California just gave its 40 million residents a permanent delete button for a largely covert part of the personal data economy.
On New Year’s Day, a government website opened to let Californians demand more than 500 intermediaries called data brokers wipe their personal information from the data on sale and regularly repeat those deletions in the future.
This deletion power is available only to California residents, and data brokers don’t have to comply until later this year. It’s still worth signing up for deletions now if you’re in California — and paying attention if you’re not.
So much of your personal information is amassed by so many companies that no individual can control the scope and the potential harm. Empowering yourself against rampant data surveillance requires savvy laws, regulation and enforcement that only governments can undertake.
Here is how Californians can use their new privacy protection powers, as well as some privacy measures the rest of us can take.
Invisible data brokers
Data brokers are the pistons of the economy built on selling your data. These companies, most of which are unknown to you, compile and sell Americans’ personal information for commercial or government use.
Largely without your knowledge or true consent, data brokers may have harvested or inferred your income, home address, Social Security number, the names of your relatives, details of your medical ailments, the trimester of your pregnancy, all the times you braked or accelerated hard while driving, and precise locations where you go with your phone, such as churches, political rallies, gay bars and Planned Parenthood clinics.
There are typically few restrictions on to whom or for what purpose that personal information can be sold or shared.
“Data brokers enrich a few while exposing everyone else to risk: a nationwide system where anyone can be located, profiled, or targeted with ease,” said Brightlines CEO Shauna Dillavou, whose company helps people remove unwanted online personal information.
But data brokers are hard to avoid. Even in states where people have the legal right to demand companies stop selling or sharing their personal information, you might have to file opt-out requests with hundreds of data brokers. Attempts by some states, including California, to regulate data brokers mostly haven’t worked.
Then in 2023, California amended its consumer protection laws with a unique mandate in U.S. data privacy history: a single website where people could order all data brokers operating in the state to delete their personal information in one fell swoop.
Advocates who worked for the California measure, known as the Delete Act, are largely thrilled.
“California has the most advanced approach to data brokers of any state,” said Matt Schwartz, a policy analyst for Consumer Reports. “The Delete Act is a great example of a law that gives meaningful control back to consumers.”
What Californians (and the rest of us) can do
To start using the data broker deletion website, you must verify that you’re a California resident through a digital identification service. Then you enter basic information including your name and variations of your name, date of birth, email address and phone number.
For simplicity, I suggest you skip for now the request for more complicated information, such as your phone’s unique identification number and your vehicle identification number. Those long strings of digits are one way that data brokers may identify you for targeted advertising or tracking.
You can go back later and add or change anything you enter into the broker deletion website, said Tom Kemp, executive director of California’s privacy watchdog, the California Privacy Protection Agency.
The privacy agency has help resources and dispute resolution if, for example, you have trouble validating that you’re a California resident. Drop me a line and tell me about your experience with the deletion website.
Don’t expect anything to happen yet. Data brokers have roughly until the middle of September to act on deletion requests. After that, they face daily fines for each unfilled deletion demand. Data brokers also must regularly comb their records to delete new information from people who previously demanded deletion.
Rachel Vrabec, founder of the data broker deletion service Kanary, said it will be challenging for California to protect people’s personal information from data brokers while also ensuring compliance with data deletion demands.
If you choose to delete your information from data brokers with the California website, there should be changes that you notice — and others you might not.
Kemp said you should notice a reduction in your data shown by “people search” websites that make information such as your address and relatives’ names available to anyone. Kemp said you should also notice fewer targeted online ads and unsolicited texts and emails from companies you’ve never dealt with.
Data broker deletions won’t scrub everything. Some personal information is considered public, such as voter registration and property records. Information like that has been digitized and compiled online and is largely exempt from deletion requests, in California and elsewhere.
While slow and imperfect, California’s years of tightening privacy protections show what’s possible when citizens and their elected representatives take data privacy seriously and keep tinkering with what isn’t working.
The goal, Kemp said, is to give people meaningful and simple power over their data.
“The way that things are stacked against consumers, privacy is too hard,” Kemp said. “What we’re doing here is trying to make privacy easier.”
One tiny win
While those of us outside California don’t have the same legal privacy powers, many Americans do have the right to tell companies we deal with directly to stop collecting or selling our personal information.
Here are privacy-protecting steps you can take:
• Use web browsers from Brave, Firefox or DuckDuckGo. Those browsers can automatically send legally binding orders, depending on your state, telling websites you visit not to share or sell information about you. Read more about that here.
• Privacy Badger, software you can download from the Electronic Frontier Foundation consumer advocacy group, does the same thing as the browsers. It works with Google Chrome, Firefox or Microsoft Edge.
• Use Permission Slip from Consumer Reports. Give the app basic information, and it will help you do much of the legwork to tell companies not to sell your information or to delete it, if you have the right to do so. Some Permission Slip features are free, with options for additional paid services that include deleting your information from data brokers.
• Ask to delete your information from “people search” websites. It will take time, or money, to scrub your information from this corner of the data broker industry. Read more from Consumer Reports.
• Consider supporting privacy laws in your state. Schwartz said more states are considering data broker deletion rights modeled on California’s. “That won’t happen without people demanding stronger laws,” he said.
The post America’s toughest privacy protections have finally kicked in appeared first on Washington Post.
