Ask for Your Data, and Companies Might Just Delete It

If you ask a tech company or a retail giant to show you the personal data they hold on you, you might expect a neat, albeit long, spreadsheet. What you probably don't expect is for them to panic and hit the delete button.

Thanks to privacy legislation like the California Consumer Privacy Act (CCPA), which took effect in 2020, consumers have the legal right to request copies of their personal information, opt out of its sale, or ask for its deletion. Curious about what his digital footprint actually looked like, a journalist recently filed a data access request with McDonald's.

The response was staggering: a 515-page document detailing his app interactions with granular precision. It wasn't just a ledger of burger orders; the system had generated behavioral predictions, confidently forecasting that the user would remain a lifelong customer.

Encouraged by this overwhelming level of detail, the journalist expanded the experiment, filing similar data access requests to over 100 different companies. But the broader results revealed a bizarre loophole in corporate compliance. Instead of compiling and returning the data as requested, several companies simply wiped the user's information from their servers entirely.

This "delete rather than disclose" approach highlights a massive disconnect in the modern data economy. Today’s corporations eagerly vacuum up vast amounts of personal information to feed algorithms and AI-driven marketing tools. However, organizing that scattered data into a coherent, shareable format for a consumer is expensive, technically demanding, and potentially embarrassing if it reveals aggressive surveillance tactics.

For some organizations, wiping the slate clean is simply cheaper and legally safer than complying with the spirit of the transparency law. It acts as a shortcut: if the data no longer exists, there is no data to hand over.

This situation exposes a fragile reality regarding digital ownership. While legislation gives us the right to peek behind the corporate curtain, the infrastructure to support that transparency is often lacking. As artificial intelligence continues to demand ever-larger pools of personal data, understanding not just what companies know about us, but how they handle our requests to see it, becomes a critical part of protecting our digital identities.

Key Points

• A CCPA data request to McDonald's yielded a 515-page report, complete with behavioral predictions about the customer's future habits.
• When a journalist sent data access requests to over 100 companies, some responded by deleting the data entirely instead of providing it.
• Companies often find it cheaper and easier to delete user records than to compile and format them for consumer review.
• This practice highlights a gap between the intent of privacy laws (transparency) and the reality of corporate data management.

Why It Matters

As companies collect vast amounts of data to fuel AI and algorithms, the way they handle legal transparency requests reveals how little control consumers actually have over their digital footprints.

Sources:

• I asked 100 companies for my data. Some deleted it instead. — Ars Technica AI