I asked 100 companies for my data. Some deleted it instead.

Summary

Testing 100 companies revealed that data privacy requests often resulted in confusion, deletion of data instead of access, or outright refusal, highlighting systemic issues with CCPA compliance.

Key Takeaways

1. Filing over 100 data access requests under the California Consumer Privacy Act (CCPA) revealed significant challenges, with companies frequently mishandling requests by deleting data instead of providing access.
2. Companies often responded to access requests with messages concerning the deletion of information, which the author explicitly stated not to do, or refused to process the request through a method listed in their privacy policy.
3. Consumer advocates and academic researchers expressed concern over these practices, suggesting they indicate weaknesses in privacy frameworks and potentially insufficient resources dedicated by companies to compliance.

Statement Breakdown

• Claimed Facts: 50% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 20% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on personal anecdotes and expert opinions to support its claims. While the author's experience is detailed, the lack of broader statistical data or independent verification of all company responses limits its objective credibility. The use of AI for drafting emails is disclosed.

Bias assessment: Consumer Advocate Framing. The article consistently frames companies' actions as problematic and highlights consumer struggles. Expert opinions are selectively used to reinforce a narrative of corporate non-compliance and the inadequacy of current privacy laws, emphasizing the consumer's perspective.

Note: This article uses personal experiences and expert commentary to illustrate challenges with data privacy requests. Consider it a qualitative account rather than a comprehensive statistical analysis.

Credibility flag: Anecdotal, Expert Support

Claimed Facts (8)

• This states a legal right granted by a specific act, presented as a factual basis for the author's actions.
• This provides factual information about the CCPA's effective date and key provisions.
• This states a specific timeframe allowed by the CCPA for companies to respond to requests.
• This is a direct disclosure of a method used in the reporting process.
• This is a direct statement about the author's primary writing method for the article's content.
• This reports a statement made by a company spokesperson regarding an error and their intended action.
• This reports a claim made by a company representative about their internal training procedures.
• This is a direct quote from a company spokesperson explaining their system's functionality.

Opinions (6)

• This is a subjective statement about the author's personal experience and feelings regarding the process.
• This expresses the author's frustration and judgment about specific company actions.
• This is an interpretation of the observed examples by an expert, reflecting a subjective viewpoint on policy effectiveness.
• This statement reflects a subjective outcome and lack of resolution from the researcher's perspective.
• This summarizes a general sentiment or questioning from experts, indicating a subjective doubt about corporate compliance efforts.
• This presents a subjective view on the benefits and nature of data minimization as a policy approach.

Claims (7)

• The prediction about the author's future eating habits is unsubstantiated and likely a hyperbolic or AI-generated element within the report, making it dubious.
• This response, given in reply to an access request and explicitly stating not to delete, is a dubious outcome that contradicts the user's stated intent and the law.
• This explanation is dubious because it implies a selective deletion that still failed to meet the user's explicit request for access, not deletion.
• This response from BeenVerified, in reply to an access request, is dubious as it describes deletion actions when access was requested.
• While presented as a claim, the attribution of the error solely to a human agent without further evidence, especially in the context of AI use, can be seen as a potentially dubious deflection.
• This response is dubious because it again refers to an opt-out/removal when the user explicitly requested data access, indicating a continued misinterpretation or deliberate misdirection.
• This is a hyperbolic and subjective description of the customer service interaction, lacking concrete evidence of the agent's understanding or intent.

Key Sources

• WIRED — Media Outlet
• Ben Winters — Director of AI and Privacy, Consumer Federation of America
• Crunchbase support representative — Customer Support
• Crunchbase spokesperson — Company Spokesperson
• BeenVerified support representative — Customer Support
• Elina van Kempen — PhD student, UC Irvine and coauthor of Consumer Beware! Exploring Data Brokers’ CCPA Compliance
• Greg Hammond — Senior Counsel and Senior Director of Compliance, BeenVerified parent company
• Cash App spokesperson — Company Spokesperson
• Mayu Tobin-Miyaji — Law Fellow, Electronic Privacy Information Center