John Gilmore knows how tough it is for people to scrub their personal data from the internet, even in California, where consumers have privacy rights.
“It’s a very labor-intensive process,” said Gilmore, who heads research at DeleteMe, a company that people can pay to remove their information from websites. “There’s no way for the average person to understand whether the efforts they’re making help or not.”
California was on the cutting edge when it passed a digital privacy law in 2018, but one of the protections it granted has proved difficult for people to use. Though the law gives Californians the right to ask businesses to delete their personal information, it requires making the request one at a time to potentially hundreds of companies. That has made it hard for people to erase their digital footprints, especially because the law has exceptions that allow businesses to deny a deletion request.
Legislation under consideration in Sacramento would make it easier by allowing consumers to make just one request to get every data broker to delete their personal information. Like so many tech policy battles in the state Capitol, it has set off a debate between consumer groups and privacy advocates who argue that Californians deserve more control over their information online, and tech companies and other big businesses that contend the modern economy is built on the flow of data to personalize advertising and other services.
Data brokers collect and sell people’s personal information including their address, age, marital status and occupation. These businesses include well-known credit reporting companies such as Equifax and Experian along with people search websites Spokeo and the Whitepages. But there are hundreds of data brokers that consumers might never have heard of, including those that work with political campaigns, law enforcement, marketers and small businesses. Roughly 500 data brokers are registered in California.
“There’s a lot of risks with our information being out there that people just aren’t aware of,” said Sen. Josh Becker (D-Menlo Park), who wrote Senate Bill 362 to allow consumers to make one request to get every data broker to delete their personal information. “It’s about giving people control of their personal information.”
The bill, known as the Delete Act, faces a critical vote this Friday as a variety of business groups whose members include tech companies, advertisers, political consultants and credit unions are working to kill it.
Supporters say personal data collected and sold by data brokers — including about people’s location — could be used against abortion seekers, undocumented immigrants and activists. Those who oppose SB 362 say data collection also has benefits, helping businesses serve more relevant ads, law enforcement solve crimes, academics conduct research and nonprofits collect donations.
“California consumers will be posed with this mechanism to delete all of their data and we’re concerned that they won’t fully recognize what all that means,” said Chris Oswald, executive vice president and head of government relations for the Assn. of National Advertisers.
The Consumer Data Industry Assn., which represents credit bureaus and background check companies, said the bill would make it tougher for businesses to quickly verify the identity of consumers. The group launched a website that included 15 reasons why businesses oppose the bill.
“In order for consumers to have free flow to the internet and purchases and transactions, it has to be instantaneous,” said Dan Smith, president and chief executive of the Consumer Data Industry Assn.
Under the legislation, consumers could exclude certain data brokers from their deletion request. Data brokers would be required to delete a consumer’s personal information at least once every 31 days. They would also be barred from selling data or sharing new personal information about the consumer.
Data brokers gather data through various sources including public records such as voter registration and social media posts. They also buy data from retailers and credit card providers that know a lot about their customers’ spending habits.
Gilmore said some of DeleteMe’s California consumers have complained that data brokers don’t respond to requests to delete their data. Companies can also drag out the process for weeks as they try to verify who is making the deletion request. Some of their customers want their data deleted because they’ve seen firsthand how their personal information can be misused, including for identity theft, stalking and harassment, he said.
The bill would make it easier for companies like DeleteMe to remove people’s personal information from data broker websites while encouraging people to get more actively engaged about their privacy, he said. DeleteMe supports the legislation. One step consumers can take, Gilmore said, is limit the amount of information they provide to businesses.
Lawmakers have tried to regulate data brokers before but have failed amid stiff opposition from business groups. Last year, a federal bill to allow people to delete personal information held by data brokers with a single request died, but lawmakers revived similar legislation in January. Becker also introduced a state bill last year that would require data brokers to disclose more information when they register with California, including whether they’ve been breached or collected data of minors. It died in committee.
Supporters of SB 362, including the bill’s sponsor Privacy Rights Clearinghouse, say the concerns of opponents are overblown and California would set a model for the U.S. and the rest of the world if it passed the legislation.
“It will certainly be a steep battle, but we’re optimistic,” said Emory Roane, policy counsel for the Privacy Rights Clearinghouse. “We think that there’s a real chance that this will get over the line and get to the governor’s desk.”
