[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84746-en":3,"doc-seo-84746-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},84746,137441390410,"Hazel","https://ap-avatar.wpscdn.com/avatar/2000252f4ab5702993?_k=1776741390130283984",8,"Research & Report","Let My Data Go Data Brokers’ Compliance with Opt-Out and Deletion Requests","Data brokers collect extensive personal information about U.S. consumers, often without knowledge or consent, and sell it to employers, landlords, insurers, governments, and malicious actors—enabling discrimination, surveillance, identity theft, and stalking. Privacy laws like the CCPA grant opt-out and deletion rights, but exercising them is difficult. The study submits synthetic opt-out and deletion requests to all California-registered brokers and analyzes responses. Results show partial compliance, significant nonresponse, and CCPA-disallowed identity verification, alongside major disparities and heavy consumer burden.","Let My Data Go:  \nData Brokers’ Compliance with Opt-Out & Deletion Requests  \nElina van Kempen  \nUC Irvine  \nGene Tsudik UC Irvine  \nPragya Jhunjhunwala Mihir Raja  \nUC Irvine UC Irvine  \narXiv :2607 .04552v 1 [ cs .CR] 5 Jul 2026  \nAbstract  \nData brokers are a largely American phenomenon. They collect vast amounts of personal information about most adult U.S. consumers, mainly without the latter’s knowledge or consent. Accumulated data can be sold to anyone, including employers, landlords, insurance agencies, banks, governments (local, state, federal, and even foreign), as well as various malicious actors. This, in turn, enables discrimination, surveillance, identity theft, and stalking.  \nRecent regulations – such as the California Consumer Privacy Act (CCPA) modeled after EU’s General Data Protection Regulation (GDPR)– were introduced to bolster consumer privacy, e.g., the rights to: (1) opt-out of the sharing or selling one’s personal information,(2) delete one’s personal information, and (3) obtain a copy of that information. However, exercising these rights is not easy, as shown by our comprehensive study of the data broker ecosystem. We submitted both opt-out and deletion requests (using synthetic consumer identities) under the CCPA to all California-registered data brokers and investigated their responses and lack thereof.  \nWhile the majority seem to be compliant, a significant fraction is not and many failed to reply to (and/or acknowledge) consumer requests. Furthermore, some data brokers require intrusive consumer identity verification in order to exercise one’s opt-out rights, which is explicitly disallowed by the CCPA. There is also great disparity in the request submission process among data brokers as well as an extremely heavy (time & effort) overall consumer burden. This motivates an urgent need for streamlining and standardization of the consumer interface, stronger enforcement, and meaningful consequences for (especially sustained) non-compliance.  \n1 Introduction  \nData brokers are business entities that collect a wide variety of consumers’personal information, usually without the latter’s knowledge or consent, and sell that information to anyone willing to pay for it. It is estimated that there are over one thousand data brokersin the world, the majority of which are concentrated in the United States [14, 35] . In fact, the entire concept was “born” in the United States during the mid-to-late 1980-s.1  \nAnyone can buy consumer information from data brokers, including private individuals, as well as both foreign and domestic businesses and governments, including law enforcement and intelligence agencies. Data collected by data brokers ranges from relatively benign contact information to much more sensitive data, such as health, financial, and even precise geolocation.  \n1Perhaps unsurprisingly, it originated in the the State of Florida [17] .  \nIn recent times, a more dangerous trend has emerged: the U.S. Department of Homeland Security (DHS), particularly its Immigration and Customs Enforcement (ICE) branch, has been purchasing information about American consumers from data brokers. This has been widely reported, e.g., by the American Civil Liberties Union (ACLU) and the Electronic Frontiers Foundation (EFF) [32] . Although government agencies are not allowed to collect data about U.S. population, apparently they are not prohibited from buying it from commercial entities.  \nThus, data brokers pose a significant threat to consumers whose personal information is accumulated, then bought and accessed by numerous entites, some of which certainly do not have consumers’best interest in mind, to put in mildly. Meanwhile, many (perhaps most) consumers are unaware of: (1) who collects their personal information,(2) what exactly is being collected, and (3) what, and to whom, information is sold.  \nRecent privacy regulations across the world give consumers more agency over their personal information and guarantee c","cbCaimZRh1t9ubc4","https://ap.wps.com/l/cbCaimZRh1t9ubc4","pdf",759398,2,1,11,"English","en",105,"# Abstract\n# Introduction","[{\"question\":\"What rights do data privacy regulations like the CCPA provide to consumers regarding their data?\",\"answer\":\"The CCPA provides rights to opt out of selling or sharing personal information, delete personal information, and obtain a copy of it. These rights are intended to strengthen consumer privacy control.\"},{\"question\":\"How did the researchers test data brokers’ compliance with consumer requests?\",\"answer\":\"The researchers submitted opt-out and deletion requests using synthetic consumer identities to all California-registered data brokers under the CCPA, then examined the brokers’ responses and failures to respond.\"},{\"question\":\"What compliance problems did the study find among California-registered data brokers?\",\"answer\":\"A significant fraction failed to reply to and/or acknowledge requests. Some brokers required intrusive identity verification to exercise opt-out rights, which the CCPA explicitly disallows, and the process varied widely while imposing heavy effort on consumers.\"}]",1784198013,28,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"let-my-data-go-data-brokers-compliance-with-opt-out-and-deletion-requests","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,47,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":20},"https://docshare.wps.com/document/","Document",{"item":48,"name":12,"@type":43,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/let-my-data-go-data-brokers-compliance-with-opt-out-and-deletion-requests/84746/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-23","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What rights do data privacy regulations like the CCPA provide to consumers regarding their data?","Question",{"text":75,"@type":76},"The CCPA provides rights to opt out of selling or sharing personal information, delete personal information, and obtain a copy of it. These rights are intended to strengthen consumer privacy control.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How did the researchers test data brokers’ compliance with consumer requests?",{"text":80,"@type":76},"The researchers submitted opt-out and deletion requests using synthetic consumer identities to all California-registered data brokers under the CCPA, then examined the brokers’ responses and failures to respond.",{"name":82,"@type":73,"acceptedAnswer":83},"What compliance problems did the study find among California-registered data brokers?",{"text":84,"@type":76},"A significant fraction failed to reply to and/or acknowledge requests. Some brokers required intrusive identity verification to exercise opt-out rights, which the CCPA explicitly disallows, and the process varied widely while imposing heavy effort on consumers.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]