Data Brokers & Privacy: Why Your Deletion Request Goes Unanswered

Post Views: 3

Most data brokers will not disclose the outcome of deletion requests, highlighting systemic issues in consumer data privacy enforcement.

Understanding Data Brokers and Privacy Concerns

Data brokers compile extensive personal information on the majority of U.S. adults and distribute it to entities such as employers, landlords, insurance providers, and government agencies. California residents have legal mechanisms to challenge this practice by requesting the removal of their data or the cessation of its sale.

Study Methodology and Findings

A research team from the University of California, Irvine, investigated the effectiveness of these procedures by submitting deletion and opt-out requests to all accessible brokers listed in California’s public registry during late 2025. The study involved 322 deletion requests and nearly 360 opt-out requests, using fabricated identities to avoid involving real individuals.

Submission of Requests

The majority of brokers failed to respond to deletion requests within the mandated 45-day period, leaving consumers without confirmation of whether their data was deleted or if the request was acknowledged. Approximately 70% of brokers provided no response, while opt-out requests saw slightly better engagement, with about 25% receiving some form of acknowledgment.

Response Rates and Compliance Issues

However, many brokers missed the 15-business-day deadline for processing opt-outs, despite legal requirements to provide verification methods. Overall response rates ranged from 26% to 38%, with the most common consumer actions yielding the least accountability. A parallel study using real individual data achieved a 57% response rate, highlighting a discrepancy in how different request types are handled.

Legal Framework and Violations

The California Consumer Privacy Act (CCPA) explicitly prohibits data brokers from requiring identity verification for opt-out requests, as the process is designed to minimize barriers. Nevertheless, 22% of brokers in the study demanded proof of identity, violating the regulation. Additionally, many brokers requested excessive personal information beyond what is necessary for verification.

A financial penalty underscored the severity of these violations when the California Privacy Protection Agency fined Ford Motor Company $375,703 for introducing unnecessary hurdles in its opt-out process. Brokers that impose similar requirements risk facing similar consequences.

Alarming Behaviors and Data Exposure

Some brokers exhibited more alarming behavior than mere silence. Three entities sent targeted marketing materials to addresses linked to the fabricated identities after receiving privacy-related requests. The CCPA mandates that data shared during a request be used solely for fulfilling that specific action.

Data Exposure Incidents

One broker confirmed a deletion request but attached a sample of its consumer records, which contained details about real individuals, resulting in an unintentional data exposure. Another broker responded to an opt-out request with a webpage stating the user had already opted in, offering no resolution or explanation.

Limitations of the Study

The study’s use of fabricated identities introduced a critical limitation. Since no actual records existed for these personas, the research focused on procedural compliance rather than the fate of real data. Brokers with no information to delete could not confirm removal, leaving questions about the effectiveness of legal mechanisms in addressing real-world data retention.

New Tools and Future Solutions

A new tool introduced in August 2026, the Deletion Request and Opt-out Platform (DROP), aims to address these challenges. Launched in early 2026, the platform allows California residents to submit a single request that applies to all data brokers, potentially streamlining the process and improving accountability.

Conclusion and Call for Action

Data brokers routinely fail to inform consumers about the status of deletion requests, despite legal obligations. The study reveals systemic issues in compliance, including delayed responses, excessive verification demands, and unintended data exposures. While new tools like DROP offer potential solutions, the underlying challenges of transparency and enforcement remain unresolved. The findings underscore the need for stronger oversight to ensure that consumer rights under privacy laws are effectively upheld.