California's data and privacy laws aren't being followed

**SPEAKER_1** (0:00)
Running a business is hard enough, so why make it harder with a dozen different apps that don't talk to each other? Introducing Odoo, the only business software you'll ever need. It's an all-in-one, fully integrated platform that makes your work easier, from CRM, accounting, inventory, e-commerce and more. And the best part, Odoo replaces multiple expensive platforms for a fraction of the cost. This is why over thousands of businesses have made the switch. So why not you?
Try Odoo for free at odoo.com. That's odoo.com.

**Megan McCarty-Corino** (0:31)
California has the country's most comprehensive data privacy protections. If only companies would comply with them. From American Public Media, this is Marketplace Tech. I'm Megan McCarty-Corino.
California promised consumers an easier way to protect their personal data. Since 2024, the Delete Act has required the state registration of data brokers, businesses that collect and sell personal data from our digital footprints. It also mandates they give consumers a way to request their data be deleted and report how many requests they get.
But a new Stanford report shows registered data brokers are largely ignoring the laws. Jennifer King is a Privacy and Data Policy Fellow at Stanford's Institute for Human-Centered AI. She says only 9% of data brokers are in compliance.

**Jennifer King** (1:31)
We also found that the companies added friction to their rights request processes, which they are technically not allowed to do.
It's an area of research that we call dark patterns, and that's where they make it really difficult to navigate these forms. So things like adding extra captures, where they're not supposed to, requesting more data from you than you actually would need to fulfill a request, and in general, just making it harder for people to submit forms, as well as not reporting out the stats that they're also obligated to report.

**Megan McCarty-Corino** (2:04)
So why does it seem so hard to get these data brokers to comply?

**Jennifer King** (2:09)
Really, I think it's all about kind of trying to take that risk gamble of, will they actually be investigated by the state privacy agency? But what we've seen is that CalPrivacy has devoted significant resources to doing what they're calling data broker sweeps. So they really have stepped up enforcement, and just recently they announced they have fined two brokers that failed to actually register at all. We haven't yet seen the investigations around the types of activities we highlighted, but they are definitely starting at least with the folks that were obligated to be on the registry and who did not actually register.

**Megan McCarty-Corino** (2:47)
Now for this research, you were looking at compliance before the newest phase of California Privacy Law rolled out this year.
The Delete Act set up basically this one-stop shop where consumers can make these requests to all the data brokers at once using something called the DROP system, Delete Request and Opt Out Platform. Why is this so important?

**Jennifer King** (3:11)
This is potentially a game changer for data rights. Right now, anybody who's ever tried to ask not only a data broker, but any of the companies that you contribute data to, to delete your data, to limit the sale of your personal information, it's a one-by-one process. You can engage with some private companies who offer these services and they are allowed to do that under California law. But in general, it's a lot of time and it's a lot of work. When it's all of us having to take that time individually to do this type of work, which is not fun, nobody wants to do this. This is nobody's idea of a good time filling out these forms repeatedly and submitting them.
It limits the extent to which we can really have impact at scale on the data that's bought about us and sold and shared in ways that we're not generally aware of what's happening. What happens with a system like DROP is that you basically sign up once and that's it. You don't have to go back multiple times a year. The brokers have to respect that your sign up. They basically have to check it every 45 days to see if new people have signed up and it's more or less persistent. So once your data has been deleted, then you don't have to think about it again. So doing that at scale and the last I heard were up to over 450,000 registrations which they began in January.
Again, they're just starting to get actually processed. They opened the registry far in advance of the actual processing date. If we see in the millions potentially over the next few years, that's a lot of people and a lot of data that's being removed from this ecosystem.