Data Access Requests Under California Privacy Law Reveal Compliance Problems
A journalist filed over 100 CCPA data access requests and found that some companies deleted information instead of providing it, and others refused to process requests through their stated methods.
What happened
A journalist filed more than 100 data access requests under the California Consumer Privacy Act (CCPA), which grants consumers the right to request copies of their personal data from large companies. McDonald's responded with a 515-page report detailing app interactions and predictive analytics. However, several companies either responded with messages indicating they had deleted the requested information—contrary to the explicit request for access—or refused to process the request through methods listed in their privacy policies. Companies are legally permitted 45 days to complete access requests.
Context
The CCPA, effective since 2020, establishes three key rights: opting out of data sales, requesting deletion, and requesting access to collected information. The journalist's experience reveals practical weaknesses in how companies handle these statutory requirements. Consumer advocates view these compliance failures as evidence that policy frameworks relying on voluntary corporate compliance are insufficient, and that the status quo around data access requests is unacceptable.