I asked 100 companies for my data. Some deleted it instead.
I asked 100 companies for my data. Some deleted it instead.
我向 100 家公司索取我的个人数据，结果有些公司直接把它删了。
I filed a request with McDonald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning 515-page report a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there. 本月初，我向麦当劳提交了一份请求，要求获取这家快餐公司收集的关于我的所有个人数据。几天后，我收到了一份长达 515 页的惊人报告，其中详细记录了我在其应用程序上的互动细节，甚至预测我永远不会停止在那里用餐。
Under the California Consumer Privacy Act, I have the legal right to request access to information from large companies that collect personal data. So I was curious what others might have on me, and I spent the next week filing more than 100 requests. 根据《加州消费者隐私法》（CCPA），我有权要求收集个人数据的大型公司提供相关信息。出于好奇，我想知道其他公司掌握了我哪些信息，于是我在接下来的一周里提交了 100 多份请求。
The CCPA went into effect in 2020, and three of its key provisions are the right to opt out of the selling of personal information, the right to delete that info, and the right to request a copy for yourself. I focused solely on the latter—access requests—to better understand what data is being collected. CCPA 于 2020 年生效，其三个关键条款包括：拒绝出售个人信息的权利、删除个人信息的权利，以及要求获取个人信息副本的权利。我只专注于后者——即“访问请求”，以便更好地了解这些公司究竟在收集什么数据。
Most companies must list two ways for you to file. These are often via a web form, phone number, or email address, as designated in their privacy policy. After you submit a request, companies can take 45 days to complete it. 大多数公司必须提供两种提交请求的渠道。正如其隐私政策中所述，这些渠道通常包括网页表单、电话号码或电子邮件地址。在提交请求后，公司有 45 天的时间来处理。
My experience placing these data access requests was incredibly time-consuming, from finding the right filing methods to verifying my identity multiple times. Most exasperating during this process were the companies that either responded to my access requests with messages concerning the deletion of information, which I explicitly said not to do, or refused to process the request through a method listed in their privacy policy. 在提交这些数据访问请求的过程中，我耗费了大量时间，从寻找正确的提交方式到多次验证身份，过程极其繁琐。最令人恼火的是，有些公司在收到我的访问请求后，要么回复说正在删除我的信息（而我明确要求不要这样做），要么拒绝通过其隐私政策中列出的方式处理我的请求。
Consumer advocates I spoke with were upset with how these requests were handled. “That’s crazy,” said Ben Winters, director of AI and privacy at the Consumer Federation of America. “That’s not an acceptable status quo.” Winters sees these examples as exhibiting the weaknesses of policy frameworks that rely on companies to act responsibly and in good faith. 我采访的消费者权益倡导者对这些请求的处理方式感到不满。“这太疯狂了，”美国消费者联合会人工智能与隐私部门主任本·温特斯（Ben Winters）表示，“这种现状是不可接受的。”温特斯认为，这些案例暴露了那些依赖公司自觉履行责任和诚信的政策框架所存在的缺陷。
In accordance with WIRED’s policies, I am disclosing that I used generative AI to draft bureaucratic emails and update my tracking spreadsheet as part of this report. I wrote the body of this article mainly by hand in my scratch notebook. 根据《连线》（WIRED）的政策，我在此披露：在撰写本报告的过程中，我使用了生成式人工智能来起草官僚化的电子邮件并更新我的追踪电子表格。而本文的正文主要是我在草稿本上手写的。
One of the first errors came from Crunchbase, known for its database about tech startups. I emailed my access request to its privacy address on August 17. My message laid out the rights I wanted to exercise and included a direct request not to erase anything: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” 最早出现的错误之一来自以科技初创公司数据库而闻名的 Crunchbase。8 月 17 日，我通过电子邮件向其隐私邮箱发送了访问请求。我在邮件中明确了我想行使的权利，并直接要求不要删除任何内容：“我目前不要求删除数据。请不要将其视为删除请求。”
I received a reply two days later from a Crunchbase support representative. “Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!” the message read in full. 两天后，我收到了 Crunchbase 一位支持人员的回复。邮件全文写道：“非常感谢您的耐心等待。您的账户已从 Crunchbase 永久删除。如果还有其他需要，请告诉我！”
I followed up via email almost immediately, reiterating that I wanted data access, not data deletion. “Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted,” read the follow-up support response explaining what happened. If I wanted to have a Crunchbase account, I would have to reregister. 我几乎立即通过电子邮件进行了跟进，重申我想要的是数据访问，而不是数据删除。随后的支持回复解释道：“您的 Crunchbase 用户账户已被删除。Crunchbase 上的其他数据并未删除。”如果我想要一个 Crunchbase 账户，就必须重新注册。
When I reached out to Crunchbase for comment, a spokesperson blamed the mistake on a “processing error” and said that the company would proceed with my original access request as filed. The spokesperson also claimed the misclassified response came from “a person on our customer success team” and not a generative AI tool. 当我联系 Crunchbase 寻求置评时，一位发言人将此错误归咎于“处理失误”，并表示公司将按照我最初提交的请求进行处理。该发言人还声称，那封分类错误的回复是“我们客户成功团队的一名员工”发出的，而非生成式 AI 工具所为。
My interactions with BeenVerified, a searchable database that gathers public records, also encapsulate my friction-filled experience placing these access requests. I emailed BeenVerified’s dedicated CCPA compliance address on the morning of August 19. It laid out that I was a California resident placing an access request, not a deletion request. 我与 BeenVerified（一个收集公共记录的可搜索数据库）的互动，也体现了我提交这些访问请求时充满阻碍的经历。8 月 19 日上午，我向 BeenVerified 专门的 CCPA 合规邮箱发送了邮件，说明我是加州居民，正在提交访问请求，而非删除请求。
You’ll never guess what happened next. Two days later, I received a message from a BeenVerified support representative about removing information. “It appears your person report has already been removed from our Person Search results,” read its initial response. “In addition, we have removed the requested phone number and email address from our search results. This change should be reflected within 24 hours.” 你绝对猜不到接下来发生了什么。两天后，我收到了一封来自 BeenVerified 支持人员关于删除信息的邮件。“看来您的个人报告已从我们的个人搜索结果中删除，”其初步回复写道，“此外，我们已从搜索结果中删除了您要求的电话号码和电子邮件地址。此更改应在 24 小时内生效。”
Not at all what I asked it to do. When I sent my next email explaining that I had submitted an access request, not a deletion request, the support representative followed up 15 minutes later, denying my claim and saying the company couldn’t verify my identity. That was perplexing, since it located some of my details earlier in the message thread and didn’t even attempt to explain what I might need to share for verification. 这完全不是我要求的。当我发送下一封邮件解释我提交的是访问请求而非删除请求时，该支持人员在 15 分钟后回复，否认了我的说法，并称公司无法验证我的身份。这令人困惑，因为他们在之前的邮件中已经定位到了我的一些详细信息，甚至没有尝试解释我需要提供什么来验证身份。
At my wit’s end, I sent another email explaining how confused I was feeling by these responses. “Please be assured that we’re able to process your opt-out request and have removed your information from our website,” read the support representative’s response. If I wasn’t already bald, I would have pulled out the rest of my hair at that moment. 我束手无策，又发了一封邮件，表达了我对这些回复的困惑。“请放心，我们已经处理了您的退出请求，并已从我们的网站上删除了您的信息，”支持人员回复道。如果我还没秃的话，那一刻我肯定会把剩下的头发都揪下来。
I found solace in chatting with an academic researcher who had previously helped place access requests with over 500 data brokers under the same California law and also encountered multiple misclassifications. “Sometimes I would make an access request, and the automatic answer was ‘We will opt you out’ or ‘We will delete your data,’” says Elina van Kempen, a PhD student at UC Irvine and coauthor of Consumer Beware! Exploring Data Brokers’ CCPA Compliance. While some data brokers followed up with corrections, other times the researcher was left without any resolution. 在与一位学术研究人员交谈时，我感到了一丝慰藉。她曾根据同一加州法律帮助向 500 多家数据经纪人提交过访问请求，也遇到过多次分类错误。“有时我提交访问请求，自动回复却是‘我们将为您退出’或‘我们将删除您的数据’，”加州大学欧文分校的博士生、报告《消费者当心！探索数据经纪人的 CCPA 合规性》的合著者埃琳娜·范·肯彭（Elina van Kempen）说。虽然一些数据经纪人随后进行了更正，但有时研究人员却得不到任何解决方案。
When I reached out to BeenVerified for comment, Greg Hammond, senior counsel and senior director of compliance at its parent company, claimed via email that support agents receive annual privacy training, including how to process CCPA requests. “Unfortunately, despite the training, the agent who handled this matter was mistaken and misunderstood the request type,” he wrote. 当我联系 BeenVerified 寻求置评时，其母公司的高级法律顾问兼合规高级总监格雷格·哈蒙德（Greg Hammond）通过电子邮件声称，支持人员每年都会接受隐私培训，包括如何处理 CCPA 请求。“遗憾的是，尽管接受了培训，但处理此事的代理人还是犯了错，误解了请求类型，”他写道。