Reporter requested data from 100 companies — some deleted it instead

A Wired reporter tested how well companies comply with California's data privacy rules by filing access requests—not deletion requests—with more than 100 businesses under the California Consumer Privacy Act (CCPA). The 2020 law gives residents the right to see, delete, or opt out of the sale of their personal data; this experiment focused solely on the right to access.

The process proved unexpectedly difficult. McDonald's, for instance, returned a 515-page report detailing granular app usage. But several other companies did the opposite of what was asked. Crunchbase, a startup database company, replied two days after the request saying the reporter's account had been "permanently deleted," despite his email explicitly stating this was not a deletion request. Crunchbase later called it a "processing error."

A similar pattern occurred with BeenVerified, a public-records search service, which repeatedly misread the access request as a deletion or opt-out request, requiring multiple follow-up emails to sort out. Cash App, whose privacy policy lists a phone number as a valid way to file such requests, proved unable to actually process the request by phone—support staff seemed unfamiliar with the procedure and asked the reporter to call back later.

Consumer advocates, including Ben Winters of the Consumer Federation of America and Mayu Tobin-Miyaji of the Electronic Privacy Information Center, called the situation unacceptable and said it reflects how little companies invest in compliance. Elina van Kempen, a UC Irvine PhD researcher who has studied CCPA compliance among more than 500 data brokers, said misclassified requests are a recurring problem.

Experts suggested stronger "data minimization" rules as a better long-term fix—limiting what companies can collect in the first place so consumers wouldn't need to navigate these bureaucratic processes at all.