California's data and privacy laws aren't being followed

Key takeaways

California’s Delete Act aims to streamline data deletion requests through the Drop system, but compliance among data brokers remains low.
Dark patterns are used by some companies to hinder consumers’ efforts to control their data.
Increased enforcement by California authorities is beginning to address non-compliance, but more systemic measures are needed.
A private right of action could empower consumers to enforce privacy laws through class actions.
The growth of AI and data-driven technologies increases the importance of robust data privacy protections for consumers.

Summary

California's Data Privacy Laws and Compliance Challenges

This section discusses California’s comprehensive data privacy protections and the challenges in their enforcement. Despite the implementation of the Delete Act in 2024, requiring data brokers to register and provide consumers a way to request data deletion, a Stanford report reveals that only 9% of data brokers are complying. The report also highlights 'dark patterns'— tactics used by companies to make data request processes difficult and opaque. The California Privacy Protection Agency has increased enforcement efforts, targeting non-compliant brokers. The episode emphasizes the importance of these laws in giving consumers better control over their personal data.

The Drop System and Its Impact on Data Privacy

This section explains the Drop system introduced by California’s Delete Act, which allows consumers to make a one-time request to delete their data across multiple data brokers. Once registered, consumers are no longer required to make individual requests to each broker, simplifying the process and reducing time and effort involved. The system is designed for mass-scale data removal, with over 450,000 registrations since its launch in January. This initiative aims to significantly affect the data ecosystem by removing vast amounts of consumer data from being exploited, especially in AI development and targeted advertising.

Policy Recommendations and Future Outlook for Data Privacy Enforcement

This section explores potential policy improvements suggested by Jennifer King, a privacy policy expert. She advocates for a private right of action within California’s law, allowing consumers or groups to pursue class action lawsuits against non-compliant companies, which could strengthen enforcement beyond regulatory agencies alone. The discussion also covers the broader context of federal privacy laws and the growing influence of AI on data privacy, including concerns about AI companies purchasing user data for ad targeting and AI model training. The episode underscores the need for stronger consumer protections and more effective enforcement mechanisms.

Show notes

California promised consumers an easier way to protect their personal data. Since 2024, the Delete Act has required the state registration of data brokers — businesses that collect and sell personal data from our digital footprints — and it also mandates they give consumers a way to request their data be deleted and report how many requests they get.

But, a new Stanford report shows registered data brokers are largely ignoring the laws. Jennifer King, privacy and data policy fellow at Stanford's Institute for Human-Centered AI, says only 9% of data brokers are in compliance.

More on this:

“Regulating Data Brokers in the Age of AI: A California Case Study” from Stanford’s Institute for Human-Centered AI

“About DROP and the Delete Act” from the California Privacy Protection Agency