I asked 100 companies for my data. Some deleted it instead.
A journalist’s attempt to obtain personal data from more than 100 companies under California’s privacy law exposed a confusing and often obstructive process. Although the California Consumer Privacy Act gives consumers the right to access data held about them, some firms appeared to mistake access requests for deletion requests or failed to honour the contact methods listed in their own privacy policies, raising concerns about enforcement and corporate compliance.
McDonald’s provided a 515-page report detailing app activity and predictions about the journalist’s future custom, illustrating the breadth of data companies can hold. By contrast, Crunchbase permanently deleted the journalist’s account despite an explicit instruction not to erase anything, later calling it a processing error; BeenVerified also responded to an access request with a message about removing information. Companies may take up to 45 days to complete requests, while the author found filing and verifying them highly time-consuming.
- Privacy access requests can be mishandled as deletion requests.
- McDonald’s supplied a detailed 515-page personal-data report.
- Advocates say the failures expose weak privacy-law enforcement.
New here? Start with this
California’s Consumer Privacy Act gives people the right to ask businesses what personal information they hold about them. The law applies to many companies that collect information through services such as apps and websites, and businesses have set procedures for handling these requests.
The information can include activity records and estimates about a person’s interests or future behaviour. Companies such as McDonald’s, Crunchbase and BeenVerified illustrate how responses can differ, while the process may involve proving identity and waiting up to 45 days.
How businesses handle requests matters because people need to know what information is held about them and be able to use the rights the law provides. The reported problems raise questions about how consistently companies follow those procedures.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Companies can hold extensive personal information, so access rights need to be practical and reliably honoured; clear disclosure lets people understand how their data is used and identify mistakes. The reported mix-ups and burdensome verification process support calls for stronger compliance and enforcement, especially when an access request is wrongly treated as consent to delete data.
The case against
Privacy requests can involve sensitive information, and companies have a legitimate duty to verify identity, prevent unauthorised disclosure and process requests securely. The reported errors are concerning, but may reflect mistakes in handling complex workflows rather than deliberate obstruction; firms also need workable time and procedures to meet requests accurately at scale.