The Problem
Consumers around the country have concerns about the privacy problems linked to tech giants like Amazon, Apple, Google, Meta, and TikTok. However, lurking in the shadows is the overlooked data broker industry, which has become a multi-billion dollar business, primarily fueled by the collection and sale of your personal data.
When the California legislature cannonballed into the privacy conversation in 2018 by passing the California Privacy Protection Act (CCPA), it created a wave that continues to crest to this day. California’s bold leap, coupled with continued inaction by Congress, has encouraged more and more states to take up the cause on their own, with baseline privacy rights extended to more than 100 million Americans through comprehensive state laws as of today. The wave shows no signs of slowing either; of the eleven states that have passed comprehensive privacy laws since CCPA, seven of those came in the 2023 legislative session alone.
However, even with CCPA and other state privacy laws, there are still blind spots that leave consumers under protected. Thankfully, California took another huge step towards addressing this problem by passing the Delete Act. California is now the first state in the nation to allow consumers to request universal deletion of their information from data brokers – and we’re hoping this concept catches on elsewhere soon.
A Promising New Law
This new law is crucial to reign in the shady data broker industry that has largely avoided scrutiny until now. Data brokers make money by collecting and selling extremely granular personal details about individuals, often without our knowledge or consent. These companies know incredible amounts of information about us, including our behavior online (did you put that Nutella in your shopping cart?), our preferences (are you a weekend camper or a beach bum?), our income and addresses (past and present), and, thanks to ubiquitous tracking on mobile devices, even our precise movements throughout the day. This information is then sold and resold, often to entities like social media companies or advertisers, but also potentially to ex-spouses, law enforcement, or others who might have an interest in tracking you. Some data brokers have shockingly unscrupulous sales practices.
Data brokers collect such information by purchasing it from companies (or purchasing the companies themselves), scraping it from online or public information sources, or even inferring it through machine learning techniques. That’s right, even if a data broker is missing some piece of information about you, they might just guess it, sometimes to wildly inaccurate ends. Since consumers often have no direct contact with data brokers, they might not even know such entities exist, let alone that they have detailed dossiers about them that include thousands of data points.
Why should I care?
The Delete Act will help consumers claw some semblance of control back from this largely unregulated industry. Most importantly, its protections are actually usable. Today, theoretically, you could ask each individual data broker to stop selling your information. But how are you supposed to know which ones actually have it? Even if you identified all the relevant brokers, Consumer Reports has found that it is incredibly burdensome and confusing to exercise your rights in this manner. Further, many brokers may argue they aren’t covered by existing law.
In lieu of this wild goose chase, the Delete Act makes things easy for consumers. Similar to how authorized agents like Permission Slip and universal opt-out signals like Global Privacy Control work under CCPA, the law requires the California Privacy Protection Agency to create a universal deletion mechanism that will allow consumers to send out a deletion request to all of the state’s registered data brokers with a single click of a button. If you do not want to be tracked in the manner described above, all you’ll have to do is set your preference once and brokers will be required to honor it until you tell them to stop. That’s a choice that everybody deserves, but predictably, the data broker industry fought tooth and nail to prevent us from having. Thankfully, it is now law.
Where do we go from here?
It seems Californians are very ready for these new protections – 81 percent of Californians polled supported the bill – and we’re guessing that similar levels of support exist for this type of measure in other states as well. Though the universal deletion mechanism doesn’t become active until 2026, there’s plenty of work to do in the interim, both implementing the law in California and proselytizing the concept elsewhere.
Stay tuned for future Consumer Reports work on the topic, because we’re hoping to make the idea mainstream around the country. Every consumer deserves this type of protection.
