{"slug": "i-asked-100-companies-for-my-data-some-deleted-it-instead", "title": "I asked 100 companies for my data. Some deleted it instead.", "summary": "A WIRED reporter filed more than 100 data access requests under the California Consumer Privacy Act and found that some companies, including McDonald's, responded by deleting data instead of providing it, despite explicit instructions not to. Ben Winters, director of AI and privacy at the Consumer Federation of America, called the handling 'crazy' and 'not an acceptable status quo,' highlighting weaknesses in policy frameworks that rely on corporate good faith.", "body_md": "I filed a request with McDonald’s earlier this month to access all of the personal data the fast food company collected about me, and I received a stunning [515-page report](https://www.wired.com/story/mcdonalds-built-a-515-page-dossier-on-me-it-says-ill-never-leave/) a few days later that detailed my app interactions in granular detail and predicted I would never stop eating there.\n\nUnder the [California Consumer Privacy Act](https://www.wired.com/story/ccpa-guide-california-privacy-law-takes-effect/), I have the legal right to request access to information from large companies that collect personal data. So I was curious what others might have on me, and I spent the next week filing more than 100 requests.\n\nThe CCPA went into effect in 2020, and three of its key provisions are the right to [opt out](https://www.wired.com/story/data-brokers-and-ai-firms-opt-out-forms-are-built-to-fail-report-finds/) of the selling of personal information, the right to delete that info, and the right to request a copy for yourself.\n\nI focused solely on the latter—access requests—to better understand what data is being collected. Most companies must list two ways for you to file. These are often via a web form, phone number, or email address, as designated in their privacy policy. After you submit a request, companies can take 45 days to complete it.\n\nMy experience placing these data access requests was incredibly time-consuming, from finding the right filing methods to verifying my identity multiple times. Most exasperating during this process were the companies that either responded to my access requests with messages concerning the deletion of information, which I explicitly said not to do, or refused to process the request through a method listed in their [privacy policy](https://www.wired.com/story/guide-protect-data-from-hackers-corporations/).\n\nConsumer advocates I spoke with were upset with how these requests were handled. “That’s crazy,” said Ben Winters, director of AI and privacy at the [Consumer Federation of America](https://consumerfed.org/). “That’s not an acceptable status quo.” Winters sees these examples as exhibiting the weaknesses of policy frameworks that rely on companies to act responsibly and in good faith.\n\nIn accordance with [WIRED’s policies](https://www.wired.com/about/generative-ai-policy/), I am disclosing that I used generative AI to draft bureaucratic emails and update my tracking spreadsheet as part of this report. I wrote the body of this article mainly by hand in my scratch notebook.", "url": "https://wpnews.pro/news/i-asked-100-companies-for-my-data-some-deleted-it-instead", "canonical_source": "https://arstechnica.com/tech-policy/2026/08/i-asked-100-companies-for-my-data-some-deleted-it-instead/", "published_at": "2026-08-29 10:50:31+00:00", "updated_at": "2026-08-29 11:17:57.345645+00:00", "lang": "en", "topics": ["ai-policy"], "entities": ["WIRED", "McDonald's", "California Consumer Privacy Act", "Ben Winters", "Consumer Federation of America"], "alternates": {"html": "https://wpnews.pro/news/i-asked-100-companies-for-my-data-some-deleted-it-instead", "markdown": "https://wpnews.pro/news/i-asked-100-companies-for-my-data-some-deleted-it-instead.md", "text": "https://wpnews.pro/news/i-asked-100-companies-for-my-data-some-deleted-it-instead.txt", "jsonld": "https://wpnews.pro/news/i-asked-100-companies-for-my-data-some-deleted-it-instead.jsonld"}}