Let My Data Go: Data Brokers' Compliance with Opt-Out and Deletion Requests

• URL: http://arxiv.org/abs/2607.04552v1
• Date: Sun, 05 Jul 2026 23:52:18 GMT
• Title: Let My Data Go: Data Brokers' Compliance with Opt-Out and Deletion Requests
• Abstract summary: Data brokers are a largely American phenomenon.<n>California Consumer Privacy Act (CCPA) modeled after EU's General Data Protection Regulation.<n>Some data brokers require intrusive consumer identity verification in order to exercise one's opt-out rights.
• Score: 9.601311112679367
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Data brokers are a largely American phenomenon. They collect vast amounts of personal information about most adult U.S. consumers, mainly without the latter's knowledge or consent. Accumulated data can be sold to anyone, including employers, landlords, insurance agencies, banks, governments (local, state, federal, and even foreign), as well as various malicious actors. This, in turn, enables discrimination, surveillance, identity theft, and stalking. Recent regulations -- such as the California Consumer Privacy Act (CCPA) modeled after EU's General Data Protection Regulation (GDPR) -- were introduced to bolster consumer privacy, e.g., the rights to: (1) opt-out of the sharing or selling one's personal information, (2) delete one's personal information, and (3) obtain a copy of that information. However, exercising these rights is not easy, as shown by our comprehensive study of the data broker ecosystem. We submitted both opt-out and deletion requests (using synthetic consumer identities) under the CCPA to all California-registered data brokers and investigated their responses and lack thereof. While the majority seem to be compliant, a significant fraction is not and many failed to reply to (and/or acknowledge) consumer requests. Furthermore, some data brokers require intrusive consumer identity verification in order to exercise one's opt-out rights, which is explicitly disallowed by the CCPA. There is also great disparity in the request submission process among data brokers as well as an extremely heavy (time and effort) overall consumer burden. This motivates an urgent need for streamlining and standardization of the consumer interface, stronger enforcement, and meaningful consequences for (especially sustained) non-compliance.

Related papers

• Privacy Without Remedy: An Assessment of Data Broker Compliance with California Privacy Law [4.524476021202175]
  We offer the first empirical assessment of data broker compliance with the California Consumer Privacy Act and the 2023 Delete Act.<n>We show that only 9% of registered data brokers were fully compliant with transparency requirements after the Delete Act took effect.<n>We articulate reforms that could improve consumer privacy, transparency in broker practices, and compliance with these laws.
  arXiv  Detail & Related papers  (2026-05-20T16:39:19Z)
• How to DP-fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy [52.00934156883483]
  Differential Privacy (DP) is a framework for reasoning about and limiting information leakage.<n>Differentially Private Synthetic data refers to synthetic data that preserves the overall trends of source data.
  arXiv  Detail & Related papers  (2025-12-02T21:14:39Z)
• The Perfect Match? A Closer Look at the Relationship between EU Consumer Law and Data Protection Law [0.8076386449963743]
  In modern markets, many companies offer so-called 'free' services and monetize consumer data they collect through those services.<n>This paper argues that consumer law and data protection law can usefully complement each other.
  arXiv  Detail & Related papers  (2025-10-15T12:13:35Z)
• Consumer Beware! Exploring Data Brokers' CCPA Compliance [8.562189001930745]
  The California Consumer Privacy Act (CCPA) grants consumers the legal right to request access to, or deletion of, their data.<n>To facilitate these requests, California maintains an official registry of data brokers.<n>This paper presents the first large-scale, systematic study of CCPA compliance of all 543 officially registered data brokers.
  arXiv  Detail & Related papers  (2025-06-27T04:57:32Z)
• SoK: The Gap Between Data Rights Ideals and Reality [42.769107967436945]
  Do rights-based privacy laws effectively empower individuals over their data?<n>This paper scrutinizes these approaches by reviewing empirical studies, news articles, and blog posts.
  arXiv  Detail & Related papers  (2023-12-03T21:52:51Z)
• Protecting User Privacy in Online Settings via Supervised Learning [69.38374877559423]
  We design an intelligent approach to online privacy protection that leverages supervised learning. By detecting and blocking data collection that might infringe on a user's privacy, we can restore a degree of digital privacy to the user.
  arXiv  Detail & Related papers  (2023-04-06T05:20:16Z)
• Certified Data Removal in Sum-Product Networks [78.27542864367821]
  Deleting the collected data is often insufficient to guarantee data privacy. UnlearnSPN is an algorithm that removes the influence of single data points from a trained sum-product network.
  arXiv  Detail & Related papers  (2022-10-04T08:22:37Z)
• Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA [29.56312492076473]
  Vagueness and ambiguity in privacy policies threaten the ability of consumers to make informed choices about how businesses collect, use, and share personal information. The California Consumer Privacy Act (CCPA) of 2018 was intended to provide Californian consumers with more control by mandating that businesses clearly disclose their data practices. Our results suggest that CCPA's mandates for privacy disclosures, as currently implemented, have not yet yielded the level of clarity they were designed to deliver.
  arXiv  Detail & Related papers  (2021-09-28T15:40:57Z)
• Second layer data governance for permissioned blockchains: the privacy management challenge [58.720142291102135]
  In pandemic situations, such as the COVID-19 and Ebola outbreak, the action related to sharing health data is crucial to avoid the massive infection and decrease the number of deaths. In this sense, permissioned blockchain technology emerges to empower users to get their rights providing data ownership, transparency, and security through an immutable, unified, and distributed database ruled by smart contracts.
  arXiv  Detail & Related papers  (2020-10-22T13:19:38Z)
• A vision for global privacy bridges: Technical and legal measures for international data markets [77.34726150561087]
  Despite data protection laws and an acknowledged right to privacy, trading personal information has become a business equated with "trading oil" An open conflict is arising between business demands for data and a desire for privacy. We propose and test a vision of a personal information market with privacy.
  arXiv  Detail & Related papers  (2020-05-13T13:55:50Z)
• GDPR: When the Right to Access Personal Data Becomes a Threat [63.732639864601914]
  We examine more than 300 data controllers performing for each of them a request to access personal data. We find that 50.4% of the data controllers that handled the request, have flaws in the procedure of identifying the users. With the undesired and surprising result that, in its present deployment, has actually decreased the privacy of the users of web services.
  arXiv  Detail & Related papers  (2020-05-04T22:01:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.