California's Data Access Law Yields Frustration and Deletion Notices, Not Information
A reporter filed more than 100 data access requests under the California Consumer Privacy Act, but many companies responded with deletion notices instead of providing the requested information. The process proved time-consuming and burdensome, requiring repeated identity verification and navigating inconsistent filing methods. Consumer advocates criticized the responses as an unacceptable status quo that exposes weaknesses in self-regulatory privacy frameworks.
The CCPA grants California residents three primary rights: opting out of data sales, requesting deletion, and obtaining copies of collected information. Companies must offer two filing methods and have 45 days to respond. While McDonald's complied thoroughly with a 515-page report, other firms misclassified access requests as deletion requests, forcing the reporter to repeatedly clarify his intent.
Crunchbase attributed its erroneous deletion to a "processing error" by a customer success team member, not an automated tool. The reporter relied on generative AI to draft bureaucratic emails and maintain a tracking spreadsheet. Consumer advocates, including Ben Winters of the Consumer Federation of America, viewed these failures as evidence that self-regulatory privacy frameworks are insufficient.
This experience could discourage California residents from exercising their legal privacy rights, as the burdensome process may outweigh perceived benefits. If companies routinely respond to access requests with deletion notices or complex verification hurdles, public trust in the CCPA's effectiveness may erode. This could prompt regulators to consider stronger enforcement mechanisms or clearer penalties for noncompliance. It may also influence how other states design future privacy legislation, potentially incorporating stricter