I Asked 100 Companies for My Data. I Got Deletion Notices Instead

Under the California Consumer Privacy Act (CCPA), individuals have the right to request access to personal data collected by large companies. The author filed more than 100 such access requests, focusing only on obtaining copies of their data, not deletion. The process proved extremely time-consuming—from finding the correct submission method (web form, phone, or email) to repeated identity verification—while companies often ignored the explicit instruction not to delete anything.

One striking example was Crunchbase, which responded to an access request by permanently deleting the user's account, despite a clear statement that deletion was not requested. When questioned, Crunchbase confirmed the account was gone but claimed other data remained. Consumer advocates, including Ben Winters of the Consumer Federation of America, called this behavior "crazy" and an unacceptable status quo, pointing to weaknesses in policies that rely on companies acting in good faith.

In contrast, McDonald's provided a 515-page report detailing app interactions and even predicting the author would never stop eating there. The article also discloses that the author used generative AI to draft bureaucratic emails and manage a tracking spreadsheet, while writing the main article by hand. Overall, the experience illustrates how companies can evade or undermine data access rights, raising questions about enforcement and consumer protection.