A Request to See the Data Ended in Its Deletion: How Companies Ignore the Privacy Law

California's Consumer Privacy Act (CCPA), which took effect in 2020, grants residents of the state three key rights: to opt out of the sale of their personal data, to demand its deletion, and to request a copy of the information collected about them. The author of the piece focused on the last of these — the right to access — and over the course of a week filed more than a hundred such requests to find out exactly what businesses know about him.

McDonald's provided a telling response: the chain sent back a 515-page report with a detailed history of his interactions in the app and a prediction that the customer would “never stop eating here.”

Asked to See — Got Deleted

From there the absurd stories began. In each request the author deliberately noted: “I am not requesting deletion. Do not treat this as a deletion request.” Even so, the service Crunchbase replied with a chipper email: “Your account has been permanently deleted. If you need anything else, let us know!” When he followed up, the company clarified that only the user account had been wiped while the rest of the data remained, and that to return he would have to sign up again. In a comment, Crunchbase called it a “technical error” by an employee rather than the work of AI.

BeenVerified, a database that trades in public records, behaved similarly: it said it had removed his data from search, then — having already denied him identification — declared that it could not verify the applicant's identity, even though it had located his information minutes earlier. The final flourish was an email saying an “opt-out request has been processed.” The parent company later admitted that an agent had “misunderstood the type of request” and promised additional training and an audit.

Block's Cash App refused in a different way: although its privacy policy explicitly names the phone as a way to submit a request, operators repeatedly sent the caller off to reread that very policy and call back later, effectively blocking the request.

A System That Relies on Good Faith

Consumer-protection experts call this state of affairs unacceptable. According to representatives of the Consumer Federation of America and the Electronic Privacy Information Center, what is happening exposes the weakness of an approach that relies entirely on companies' good faith, and how few resources businesses devote to complying with the law. Elina van Kempen, a graduate student at UC Irvine who has previously filed requests with more than 500 data brokers, confirms it: an automated reply along the lines of “we'll delete you” instead of the actual data is a common occurrence.

As a more sensible alternative, specialists propose the principle of “data minimization”: companies should collect only what is genuinely needed to operate, rather than saddling a person with a bureaucratic quest just for the chance to see what is known about them.

In keeping with his outlet's rules, the author disclosed that he used generative AI to draft the boilerplate letters and to maintain a spreadsheet, but wrote the article's text itself by hand.

Source: Ars Technica