A recent test of 100 companies found that responding to privacy data requests under the California Consumer Privacy Act (CCPA) often leads to confusion or outright dead ends. One request to McDonald’s returned a 515-page report detailing app interactions, including predictions about the requester’s future orders.
Under the CCPA, which took effect in 2020, consumers have the right to access, delete, or opt out of the sale of their personal data. The author filed over 100 such requests to assess compliance, encountering inconsistent outcomes ranging from partial responses to outright deletions.
The findings highlight systemic gaps in how companies handle privacy requests, raising questions about enforcement and the practical effectiveness of the law.
