Companies Delete Data Instead of Sharing It With Customers

A simple request to see your own data shouldn't end with companies deleting your account, but that's exactly what kept happening to one determined journalist.

McDonald's got it right. When the reporter filed a data access request, the fast food giant delivered a massive 515-page report showing every app interaction in stunning detail. It even included predictions about his future dining habits.

Encouraged by this transparency, he filed similar requests with over 100 companies under the California Consumer Privacy Act. The law gives residents three key rights: opt out of data selling, delete personal information, or request a copy of what companies have collected.

He chose the third option and made it crystal clear in every request. His messages explicitly stated he was not asking for deletion and wanted only to see his data.

Then the responses started rolling in, and many were baffling. Crunchbase, the tech startup database, sent a cheerful reply saying his account had been permanently deleted. When he followed up to explain the mistake, support staff confirmed they had erased his user account despite his clear instructions.

BeenVerified, a public records database, created an even more confusing mess. After receiving his access request, the company sent multiple messages about removing his information from search results. When he clarified again that he wanted access, not deletion, they denied his request entirely and claimed they couldn't verify his identity.

The journalist wasn't alone in this frustrating experience. A UC Irvine researcher who filed access requests with over 500 data brokers encountered the same problems. Many companies automatically responded with deletion confirmations instead of providing the requested data.

The Bright Side

These mishaps actually reveal something hopeful: companies are starting to build systems for handling privacy requests, even if they're not perfect yet. The California Consumer Privacy Act only took effect in 2020, and businesses are still learning how to comply.

Consumer advocates see these mistakes as growing pains that point toward needed improvements. When companies mess up this badly, it creates clear evidence for strengthening privacy protections and enforcement. Every confused response and wrongful deletion makes the case for better systems stronger.

Both Crunchbase and BeenVerified acknowledged their errors when contacted. Crunchbase blamed a "processing error" and promised to fulfill the original access request. These corrections show companies can learn from their mistakes when held accountable.

The real win here is visibility. By documenting these failures, consumers now have a clearer picture of what to expect when exercising their privacy rights and can push for the improvements everyone deserves.