I asked 100 companies for my data. Some deleted it instead. 我向100家公司索要我的数据，有些直接删除了

TL;DR

• A journalist filed over 100 CCPA data access requests to major companies and encountered widespread mishandling, with many firms misclassifying access requests as deletion or opt-out requests
• McDonald's provided a detailed 515-page report showing granular app interaction data and predictive analytics about the user's eating habits
• Companies like Crunchbase and BeenVerified deleted user accounts or removed data despite explicit instructions not to, citing "processing errors" or agent misunderstanding
• Consumer advocates and researchers describe the current compliance landscape as unacceptable, highlighting systemic weaknesses in self-regulatory privacy frameworks
• The process was extremely time-consuming, involving identity verification hurdles, confusing responses, and companies refusing to process requests through designated channels

Why It Matters

This investigation reveals significant gaps between privacy legislation intent and corporate implementation, demonstrating that CCPA rights are not being honored consistently across industries. For AI and data practitioners, it underscores the importance of robust compliance infrastructure and the risks of relying on automated or undertrained support systems to handle sensitive legal requests.

Technical Details

• The California Consumer Privacy Act (CCPA), effective 2020, grants three key rights: opt-out of data selling, right to deletion, and right to data access
• Companies have up to 45 days to respond to access requests and must provide two filing methods per their privacy policies
• The investigation utilized generative AI to draft bureaucratic emails and maintain tracking spreadsheets, as disclosed per editorial policy
• Academic research by UC Irvine's Elina van Kempen involved over 500 data broker requests, revealing similar misclassification patterns with automated responses
• Support systems at multiple companies appeared to lack proper request-type classification, with agents or automated systems conflating access, deletion, and opt-out requests

Industry Insight

• Companies should invest in specialized training and automated classification systems for CCPA requests to prevent costly compliance failures and reputational damage from misprocessed data requests
• The reliance on undertrained support staff or poorly configured automation for legal compliance represents a systemic risk that could expose organizations to regulatory scrutiny and consumer advocacy challenges
• Privacy compliance requires more than annual training; organizations should implement real-time request validation, audit trails, and dedicated compliance teams to ensure proper handling of consumer data rights requests

摘要

一位记者向多家大型企业提交了超过100份CCPA数据访问请求，却遭遇了广泛的处理不当，许多公司错误地将访问请求归类为删除或退出请求
麦当劳提供了一份详尽的515页报告，展示了细粒度的应用交互数据和关于用户饮食习惯的预测分析
Crunchbase和BeenVerified等公司无视明确指示，仍删除了用户账户或移除了数据，并以"处理错误"或客服误解为由
消费者倡导者和研究人员称当前合规状况不可接受，凸显了自我监管隐私框架中的系统性缺陷
整个过程极其耗时，涉及身份验证障碍、令人困惑的回复，以及公司拒绝通过指定渠道处理请求

深度分析

简要总结

• 一位记者向多家大型企业提交了超过100份CCPA数据访问请求，却遭遇了广泛的处理不当，许多公司错误地将访问请求归类为删除或退出请求
• 麦当劳提供了一份详尽的515页报告，展示了细粒度的应用交互数据和关于用户饮食习惯的预测分析
• Crunchbase和BeenVerified等公司无视明确指示，仍删除了用户账户或移除了数据，并以"处理错误"或客服误解为由
• 消费者倡导者和研究人员称当前合规状况不可接受，凸显了自我监管隐私框架中的系统性缺陷
• 整个过程极其耗时，涉及身份验证障碍、令人困惑的回复，以及公司拒绝通过指定渠道处理请求

为何重要

这项调查揭示了隐私立法意图与企业实际执行之间的显著差距，表明CCPA权利在各行业并未得到一致尊重。对于AI和数据从业者而言，这凸显了建立稳健合规基础设施的重要性，以及依赖自动化或培训不足的客服系统来处理敏感法律请求所存在的风险。

技术细节

• 《加州消费者隐私法》（CCPA）于2020年生效，赋予三项核心权利：退出数据出售、删除权和数据访问权
• 公司最多有45天时间回应访问请求，且必须根据其隐私政策提供两种提交方式
• 该调查利用生成式AI辅助处理数据访问请求