I Asked 100 Companies for My Data. I Got Deletion Notices Instead

California gives consumers some of the strongest data-access rights in the United States. Actually using those rights can be another matter.

WIRED senior writer Reece Rogers recently filed more than 100 requests with companies asking to see the personal information they had collected about him. Under the California Consumer Privacy Act, California residents can request a copy of their personal information, ask for it to be deleted, and opt out of its sale or sharing.

Rogers was interested in the first of those rights. He wanted access.

Some companies apparently couldn't tell the difference.

Asking for Data and Getting an Account Deleted

Rogers had already received a remarkable 515-page report from McDonald's detailing information associated with his use of its app. Curious about what other companies held, he spent a week submitting access requests to more than 100 businesses.

The process quickly became an exercise in bureaucracy. Finding the correct request mechanism took time. Identity sometimes had to be verified repeatedly. Companies generally have up to 45 days to complete an access request, meaning even a properly functioning process is hardly equivalent to simply opening a file containing your own information.

Then things got stranger.

Rogers explicitly told Crunchbase that he was requesting access to his information and was not asking for deletion. Two days later, according to WIRED, he received a message telling him that his account had been permanently deleted.

Crunchbase later attributed the incident to a processing error and said it would continue with the original access request.

BeenVerified produced a similarly confused exchange. Rogers again asked for access rather than deletion, but received responses concerning the removal and opt-out of his information. An executive at its parent company subsequently told WIRED that the support agent had misunderstood the type of privacy request and that additional training and auditing would follow.

Cash App presented a different problem. Its privacy policy listed a telephone number as one method California residents could use to make an access request. Rogers called it, only to encounter support staff who appeared unsure how to process what he was asking for.

These aren't obscure technical distinctions. Access, deletion and opting out are different rights.

Having a Right Isn't the Same as Having Control

There is something revealing about needing to ask more than 100 separate organizations what they know about you.

Legally, the data may be subject to rights granted to you. Operationally, however, it exists inside databases, customer-service systems and compliance workflows controlled by somebody else.

That distinction matters.

We have spent much of the platform era treating digital ownership as a matter of permissions. A platform stores the information; the user receives certain rights concerning it. When everything works properly, those rights can be meaningful. When it doesn't, exercising them can turn into emails, forms, identity checks, support tickets and arguments over what you requested in the first place.

Rogers' experiment demonstrates the weakness of that arrangement unusually well. The problem wasn't simply that companies possessed information about him. The problem was that even discovering exactly what they possessed required asking each custodian individually and then relying on that custodian to correctly interpret the request.

That is a very different relationship from possessing something yourself.

Creators Have the Same Architectural Problem

For creators, this question extends beyond conventional personal data.

A working creator accumulates identity information, audience relationships, release histories, rights information, transaction records, permissions, provenance and commercial history across an expanding collection of services. A streaming service knows one part of the audience. A social network knows another. A commerce platform holds transaction history. A distributor maintains release information. Other services hold still more pieces.

Each platform may provide dashboards, exports or APIs. Those tools can be useful. But access supplied by a platform remains different from infrastructure controlled by the creator.

That distinction becomes particularly important when a creator wants to leave.

An audience of 100,000 followers can feel like an asset until the platform controls the accounts, graph and communication channel connecting them. Years of transaction history can be commercially valuable until access depends upon a vendor continuing to expose it. Identity itself can become fragmented across accounts that ultimately belong to different systems.

Using platforms isn't the problem. Allowing the platforms to become the only authoritative home of what you built is.

Start With Creator-Controlled Infrastructure

Certifyd Core approaches the problem from the opposite direction.

Rather than beginning with an account inside a centralized creator platform, Core is designed around creator-controlled infrastructure for establishing identity, works, provenance, permissions, release records, commerce and creator-fan relationships.

That doesn't mean creators should stop using platforms. Distribution services, social networks, marketplaces and streaming platforms can all remain valuable parts of a creator's business.

The difference is architectural.

A creator who establishes important assets under infrastructure they control can enter external platforms as a participant rather than treating each platform as the permanent custodian of their digital existence. Partnerships become connections to the creator's infrastructure instead of substitutes for it.

Rogers' experiment involved personal privacy rather than creator infrastructure, but it exposes the same underlying distinction remarkably well.

There is a difference between being granted rights to something stored inside somebody else's system and actually controlling the system where the important record begins.

The internet has spent decades making the first model normal.

Creators should be building toward the second.