EPIC, Consumer Reports File Comments Urging California Privacy Agency to Strengthen Its Delete Request and Opt-out Platform

EPIC and Consumer Reports submitted comments to the California Privacy Protection Agency responding to the Agency’s Notice of Proposed Rulemaking on its Delete Request and Opt-out Platform (DROP) System Requirements, recommending additional steps to make the requirements most effective. The Agency is creating the DROP, a publicly accessible universal deletion mechanism for consumers to request that data brokers delete their personal information. This is a strong step towards limiting some of the most harmful uses of personal information by data brokers who operate largely behind opaque practices with little oversight or regulation.

Consumer Reports and EPIC’s comments suggest that the mechanism include a broad definition of “direct relationship” which governs when a business that is selling consumers’ information to third parties would be considered a data broker under the law. We further suggest that the mechanism limit data leakage from sharing hashed identifiers. The Agency should also allow for authorized agents to assist consumers in the deletion of their records.

EPIC regularly urges the CPPA to strengthen privacy protections for consumers, including limits on the most harmful uses of personal information. EPIC advocates to reign in the abusive practices of data brokers, including through the use of data minimization and by advocating for greater transparency and oversight of how companies collect, use, and share personal information.