A journalist’s attempt to obtain personal data from more than 100 companies under California’s privacy law exposed a confusing and often obstructive process. Although the California Consumer Privacy Act gives consumers the right to access data held about them, some firms appeared to mistake access requests for deletion requests or failed to honour the contact methods listed in their own privacy policies, raising concerns about enforcement and corporate compliance.

McDonald’s provided a 515-page report detailing app activity and predictions about the journalist’s future custom, illustrating the breadth of data companies can hold. By contrast, Crunchbase permanently deleted the journalist’s account despite an explicit instruction not to erase anything, later calling it a processing error; BeenVerified also responded to an access request with a message about removing information. Companies may take up to 45 days to complete requests, while the author found filing and verifying them highly time-consuming.