I Requested My Data from 100 Companies. Some Deleted It Instead.
Challenges in data access requests under California's privacy law revealed
1California Privacy Law and Data Access Rights
The California Consumer Privacy Act (CCPA), enacted in 2020, grants consumers rights to access personal data, request deletion, and opt-out of data sales. A journalist investigating corporate data collection practices filed access requests with over 100 companies. While McDonald's provided a detailed 515-page report, others mishandled the requests, highlighting systemic issues in CCPA compliance processes across industries.
2Problems in Data Access Requests
Despite clear access requests, Crunchbase mistakenly deleted the journalist's account, later calling it a 'processing error.' BeenVerified misinterpreted an access request as deletion, removing data from search results. These cases expose significant gaps in corporate CCPA compliance. Consumer advocates condemn such errors as unacceptable, demonstrating weaknesses in policy frameworks relying on corporate good faith.
3Mishandled Requests by Companies
BeenVerified wrongly processed an access request as deletion, then claimed inability to verify identity - despite having previously confirmed personal details. A UC Irvine researcher reported similar misclassifications when dealing with 500+ data brokers. While some companies corrected mistakes, many left requests unresolved. These patterns reveal widespread misunderstanding of CCPA requirements among corporate compliance teams.
4Training Gaps and System Failures
BeenVerified management admitted annual privacy training for support staff, yet acknowledged this agent misunderstood the request type. Crunchbase blamed its error on human staff rather than AI systems. These incidents demonstrate both human and systemic failures in CCPA compliance processes. With only 29% of data brokers fully CCPA-compliant, significant improvements in training and systems are urgently needed.
5Consumer Advocates Respond
Ben Winters of Consumer Federation of America called such errors 'crazy' and unacceptable, highlighting weaknesses in policy frameworks relying on corporate good faith. Researchers point to studies showing just 29% of data brokers fully comply with CCPA. Advocates demand stronger enforcement and clearer guidelines to ensure effective exercise of data access rights by California consumers.
6Journalist's Investigative Experience
The journalist spent considerable time filing 100+ access requests, navigating varied submission methods and repeated identity verification. Most frustrating were companies that sent deletion confirmations despite explicit instructions otherwise, or refused to process requests through approved channels. McDonald's emerged as a positive example, providing a comprehensive 515-page data report.
7AI Use and Journalism Ethics
The journalist disclosed using generative AI to draft bureaucratic emails and update tracking spreadsheets, while writing the article's core content manually. This transparency about AI use in investigative journalism highlights evolving ethical considerations. The disclosure aligns with WIRED's policies on responsible AI use in reporting processes.
8Future of Data Privacy Rights
This investigation reveals critical gaps in privacy law enforcement, with only 29% of companies estimated as fully CCPA-compliant. Advocates call for stronger penalties and clearer guidelines. Effective implementation of data access rights requires both improved corporate training and system upgrades. As privacy concerns grow, this case underscores the need for more robust consumer protection mechanisms.