6 ms·
California residents can now request all data brokers delete personal info
- derektank 9mo agoThis was already the law, correct? The change here is that California now provides its own platform for submitting requests?
- repeekad 9mo agoCalifornia also requires data brokers to register with the state, creating the (intended) possibility of removing your info fully from all brokers all at once
- lazide 9mo agoOr these databrokers just won’t setup bank accounts or offices in the state and tell CA to go screw itself?
- Paracompact 9mo agoAs a Californian: I don't want their business.
- lazide 9mo agoYou aren’t their customer. You are their product.
- rl3 9mo agoAdditional context: https://cppa.ca.gov/regulations/pdf/20260101_ccpa_statute.pdf https://cppa.ca.gov/regulations/pdf/20260101_ccpa_statute.pd... https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_2026010... https://cppa.ca.gov/data_broker_registry/ https://cppa.ca.gov/data_broker_registry/ https://cppa.ca.gov/announcements/ https://cppa.ca.gov/announcements/ Here's hoping other states follow suit.
- ungreased0675 9mo agoI’d love to have a federal version of this.
- gtowey 9mo agoWhich will never happen in a million years with the current regime. Which is exactly why corporations put them there -- to ensure industry will not be regulated (unless you're not paying protection money).
- ungreased0675 9mo agoThe previous regime, and the one before that didn’t do it either, so I think the obstacle might be something more systemic.
- gtowey 9mo agoYes, the systemic issue is that money equals speech which means there is no way individual citizens can compete with the influence giant corporations can bring to bare. Essentially oligarchs own both parties and the media. One party is willing to be completely, nakedly, evil and the other is just trying to maintain the status quo. But even the status quo is pretty bad for most people these days.
- hellcow 9mo agoCloudFlare just decided I’m not a person, so I’m unable to access the website.
- usr1106 9mo agoThey decided that my niche phone's stock browser is not good for internet oligopolies.
- anonymousiam 9mo agoI'm feeling left out. I've got a house in California, but I'm no longer a resident. I wish this law was also applicable to me.
- Forgeties79 9mo agoBe a resident, pay the taxes, reap the benefits.
- nutjob2 9mo agoIf you have a house in CA they will tax you anyway so might as well.
- derektank 9mo agoYou also have to live somewhere for the majority of the year to be a resident. I would assume GP has responsibilities elsewhere that make it impossible to be a resident
- Forgeties79 9mo agoI would also like the benefits of places I am unable to reside in!
- lazzlazzlazz 9mo agoThe tax savings (let alone cost of living savings) of avoiding California for most readers of this comment would pay for a professional data removal service 100x.
- fragmede 9mo agoYeah, but then you don't get to live in California.
- Forgeties79 9mo agoI’d rather it be government enforced/my right and not a privilege I have to pay out the ass for, personally.
- nalekberov 9mo agoWhy data brokers are allowed to collect your data without an explicit consent in the first place is a question no one yet seems to address.
- yunnpp 9mo agoIndeed. The CCPA is welcome, but this explicit opt-out just means that only broccoli of the technical caliber that frequents HN will realistically benefit from the law. This needs to go a step further and make opt-out the default for all to benefit. And it is the social duty of the technical broccoli that understand these things that need to push this for everyone's benefit.
- kristianp 9mo agoAs one of the technical broccoli like you, I think this is a good sentiment, but it would be much harder to legislate.
- casper14 9mo agoGDPR works like this. You need consent to process data vs the US whwre its just a free for all
- PeterStuer 9mo agoIm theory yes. In practice, we have "legitimate interest".
- TheDong 9mo agoAre you willing to take a significant salary cut to benefit people? All the big tech companies, Google, Meta, Netflix, etc make a huge amount of money by using Ads to push things people don't need onto them, brainwashing people. This brainwashing is massively more effective with data-collection. If tech companies didn't hoard and sell people's data, the brainwashing would be less profitable, Google would pay lower salaries, and the entire industry's salaries would go down as a result. Salaries in the US might drop from ~$500k to $250k for an average software engineer. Would you be willing to take that sort of cut? You could also "vote with your feet" and move to europe where the GDPR protects everyone like you want, and your salary will drop to maybe $100k USD.
- puppycodes 9mo agoHow does this work over time? Do you have to keep submitting this every month as they recollect your info from databases in other states? Seems great in concept but I am skeptical this will change much. Data doesn't respect state lines.
- terminalshort 9mo agoI would assume so. It's sort of a catch 22 because if they delete your data, they have no way of knowing about you when they buy another batch of data. To have some sort of no track list, they have to keep your data. I'm also skeptical it will have any real effect. The law requires them to process deletion requests at a 45 day interval: > Data brokers are required to process deletion requests at least once every 45 days beginning August 1, 2026. But what if Broker A (based in CA) has a contract with Broker B, who doesn't do business in CA, to sync data once a day. Now Broker A will have your data on 44 out of 45 days and still be fully compliant with the law. Furthermore, it's not difficult to figure out when that 45 day interval comes up, so I would expect customers to figure that out and time their purchases accordingly.
- itsyonas 9mo ago> I would assume so. It's sort of a catch 22 because if they delete your data, they have no way of knowing about you when they buy another batch of data. To have some sort of no track list, they have to keep your data. They could store a normalised, hashed version of your data and use it to filter any incoming datasets. But, of course, why would they?
- terminalshort 9mo agoThat wouldn't really work because the hash key has to be both specific enough to be unique to you and also general enough to cover any incomplete data set that matches you.
- monerozcash 9mo ago
- pilastr 9mo agoThe webform can't be completed becaus erequired Date of Birth can only be input by selecting from a calendar widget which requires paging back 12 times per every year ylu've been alive. This is one more cynical bad faith ruse from advertisers.
- hcnews 9mo agoYou can go back by the year. Though I ended up hitting another roadblock down the road yesterday. So, I am currently waiting a couple of weeks for the flow to be functional.
- andrewbutts 9mo agoFWIW not true on safari on iOS, direct month entry works fine
- forks 9mo agoWorked fine on Safari on macOS.
- meroes 9mo agoThere’s a tiny blue arrow in the widget that lets you scroll to a year (iOS Firefox)
- AbstractH24 9mo agoCurious, practically speaking, how much does this impact people's lives daily? Asking as a non-ca resident.
- fragmede 9mo agoDepends on what kind of life you live, daily. If you're totally inoffensive and not being bold about anything, not interacting with people in meaningful way, such that no one could possibly be motivated to use the information to track you down and hurt you, then, practically speaking, you're too boring to be of note. But if you are interesting to someone. Maybe you're the other person in an affair, or you're active online in some sort of fashion; if you stick out in some way, then they, whomever you've pissed off, is gonna track you down thanks to such data leaks. Personally, an ex girlfriend just got into a fight with her latest beau, and for some reason I came up, and he was able to track me down to tell me exactly what he thought about I don't know what. Not having that information out there would make me safer when the woman at the bar I made out with turns out to be married to a jealous and violent police officer.
- deleted 9mo ago[deleted]
- yieldcrv 9mo agoor if you just don’t want manosphere, conspiracy, gender war and partisan echo chamber content, this is a way to reset the algorithm
- terminalshort 9mo agoThat is entirely based on first party activity history which is nothing to do with the data brokers.
- yieldcrv 9mo agoData brokers ensures you see the same content on other networks Even if your only activity was commenting in disagreement
- shadowgovt 9mo ago"Request," sure. Enforce?
- SilverElfin 9mo agoI feel like the definition of what counts as a data broker and also the idea of information “directly collected” will be abused. Regardless, it’s a good step. I would also like to see long term liability for security breaches, including lifelong compensation for identity theft and stuff. And for it to be applied retroactively.
- forks 9mo ago> Processing begins August 1, 2026.
- Guestmodinfo 9mo agoBy that time the data brokers might have sold off the data to others outside USA. may they already have. This is just US law, it will not affect India, China, Russia, etc data brokers
- magicalhippo 9mo agoThe word "request" sounds very passive, but it seems data brokers actually have to abide to be in accordance with the law?
- georgemcbay 9mo agoGlad this exists but skeptical about enforcement, particularly for any data broker hosting outside of the US. My phone number is on the national Do Not Call registry and that isn't stopping me from getting 1-2 calls a day from loan scam companies (and they are literally calling from a different phone number every time, so there's no real way to block them).
- terminalshort 9mo ago> Before submitting a deletion request, you will be required to verify you are a California “resident,” as defined in section 17014 of Title 18 of the California Code of Regulations as that section read on September 1, 2017. Verification is made with assistance from state contracted third-party vendors, including Socure and Login.gov, through the California Identity Gateway. I'm seeing a problem here...
- lionkor 9mo agoNo, see they are unhackable because they are government contractors. /s
- nolok 9mo agoIt really depends on the quality (strenght of the teeth, willingness to use it) of the regulator here; we have a lot of similar situation in EU/France and it's always a case that either it creates a new right or it creates a moat, depending on the enforcer.
- cogman10 9mo agoAh California. This is a very good example of the difference between a left policy and a liberal policy (actually neoliberal to be precise). The left policy would have been to have some agency within the california government which ultimately does the verification... because why would you outsource that task to a 3rd party? The neoliberal policy is "Well, we don't want to spend the time to set this up, so let's just pay 10 companies with some taxpayer money to do the job we really should do ourselves".
- terminalshort 9mo agoSo now the government has all my data and looks at it constantly to avoid it being available to private companies? Sounds like the worst situation possible.
- cogman10 9mo agoAll your data? No, just records of whether or not your a citizen/resident. That seems like pretty important data for any government to have. It's also information the state's records department likely already has. For example, if you have a drivers license with the state or you were born in the state they'll have that documentation. Unless you are just an anarchist, then I can't see how it's unreasonable for a government to know who it represents. That's why governments do censuses. Heck, that's needed just for the basic function of making sure you aren't voting in multiple districts.
- tartoran 9mo agoI still think data brokers will not fully delete the data and would make it available or sell it elsewhere. Data should not be in the hands of these companies in the first place but I guess the cat's out of the bag. They should not collect data deemed sensitive and they should be fined heavily at least to deter wrongdoing.
- temp0826 9mo agoMuch of the data is just scraped from public records that aren't going away. (Yes, collection/resale of those records should be restricted...there is good reason for some types to at least be available)
- jmward01 9mo agoI love the idea. A few thoughts though: - This needs teeth and they should inform you of what to do if you find out they ignored the request and what penalties they will receive. Tell people they can aid in the enforcement and I bet they will. - I understand why the residency requirement is there but it just bums me out. - The language is wrong. People are people, not 'consumers': "...In addition, the consumer must first have their residency verified as described in the Use of DROP section above..."
- dongkyun 9mo ago"consumer" is the language in the CCPA (which had its origins in a ballot initiative); most general privacy laws in the states are designed as consumer protection laws rather than civil rights like in the EU.
- throwawayqqq11 9mo agoI always wondered about a possible loophole in opt-out. Could you create legal entities fast/cheap enough and delay compliance long enough so that any private data, requested for deletion, can be transfered from the old opted-out entity to the new one, over and over again? This could render the entire opt-out approach useless, right? Because in order to reach your goal of deletion, you must get ahead of the transfer curve.
- mahirsaid 9mo agoI don't see them being on the resident's side when it comes to something as valuable as data. I agree with you on this. They'll play the loop hole long enough that by then your data has conjoined and transverses into some other data: it has served it's purpose.
- ChrisArchitect 9mo ago[dupe] Discussion: https://news.ycombinator.com/item?id=46449694 https://news.ycombinator.com/item?id=46449694
- alsetmusic 9mo agoI tried this yesterday (Saturday). I went through two pages of forms and two rounds of SMS 2FA only for it to reject the 2FA codes on the second page. I gave up because I try not to allocate too much energy toward fighting losing battles.
- userbinator 9mo agoThis is a dangerous precedent for the boundaries of ownership.
- lunias 9mo agoThere is only one sensible default, and that is opt-in. Requiring submission of a request to opt-out is never an acceptable solution.
- brian_spiering 9mo agoI signed up for it (took about 5 minutes). I'm cautiously optimistic about it having positive return on that investment. One of the best things I have done is sign up for DMAchoice and optoutprescreen.com which has completely stopped junk mail for me.