The Bureaucratic Maze: A Journalist’s Struggle to Access Personal Data Under California’s Privacy Law

Earlier this month, a journalist’s routine request to McDonald’s for their personal data yielded a startling 515-page report. This extensive dossier meticulously detailed every app interaction and even ventured a prediction: the individual would "never stop eating there." This revelation, obtained under the provisions of the California Consumer Privacy Act (CCPA), served as the opening salvo in a week-long odyssey that saw the journalist file over 100 similar data access requests, exposing significant friction points and systemic failures in how companies handle consumer privacy rights.

The California Consumer Privacy Act, which came into effect in 2020, stands as a landmark piece of legislation designed to grant consumers greater control over their personal information. Among its core tenets are three crucial rights: the right to opt out of the sale of personal information, the right to demand the deletion of such data, and the right to request a copy of the data a company has collected. For this particular investigation, the journalist focused exclusively on the latter – access requests – aiming to gain a clear understanding of the types and volume of data being amassed by various corporations. Under the CCPA, companies are typically required to offer at least two distinct methods for consumers to file these requests, often through web forms, dedicated phone numbers, or specific email addresses, as outlined in their privacy policies. Once submitted, companies have a statutory period of 45 days to fulfill the request.

However, the journalist’s journey through this regulatory landscape proved to be far from straightforward. The process was described as "incredibly time-consuming," a laborious endeavor compounded by the challenge of identifying the correct filing channels and the repetitive, often frustrating, need to verify identity multiple times. The most vexing issues arose from companies that either misinterpreted access requests as deletion requests, despite explicit instructions to the contrary, or outright refused to process requests through the very methods they had listed in their own privacy policies. These experiences, as noted by consumer advocates, highlight significant deficiencies in current corporate compliance practices.

Ben Winters, the director of AI and privacy at the Consumer Federation of America, expressed profound dismay at these findings. "That’s crazy," Winters remarked, emphasizing that such a status quo is "not acceptable." He viewed these recurring incidents as stark illustrations of the inherent weaknesses in policy frameworks that predominantly rely on companies to operate responsibly and in good faith, without sufficient external oversight or robust enforcement mechanisms.

In the spirit of transparency, and in accordance with WIRED’s editorial policies, the journalist disclosed the use of generative AI tools to streamline the drafting of bureaucratic emails and to manage updates to a tracking spreadsheet during the reporting process. However, the core narrative of the article was meticulously penned by hand in a scratch notebook, underscoring the human effort behind the investigation.

One of the most immediate and glaring errors in handling an access request came from Crunchbase, a well-known database specializing in information about tech startups. On August 17, the journalist emailed Crunchbase’s designated privacy address, clearly articulating the intent to exercise data access rights and explicitly stating: "I am not requesting deletion at this time. Please do not treat this as a deletion request." Despite this unambiguous instruction, a reply arrived just two days later from a Crunchbase support representative with a chilling message: "Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!"

Promptly, the journalist followed up, reiterating the original request for data access, not deletion. Crunchbase’s subsequent response attempted to clarify the situation, stating, "Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted." This distinction, while technically true for data about the journalist present on the platform, meant the journalist’s user account—which likely contained personal interaction data—was irrevocably erased, thereby thwarting the original access request. To regain an account, the journalist would have had to re-register entirely. When contacted for comment, a Crunchbase spokesperson attributed the blunder to a "processing error" and assured that the original access request would now be processed. The spokesperson also clarified that the misclassified response originated from "a person on our customer success team," explicitly denying the involvement of a generative AI tool in that specific instance.

The journalist’s interactions with BeenVerified, a prominent searchable database that aggregates public records, further encapsulated the frustrating and often contradictory experience of placing these access requests. An email was dispatched to BeenVerified’s dedicated CCPA compliance address on the morning of August 19, again specifying that the sender was a California resident seeking an access request, not a deletion.

Predictably, two days later, BeenVerified responded with a message concerning the removal of information. "It appears your person report has already been removed from our Person Search results," the initial email read. It continued, "In addition, we have removed the requested phone number and email address from our search results. This change should be reflected within 24 hours." This response was precisely the opposite of what had been requested. When the journalist clarified that an access request, not a deletion, had been submitted, the support representative replied within 15 minutes, denying the claim and stating the company couldn’t verify the journalist’s identity. This was particularly perplexing, given that the previous email had successfully located and referenced some of the journalist’s personal details. Furthermore, no explanation was provided regarding what information might be needed for proper verification. Pushed to the brink of exasperation, the journalist sent yet another email expressing confusion. The response: "Please be assured that we’re able to process your opt-out request and have removed your information from our website." The repeated misclassification, despite clear instructions, highlighted a systemic issue.

In this moment of profound frustration, the journalist found a measure of solidarity in conversations with Elina van Kempen, a PhD student at UC Irvine and coauthor of the paper Consumer Beware! Exploring Data Brokers’ CCPA Compliance. Van Kempen, who had personally placed access requests with over 500 data brokers under the same California law, recounted encountering similar patterns of misclassification. "Sometimes I would make an access request, and the automatic answer was ‘We will opt you out’ or ‘We will delete your data,’" van Kempen explained, noting that while some brokers eventually corrected their errors, others left her without resolution. This academic research underscored that the journalist’s individual struggles were not isolated incidents but rather symptoms of a widespread problem within the data broker industry.

When BeenVerified was approached for comment, Greg Hammond, senior counsel and senior director of compliance at its parent company, stated via email that support agents receive annual privacy training, including specific instruction on processing CCPA requests. Hammond conceded, "Unfortunately, despite the training, the agent who handled this matter was mistaken and misunderstood the request type." He added that the company intended to provide refresher training on correct processing procedures and to audit recent work to prevent similar errors.

The attempts to place an access request with Cash App, the money-sending service operated by Block, proved equally exasperating, even without the added frustration of a deletion mistake. Cash App’s privacy policy explicitly, and in bold text, states that California residents can submit access requests either through the company’s website or via a toll-free phone call. The journalist opted to test the phone option. The initial call, explaining the purpose as a California resident seeking an access request, was met with apparent bewilderment. After being placed on hold multiple times, the journalist was instructed to consult the privacy policy and call the number listed there – the very number that had just been dialed. The attempt to process an access request over the phone was effectively denied.

"OK, sure, I’ll call this number right back," the journalist recalled saying, a hint of anger surfacing despite efforts to maintain professionalism. Subsequent interactions with another customer support agent were similarly unproductive. After another hold, the journalist was advised to call back later, as the support team needed "more time to review their resources and understand how to handle my call."

When WIRED reached out to Cash App for comment, a spokesperson responded via email, stating, "Customers can access or delete their personal information directly through Cash App, which allows us to more quickly verify identity before providing access to financial account information or deleting an account." The spokesperson added that "Our phone support teams are trained to help customers understand how to submit these requests, and we also provide customers with instructions they can access through our online Help Center." However, the spokesperson notably failed to address follow-up questions inquiring why the phone number was explicitly listed in Cash App’s privacy policy as a valid method for consumers to exercise their data rights if the service was not genuinely equipped to handle such requests.

Experts in the field of digital privacy expressed serious doubts about the level of commitment companies are investing in legal compliance. Mayu Tobin-Miyaji, a law fellow at the Electronic Privacy Information Center (EPIC), articulated this concern: "It shows how potentially little resources the companies are putting toward compliance and making sure that people can have access to their data." This perceived lack of investment translates directly into the frustrating experiences faced by consumers.

Both Winters and Tobin-Miyaji advocated for a more robust approach to "data minimization" as a superior path forward for consumers. Data minimization is a privacy principle that essentially dictates companies should collect only the data strictly necessary to perform their standard business operations. For instance, while storing credit card information within an app for seamless future purchases might be permissible, gathering extensive personal demographic data solely for the purpose of selling it to data brokers would be restricted.

This holistic approach to data minimization would fundamentally shift the burden away from individual consumers, who are currently forced to navigate a complex and often bureaucratic obstacle course merely to ascertain what information companies possess about them. Instead, by proactively limiting the scope of data that companies are allowed to collect in the first place, consumers could enjoy significantly greater peace of mind, without having to endure the headache-inducing and often futile processes that characterized the journalist’s investigation. It represents a move from reactive consumer rights to proactive corporate responsibility.