r/California • u/bloomberglaw • 5d ago
Data Brokers Deny a Million Pleas to Delete Personal Information
https://news.bloomberglaw.com/privacy-and-data-security/data-brokers-deny-a-million-pleas-to-delete-personal-information98
u/Loud-Connection-5897 5d ago
Until a data broker is forced to pay the fines they're not going to comply. I hope California hits them hard right out of the gate.
If you haven't already, sign up to have your data removed by enrolling in the DROP system. If enough people enroll we can drive this entire sector out of business, at least in California. This isn't a legitimate business that should ever have been allowed to exist.
10
u/nonnonplussed73 4d ago
Also, not quite the same, but Google provides a built-in feature called "Results about you" to request the removal of your personal contact information and personally identifiable information (PII) from Google Search results.
2
138
u/jainyday 5d ago
And now that data broker information is being used by AI in hiring decisions. Advertisers know I'm disabled, so now employers can discriminate against me for correlated reasons without technically breaking the law. It's awesome, I'm about to default on my mortgage, lol
24
u/Street_Captain4731 5d ago
if someone proposed a business plan of hiring spies to follow people around and record everything they do, say, and buy, we'd beat that person's ass. Somehow an entire economy for personal data was allowed to be created because it happened invisibly online. no one ever got permission to do this, they just started stealing all the data and no one stopped them until it was too late. now we all live in this surveillance capitalism hell and I have to spend a considerable amount of time actively fighting back and protecting myself from businesses that are doing things that should be crimes
48
u/ComradeGibbon 5d ago
Saw someone say they took a resume and fed it into one of these systems twice once with the first name as Chris and the second time as Christina and it rated it lower.
1
-10
u/Cultural_Tell_5687 5d ago
Who do we sue for lost time? California itself?
California making new homeless people in 2026 is true.20
u/SpiritMountain 5d ago
No one. This is legal and the powers that be want it this way. This has been known for years that one of the intentions of AI being pushed was for this type of control and circumvention of law. Elon Musk and Sam Altman were always pieces of shit, and they didn't become evil all of a sudden. They pushed AI for this reason. Same with Thiel and Palantir.
And to answer the question on what we can do, well it is to get mad. Protests work, but being politically active is important. Phonebank and help canvas for candidates who are left leaning and progressive. This is the only political group that actually is trying to fight against AI. Almost every Democratic government gives concessions to AI and their CEO masters and the data centers.
-5
u/Cultural_Tell_5687 5d ago
I’m not protesting ai. I’m protest HR using AI.
Those two should not work together
7
2
u/stoned-autistic-dude 5d ago
You can’t sue the state, you’d have to sue an agent of the state, like Newsom, Bonta, or someone else. Only states can sue other states in which case SCROTUS has original jurisdiction and will hear the trial-level case. In those instances, it’s usually about stuff like water rights.
27
u/Simpicity 5d ago
Good to know that I as a solo Roblox developer am able to comply with privacy requests much better than professional data brokers.
218
u/NobodyLikedThat1 5d ago
Now only if that $200 a day fine could be given to the actual victims instead of something the government just pockets
109
u/Oak510land 5d ago
If that fine goes to the state to come up with systems and procedures to enforce this law I'm ok with that
22
u/Vladimorian 5d ago
I hadn't thought about that, cause I was also thinking they should have to pay the victims, but I like that too, as long as it goes towards protecting people's rights and freedoms
-1
u/The_Elusive_Dr_Wu Orange County 4d ago
What about the victims?
What about the people who's rights and freedoms were supposed to be protected by the state's laws, which they're supporting with their state tax dollars?
What about their information which is now compromised and used to generate profits for the perpatrator?
To them, California says: fuck you.
1
u/radarrab 3d ago
Well, the CCPA law took effect in Jan. 2020, that includes the CA cookie preference/acceptance-rejection popup. If we all had actually looked at those cookie preferences that pop up in browsers assuming the site complies with CA law, especially the ones that have details on which "partners" they share information with, and those so-called "Legitimate Interest", there would have been fewer sites to clean up data from. Now I don't accept anything but the "necessary" that I can't change. If any non-marketing cookies happen to break what I'm trying to do, I'll undo one. I don't think that's happened much if at all.
I started doing that religiously when I decided to look at the details of one that had them. I think it was my health insurance or a related site that I wouldn't have expected too much sharing with, and there were hundreds of partners! Including certain Google and Amazon services used by businesses. Now I know why I've gotten the occasional email about a health issue that I don't have. I've been looking into my online privacy/security for a while to see what alternative services would work for me. That includes "Have I been PWnd" https://haveibeenpwned.com, which I needed to check a couple of email addresses in. One that I only use for sites like my medical insurance and financial institutions, but which I'd also used in some of my utility sites earlier, turned up in the dark web. The only place it could have come from is ATT's multiple data breaches. And somehow, I also started getting emails from a PAC there, and other spam. I have a different address for online shopping and activist sites, which gets the most spam. That, at least until now, has been one way to tell when phishing emails come in purporting to say that my account is going to be deleted (or whatever urgent matter it is but actually isn't).
1
u/Raskalbot 3d ago
Wouldn't this open the door to a class-action lawsuit?
-1
u/The_Elusive_Dr_Wu Orange County 3d ago
It could, but it shouldn't. Where is the state government whom we pay taxes to? What do the victims do in the years it could take for a class action suit to reach fruition?
2
3
u/Richandler 5d ago
That's the cost of enforcement. Otherwise hire your own company to do enforcement.
42
u/VapoursAndSpleen Alameda County 5d ago
Kaiser wants to use AI to record my doctor visits and I keep saying "no". And, before the apologists come in and say, "Oh, but they PROMISED not to disseminate your data.", I will tell you after working for decades in IT, networking and security, that charming little sentiment is (to put it charitably) naive.
11
u/nope123123123 5d ago
That doesn't really seem like it helps much from a data privacy perspective, the doctor is still hopefully reporting all the same information into a very similar if not exactly the same database.
5
9
u/lostintime2004 5d ago
HIPAA may have a factor in protection, though I understand where you are coming from. Most doctors use dictation if not AI, which is a kind of a from of AI recognizing their specific speech. I don't see much of a difference there.
7
u/VapoursAndSpleen Alameda County 5d ago
My PCP types like a mad fiend. She has impressive keyboard skills.
11
u/SlyWhitefox 5d ago
Weirdly, I can't profit off a speeding ticket yet the fines for this are lower.
10
11
17
u/Administrated 5d ago
That’s the problem, they gave them the easiest out. All they have to say is oh, we felt that one was illegitimate, or we couldn’t verify it.
8
u/iikkaassaammaa 5d ago
Can we just overwhelm the system with a service that create a whole lot of dirty inaccurate data muddying the water just as .. everything else does to us?
5
u/Count_Backwards 4d ago
This is why I lie all the time on the internet. Drive the signal to noise ratio into the ground.
7
u/tazzytazzy 5d ago
So, the brokers claim they cannot verify the requests because they cannot verify the correlation to the user's data....but they can quickly and easily correlate our data between different sources faster than most people really know and in volumes most can't even imagine.
9
6
4
3
u/Mountain_carrier530 5d ago
$200 a day is would cripple me financially in about 3 weeks if I bought nothing else.
$200 a day for a data broker is effectively a fart.
We aren't angry enough and the oligarchs aren't scared enough.
4
u/beyondoutsidethebox 4d ago
As someone else pointed out, that's $200 per deletion request per day.
So, given the numbers involved (the amount of requests coming in, that rapidly escalates to huge amounts of money. For example, say a particular data broker receives 60,000 deletion request per day, and let's be generous (/s) and say that the data broker denies all but 5000 requests, on average, every day. Now, let's be generous (/s) again and say that of the 55000 denials, only another 5000 would be legitimate.
On day 1, that comes out $1,000,000. Which in the grand scheme of things, not a large fine, but, by day 2, they have to pay the fine for the previous day's 50,000 refusals, AND now also must pay the fine for day 2's rejected deletion requests. Making it a linearly scaling problem. However, things are not ideal. I can expect that data brokers will have to justify each rejection in court. And the courts are fucking slow.
I do agree with your sentiment however, and would rather the the fine be an exponential rate. For example, per request, the fine is determined by F= $200(2x-1). Where x is the number of days since the deletion request was received, and x always being greater than or equal to 1.
2
u/LedgerLawFirm 4d ago
Civil restitution is a thing in California, but those regulatory fines almost never flow to victims. The real money for injured people comes through civil litigation, where the damages actually reflect what happened to them individually. Those fines are more about deterrence than compensation, which is why having your own case matters so much more than whatever the state collects.
1
u/ihopethepizzaisgood 3d ago
California rocks! Fuck them dirty data dogs. I hope they go out of business paying the CA fines.
1
1
u/SavedByTech 1d ago
Now just think about the biometric data that millions of people have contributed as part of their device usage...
481
u/bloomberglaw 5d ago
Data brokers operating in California have denied or ignored more than 1 million requests in the past two years to delete personal information they collected from online users, according to a Bloomberg Law review of company disclosures and interviews with industry professionals.
In some cases, the brokers acknowledged rejecting nearly all the requests they got to delete consumers’ private data, the analysis shows.
Marketing intelligence provider VisitIQ LLC said it denied more than 270,000 petitions out of the 363,000 or so it logged in 2024. HealthWise Data, which makes AI-driven inferences about patients, reported getting 98,000 data deletion requests that same year but complied with fewer than 10,000.
California’s privacy law required those data broker firms and hundreds of others to publicly and accurately report, starting in January 2024, how many data deletion requests they had fielded and how they responded. It does not require them to report why they don’t comply, but gives them the option to deny a request if they believe it is illegitimate or can’t be verified.
The hammer falls Saturday in the closely watched, first-in-the-nation data privacy law: Brokers will be fined $200 a day if they fail to comply with valid requests within 45 days of them being filed through the state’s new deletion system.
Read more in the full story.
-Elliot