California’s DROP Tool: Take Back Your Data from Brokers & Defend Online Anonymity
Featured image: Photo by Dan Nelson on Pexels.
In an increasingly digital world, our personal information is constantly being collected, analyzed, and traded by entities often referred to as data brokers. These companies operate largely behind the scenes, compiling vast profiles on individuals from various sources and then selling that data to third parties. For residents of California, however, a powerful new tool has emerged to help regain control over this personal data and bolster online privacy: the Delete Request and Opt-out Platform, or DROP. This innovative system represents a significant step forward in simplifying the complex process of asserting your digital rights, offering a streamlined way to tell hundreds of data brokers to delete your information and cease its sale.
The Pervasive Reach of Data Brokers
Data brokers are businesses whose primary function is to collect personal information from a myriad of sources, repackage it, and then sell or share it. This information can range from identifying details like your name, address, phone number, and email to more sensitive data such as precise geolocation, browsing history, and even inferences about your political views, health status, or financial habits [1]. The sheer volume and variety of data collected enable these brokers to create incredibly detailed profiles on individuals, often without their direct knowledge or consent. This vast network of data exchange makes it incredibly difficult for individuals to track who holds their information, let alone request its deletion or opt-out of its sale.
The risks associated with this unchecked data collection are substantial. Your information can be sold to spammers, leading to an influx of unwanted emails and phone calls. It can also fall into the hands of predatory companies, scammers, or even stalkers. Furthermore, every company that holds your personal data represents a potential vulnerability; a breach at any one of these firms could expose your sensitive information, compromising your personal cybersecurity [1]. Before tools like DROP, attempting to manage these privacy risks required a tedious, time-consuming process of contacting each data broker individually, a task so daunting that most people never even began.
Introducing California’s DROP Tool
Recognizing the immense challenge individuals faced in exercising their privacy rights, California developed the Delete Request and Opt-out Platform (DROP). Launched on January 1st, this tool is designed to simplify the process of telling data brokers to delete your information and stop selling or sharing it. A single DROP request, once submitted, sends instructions to all data brokers registered in the state of California. As of its initial rollout, this single request reaches an impressive 614 registered brokers, significantly cutting down on the individual effort previously required [1].
The creation of DROP was a direct result of advocacy for the Delete Act, a law aimed at making California’s privacy regulations more user-friendly. While companies had until August 1st to begin fully complying with requests, the system is now fully operational. Upon receiving a request, data brokers are given 45 days to address it, providing a clear timeline for compliance. This centralized platform not only makes it easier to submit requests but also ensures that these requests reach a broad spectrum of companies that actively trade in personal data, making it a powerful mechanism for privacy protection [1].
How DROP Empowers You
Filing a request through the DROP tool offers several tangible benefits for California residents. Firstly, by removing your information from data broker lists, you can expect a noticeable decrease in unwanted communications, such as spam emails, telemarketing calls, and junk mail [1]. This reduction in unsolicited contact can significantly improve your daily digital experience and reduce the nuisance of constant marketing attempts.
Secondly, reducing the number of companies that possess your personal information directly enhances your personal cybersecurity. Each firm holding your data represents a potential point of failure; fewer entities with access to your details means fewer opportunities for your information to be exposed in a data breach. This proactive step can safeguard you against identity theft and other forms of digital harm [1]. Most importantly, DROP provides you with an opportunity to exert greater control over how your personal information is collected, used, and shared. In an era where data is constantly being harvested and monetized, reclaiming agency over your digital footprint is a fundamental aspect of privacy. It prevents data brokers from selling your private information to entities that might use it for predatory purposes, ranging from aggressive sales tactics to more malicious activities [1].
What Data Can Be Deleted (and What Can’t)
The California Privacy Protection Agency, which oversees the DROP platform, provides clear guidelines on what types of data are covered by a deletion request. Generally, a DROP request targets identifying information such as your Social Security number, precise geolocation data, web browsing history, email address, and phone numbers. Beyond explicit identifiers, the request also aims to delete inferences that data brokers may have made about you based on your collected information, including guesses about your political views or health conditions, such as pregnancy or chronic illness, often derived from purchase histories or browsing patterns [1].
However, it’s important to understand that not all information can be deleted through DROP. Certain data, particularly information that is already a matter of public record, such as vehicle ownership or real estate holdings, is exempt from these deletion requests. These types of records are publicly accessible and therefore fall outside the scope of what data brokers can be compelled to delete. Additionally, if there’s a specific data broker you wish to allow to retain and sell your data, the system also offers an option to exclude them from your request [1].
Navigating the DROP Request Process
To initiate a DROP request, California residents should visit the California Privacy Protection Agency’s official DROP website. Before starting the process, it’s advisable to gather certain pieces of information that may be requested, such as your advertising ID or your Vehicle Identification Number (VIN), if you wish for this specific data to be removed from data broker databases [1].
When filing a request, you will be asked to provide some personal information, including your name, address, phone number, and email address. While there might seem to be an irony in providing personal data to request its deletion, this information is necessary for the agency to verify your identity and ensure that you are the legitimate individual making the deletion and opt-out request. The agency itself is bound by its terms of service, which explicitly state that it will not sell or share this verification information for other purposes. It is also possible to file a request on behalf of someone else, such as an elderly relative who may be overwhelmed by junk mail, provided you can attest that they are a California resident [1]. Once your request is filed, you will receive a unique DROP ID, which can be used to check the status of your submission. Keeping this ID in a safe place is recommended for future reference [1].
Beyond a Single Request: Sustaining Your Privacy Efforts
While the DROP tool is incredibly powerful, it’s crucial to understand that filing a single request is not a permanent solution for all your privacy concerns. The opt-out of sale request should last indefinitely, preventing brokers from selling the data they currently hold. However, California’s privacy laws generally allow companies to continue collecting new information without explicit permission in most cases. This means that data brokers are likely to continue gathering new data to build profiles on you, albeit with less existing data and limitations on its use after an opt-out request [1].
Furthermore, new data brokers may register with the state after you’ve filed your initial request, meaning they wouldn’t have received your original instruction. It’s also important to remember that DROP specifically targets registered data brokers and does not prevent other companies, like major tech platforms, from collecting and sharing your personal information. Therefore, integrating periodic updates to your DROP request into a broader strategy for managing your digital footprint is a wise approach. Consider making it a regular practice, perhaps annually, to ensure your privacy preferences are continually enforced [1].
The Broader Fight for Online Anonymity
The introduction of the DROP tool highlights a wider ongoing struggle for online anonymity and control over personal data. Beyond data brokers, various entities are constantly collecting information about individuals’ online activities. For instance, the use of automated tools to access and collect public web data, often referred to as web crawlers, plays a significant role in how information is gathered across the internet. While some argue for unmasking these tools, anonymous crawling is crucial for beneficial activities such as investigative journalism, academic research, and cybersecurity protection [2]. Efforts to restrict such anonymity, like certain legislative proposals, could stifle important public interest work and undermine the open web by allowing websites to block researchers or critics [2].
Moreover, the privacy landscape extends to the devices we use every day. Recent revelations, such as the discovery that a significant percentage of apps on LG smart TVs could turn user televisions into always-on residential proxy nodes, demonstrate how personal devices can be unwittingly co-opted for third-party internet traffic [3]. These examples underscore the multi-faceted nature of data privacy challenges and the importance of both user vigilance and robust tools like DROP to safeguard personal information in an interconnected world.
The Path Forward: Stronger Privacy Laws and Personal Vigilance
California’s DROP tool stands as a landmark achievement in empowering individuals to manage their digital privacy. By streamlining the process of requesting data deletion and opting out of data sales, it addresses a significant pain point for consumers. However, DROP is also a reminder that the fight for comprehensive privacy protection is ongoing.
Sources
- [1] Protect Your Privacy with California's DROP Tool (www.eff.org)
- [2] “Stealth Crawlers” Are Not a Threat to the Open Web. Bills Targeting Them Would Be. (www.eff.org)
- [3] LG to Ban Residential Proxies from Smart TV Apps (krebsonsecurity.com)
StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.
