Consumer Beware! Exploring Data Brokers' CCPA Compliance

TL;DR

This study systematically evaluates CCPA compliance across all 543 California-registered data brokers by submitting Verifiable Consumer Requests (VCRs) to assess burden, verification, response timelines, and data delivery. Using a single researcher, the work documents substantial non-compliance, with roughly half of brokers failing to respond and many responses providing little or no PI about the requester. Among those that did respond, data delivery varied, including cases of sensitive PI exposure and even third-party leakage, revealing privacy risks intrinsic to the VCR process. The findings highlight significant enforcement gaps, a lack of standardization in VCR procedures, and a privacy paradox where exercising rights can paradoxically increase exposure risk, underscoring the need for standardized processes, stronger oversight, and clearer consumer remedies.

Abstract

Data brokers collect and sell the personal information of millions of individuals, often without their knowledge or consent. The California Consumer Privacy Act (CCPA) grants consumers the legal right to request access to, or deletion of, their data. To facilitate these requests, California maintains an official registry of data brokers. However, the extent to which these entities comply with the law is unclear. This paper presents the first large-scale, systematic study of CCPA compliance of all 543 officially registered data brokers. Data access requests were manually submitted to each broker, followed by in-depth analyses of their responses (or lack thereof). Above 40% failed to respond at all, in an apparent violation of the CCPA. Data brokers that responded requested personal information as part of their identity verification process, including details they had not previously collected. Paradoxically, this means that exercising one's privacy rights under CCPA introduces new privacy risks. Our findings reveal rampant non-compliance and lack of standardization of the data access request process. These issues highlight an urgent need for stronger enforcement, clearer guidelines, and standardized, periodic compliance checks to enhance consumers' privacy protections and improve data broker accountability.

Figures (9)

• Figure 1: Map of US $\sf{\mathcal{DBR}s}$.
• Figure 2: VCR submission methods.
• Figure 3: Time needed to submit VCRs.
• Figure 4: Questions from a questionnaire in a form-VCR.
• Figure 5: Distribution of answer categories received from $\sf{\mathcal{DBR}s}$.