“This research reveals a systemic failure to uphold the most basic obligations of privacy law,” said Bryan Cunningham, executive director of UCI’s Cybersecurity Policy & Research Institute. “When companies make it difficult—or even impossible—for people to see or delete their personal data, they’re not just skirting regulations. They’re violating consumer trust.”
The CCPA, enacted in 2018, was designed to give Californians more control over how their data is collected and used. Among its core features are the rights to know what data is being gathered, request deletion of personal information, and opt out of its sale to third parties. However, UC Irvine’s findings suggest that these legal protections may be more theoretical than practical.
The university’s research team conducted real-world consumer data requests—known as verifiable consumer requests (VCRs)—and documented each company’s response. In many cases, brokers demanded invasive forms of identification, such as selfies holding a government ID, before processing requests. In other cases, they didn’t respond at all or buried compliance procedures behind layers of hard-to-find web links and technical jargon.
“These tactics not only deter consumers from asserting their rights—they may actually be unlawful under the CCPA,” said Ian Kerr, a UCI legal researcher involved in the project. “It raises the question: what good is a privacy law if the average person can’t realistically use it?”
The implications are far-reaching. State regulators, including the California Privacy Protection Agency (CPPA), may face growing pressure to crack down on noncompliant data brokers and strengthen enforcement mechanisms. Privacy advocates are calling for tougher penalties and more aggressive auditing to ensure accountability.
