I Asked 100 Companies for My Data. I Got Deletion Notices Instead | WIRED

Overview

I Asked 100 Companies for My Data. I Got Deletion Notices Instead

I filed a request with Mc Donald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there.

Details

Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data. So I was curious what others might have on me, and I spent the next week filing more than 100 requests.

The CCPA went into effect in 2020, and three of its key provisions are the right to opt out of the selling of personal information, the right to delete that info, and the right to request a copy for yourself.

Consumer advocates I spoke with were upset with how these requests were handled. “That's crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America. “That's not an acceptable status quo.” Winters sees these examples as exhibiting the weaknesses of policy frameworks that rely on companies to act responsibly and in good faith.

In accordance with WIRED’s policies, I am disclosing that I used generative AI to draft bureaucratic emails and update my tracking spreadsheet as part of this report. I wrote the body of this article mainly by hand in my scratch notebook.

One of the first errors came from Crunchbase, known for its database about tech startups. I emailed my access request to its privacy address on August 17. My message laid out the rights I wanted to exercise and included a direct request not to erase anything: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” I received a reply two days later from a Crunchbase support representative.

“Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!” the message read in full.

I followed up via email almost immediately, reiterating that I wanted data access, not data deletion. “Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted,” read the follow-up support response explaining what happened. If I wanted to have a Crunchbase account, I would have to reregister.

When I reached out to Crunchbase for comment, a spokesperson blamed the mistake on a “processing error” and said that the company would proceed with my original access request as filed. The spokesperson also claimed the misclassified response came from “a person on our customer success team” and not a generative AI tool.

My interactions with Been Verified, a searchable database that gathers public records, also encapsulate my friction-filled experience placing these access requests.

I emailed Been Verified’s dedicated CCPA compliance address on the morning of August 19. It laid out that I was a California resident placing an access request, not a deletion request. You’ll never guess what happened next.

Two days later, I received a message from a Been Verified support representative about removing information. “It appears your person report has already been removed from our Person Search results,” read its initial response. “In addition, we have removed the requested phone number and email address from our search results. This change should be reflected within 24 hours.” Not at all what I asked it to do.

When I sent my next email explaining that I had submitted an access request, not a deletion request, the support representative followed up 15 minutes later, denying my claim and saying the company couldn’t verify my identity. That was perplexing, since it located some of my details earlier in the message thread and didn’t even attempt to explain what I might need to share for verification.

At my wit's end, I sent another email explaining how confused I was feeling by these responses. “Please be assured that we're able to process your opt-out request and have removed your information from our website,” read the support representative's response. If I wasn’t already bald, I would have pulled out the rest of my hair at that moment.

I found solace in chatting with an academic researcher who had previously helped place access requests with over 500 data brokers under the same California law and also encountered multiple misclassifications. “Sometimes I would make an access request, and the automatic answer was ‘We will opt you out’ or ‘We will delete your data,’” says Elina van Kempen, a Ph D student at UC Irvine and coauthor of Consumer Beware! Exploring Data Brokers' CCPA Compliance. While some data brokers followed up with corrections, other times the researcher was left without any resolution.

Consumer Beware! Exploring Data Brokers' CCPA Compliance

When I reached out to Been Verified for comment, Greg Hammond, senior counsel and senior director of compliance at its parent company, claimed via email that support agents receive annual privacy training, including how to process CCPA requests. “Unfortunately, despite the training, the agent who handled this matter was mistaken and misunderstood the request type,” he wrote. Hammond says the company now plans to provide refresher training on correct processing and to audit recent work.

“OK, sure, I'll call this number right back,” I said before I hung up, a bit of anger bubbling up in my voice despite my best efforts to remain professional. My interactions with the next customer support agent were similarly burdensome. After being put on hold, I was asked to call back later, so the support team would have more time to review their resources and understand how to handle my call.

“Customers can access or delete their personal information directly through Cash App, which allows us to more quickly verify identity before providing access to financial account information or deleting an account,” a Cash App spokesperson wrote over email when I reached out for comment. “Our phone support teams are trained to help customers understand how to submit these requests, and we also provide customers with instructions they can access through our online Help Center."

Experts I spoke with questioned whether companies are putting in enough effort to be legally compliant. “It shows how potentially little resources the companies are putting toward compliance and making sure that people can have access to their data,” says Mayu Tobin-Miyaji, a law fellow at the Electronic Privacy Information Center.

Both Winters and Tobin-Miyaji mentioned a beefed-up approach to “data minimization” as a potential better path forward for consumers. This would essentially mean companies can collect only the data they need to process standard business operations. For example, saving your credit card information in the app for future purchases might be allowed, but collecting personal demographic information to sell to brokers might be blocked.

Data minimization is a more holistic approach that shifts the burden away from consumers, who are currently forced to navigate a bureaucratic obstacle course just to see what companies know about them. Instead, by limiting what companies can collect about you in the first place, consumers can have more peace of mind without going through the headache-inducing process I endured.

In your inbox: WIRED's most ambitious, future-defining stories

AT&T Top Deals: Wireless, Internet, Bundles and More!

Take Up to 25% Off Custom Prints with Vista Print Promo Code

Squarespace Promo Code: 20% Off Annual Acuity Subscriptions

Key Takeaways

I Asked 100 Companies for My Data
I filed a request with Mc Donald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there
Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data
The CCPA went into effect in 2020, and three of its key provisions are the right to opt out of the selling of personal information, the right to delete that info, and the right to request a copy for yourself
Consumer advocates I spoke with were upset with how these requests were handled