The California Consumer Privacy Act (CCPA) gives residents the legal right to request the personal information that large companies collect about them. To see how well that system works in practice, one reporter filed more than 100 data access requests over the course of a week, and the results exposed serious cracks in how businesses handle these obligations.
The experiment began with McDonald’s. A single request to the fast food chain produced a 515-page report a few days later, detailing app interactions in granular detail and even predicting the reporter would never stop eating there. That level of insight prompted a broader question: what were other companies storing?
The CCPA took effect in 2020. Among its central protections are the right to opt out of the sale of personal information, the right to delete that data, and the right to request a copy for yourself. This project focused only on access requests, the provision meant to reveal what information is actually being collected. Most companies are required to offer at least two ways to file, typically a web form, phone number, or email address.
Deletion Instead of Access
Filing the requests proved exhausting. The process involved tracking down the correct submission methods and verifying identity multiple times across dozens of companies. The most frustrating outcomes came from firms that either responded with messages about deleting information, which the reporter explicitly asked them not to do, or refused to process requests through a method they themselves had listed.
One early error involved Crunchbase, the database company known for tracking tech startups. An emailed access request sent on August 17 clearly stated: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” Two days later, a support representative replied that the account had been permanently deleted, adding, “Please let me know if you need anything else!”
A follow-up clarified that only the user account had been removed, while other data on the platform remained. Restoring access would require re-registering. When contacted for comment, a Crunchbase spokesperson attributed the mistake to a “processing error,” said the company would proceed with the original access request as filed, and stated that the misclassified response came from a member of the customer success team rather than a generative AI tool.
Advocates Question the Framework
Consumer advocates found the handling troubling. “That’s crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America. “That’s not an acceptable status quo.” Winters views these outcomes as evidence of the weaknesses in policy frameworks that depend on companies acting responsibly and in good faith.
For transparency, the reporter disclosed using generative AI to draft bureaucratic emails and update a tracking spreadsheet during the project, while writing the article itself largely by hand. Across the 100-plus requests, the pattern was consistent: a legal right that exists on paper often broke down at the point of enforcement, with at least one company deleting an account after being explicitly told not to.
Source
Image: arstechnica.com
