Use a loyalty card at a drug store, browse the web, post on social media, get married or do anything else most people do, and chances are companies called data brokers know about it — along with your email address, your phone number, where you live and virtually everywhere you go.
But starting Jan. 1, under the state’s first-in-the-nation Delete Act, Californians can reduce the information brokers can gather and sell.
“So many people still don’t realize that these companies even exist, or the scale of the marketplace — the number of these companies that sell information about us,” said Irina Raicu, director of the Internet Ethics program at Santa Clara University’s Markkula Center for Applied Ethics.
The companies build dossiers that are increasingly supercharged by artificial intelligence to draw conclusions about a person’s interests, family, politics, lifestyle, finances, sexual orientation and health. They sell those dossiers to advertisers and marketers, and, in some cases, to criminals, governments, landlords and employers.
The Delete Request and Opt-out Platform (DROP), run by state agency CalPrivacy, goes live New Year’s Day, allowing residents to have their data deleted, through a single request, by the more than 500 brokers already registered with the agency.
“It’s the big delete button in the sky,” said CalPrivacy’s executive director Tom Kemp. “You just go in, you spend a couple of minutes on the DROP site, you hit go, and starting in August the deletions will begin. There will be a significant reduction in Californians’ data being sold.” Data brokers were given six months to process the first delete requests.
The Delete Act was authored by Peninsula and South Bay state Sen. Josh Becker, and signed into law in 2023.
“We didn’t give consent to this, and our data is being bought and sold without our permission and for 99.9% of people without their knowledge,” Becker said.
A 2023 legislative staff report to the state Assembly said brokers can offer consumer benefits, such as detecting fraud or facilitating loan approvals. But, the report continued, “there have been myriad reports of the risks data brokers pose to individuals’ Constitutional rights, financial privacy, personal privacy and reproductive privacy.”
Location data from smartphones, tablets and internet-connected devices was a $21 billion industry globally last year, according to market-research consultancy Grandview Research reported. That information allows brokers to connect the dots between various publicly available and purchasable information points to identify specific people, Kemp said.
“That data can be weaponized,” he said, citing reports of federal immigration-enforcement agencies buying data from data brokers, including location information.
Kemp also said there have been instances of people who have been tracked going to reproductive health clinics. Last year, Oregon Democratic U.S. Senator Ron Wyden said an anti-abortion political group used mobile phone location data from a data broker to send “targeted misinformation” to people who visited any of 600 reproductive health clinics in 48 states
Financial information — often ambiguous or out of date, according to the U.S. Consumer Financial Protection Bureau — can be bought from data brokers by landlords.
“We’ve seen incidences where people have been rejected for rental units based on data from data brokers,” Kemp said.
Scammers can also buy the information. They may choose a target based on age, find out the names, phone numbers and email addresses of their grandchildren, then fake an emergency call or email from a grandchild pleading for money to be wired, Kemp said.
Becker expressed concerns about mental health apps selling information to data brokers, and employers denying a job to someone based on inferences they’re gay, ill or have been a union member.
Santa Clara University’s Raicu said health insurers could use inferences to deny coverage.
While many companies gather personal data — including Silicon Valley technology giants Google and Meta, which use it to sell targeted advertising — companies deemed data brokers under the law are those that Californians do not have a direct relationship with.
The legislation faced intensive lobbying by data brokers and their beneficiaries, Becker said.
Groups opposing it included the American Advertising Federation, the California Bankers Association, and the California Retailers Association. The bill was supported by groups including the Consumer Federation of America, Oakland Privacy, and Planned Parenthood Affiliates of California.
Not all personal information must be deleted under the law. Public information, for example whether someone is registered to vote, can still be collected even if a person goes through the DROP process. And credit-reporting companies, banks and insurance companies can keep certain data that is regulated by federal law and other state laws.
For the past year and a half, CalPrivacy worked to register firms collecting Californians’ information and ensure brokers will be ready to purge and continue to purge information covered by the law.
“There are more out there and we’re looking to make sure that data brokers are following the law by registering,” Kemp said, adding the companies are required to submit independent audits of their compliance. “We have a dashboard of who’s deleting and who’s not,” he said.
Brian Hofer, former chair of Oakland’s Privacy Advisory Commission, said he expected “some positive benefit” from the Delete Act, “but it’s not a game changer.”
Brokers making tens of millions of dollars a year selling personal data may consider the $200 daily fine for failing to register with state authorities to be the cost of doing business, Hofer said.
Companies that fail to delete information face larger fees, a $200-a-day fine for each violation, which Kemp said could draw “astronomical” penalties.
Raicu called the law a “worthy experiment,” and said it remained to be seen how effective it would be.
“Whether it’s successful will depend in part on how many people know that they can do this,” Raicu said, “and how many people take advantage of it.”
Come the New Year, brokers will begin to find out how many Californians are reaching for the big delete button.
Leave a Reply