on the data access aspect to better understand what data is being collected.
Most companies have methods for filing access requests, such as web forms, phone numbers, or email addresses listed in their privacy policies. Upon submission, companies have 45 days to complete the request.
The reporter's experience was time-consuming and filled with complications. Many companies responded with deletion notices instead of providing the requested data. Ben Winters, director of AI and privacy at the Consumer Federation of America, expressed concern over the lack of responsibility from companies. "That's crazy," Winters stated, "that's not an acceptable status quo."
The reporter faced issues with various companies. For example, Crunchbase deleted the reporter's account upon receiving the access request and later clarified that only their user account was deleted, not other data. BeenVerified, a searchable database, removed the reporter's person report and phone number/email address from their search results, claiming they were removed within 24 hours.
When the reporter explained that they had submitted an access request, not a deletion request, BeenVerified denied the claim and said they couldn't verify the reporter's identity.
Consumer advocates were disappointed with how these requests were handled, seeing it as a weakness in policy frameworks that rely on companies to act responsibly. The researcher, who had placed access requests with over 500 data brokers, also encountered multiple misclassifications. Despite receiving annual privacy training, some support agents still misunderstood the request type. The researcher's company, Cash App, has yet to be addressed in this report.
Written by urgent.news from Wired's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
