California's data and privacy laws aren't being followed

概览

This episode focuses on California’s DELETE Act and whether data brokers are complying with the state’s privacy requirements. Host Megan McCarty-Carino interviews Jennifer King of Stanford’s Institute for Human-Centered AI about a new Stanford report finding that registered data brokers are largely ignoring key obligations.

The main conclusion is that California has unusually strong consumer privacy protections, but enforcement and usability remain major weak points. The report found only 9% of registered data brokers in compliance, with some companies adding friction to deletion request processes or failing to report required statistics.

The conversation then turns to the DELETE Act’s DROPS system, which is designed to let consumers submit one centralized deletion request across data brokers. King frames this as potentially transformative because it could remove large amounts of personal data from the broker ecosystem at scale.

The final section connects data broker regulation to AI. King says California’s registry now requires brokers to indicate whether they sell data to generative AI developers, and she warns that AI companies may replicate the consumer ad-targeting ecosystem as they seek revenue.

分段落总结

[00:31] California’s Privacy Law And Data Broker Compliance

[事实] California is described as having the country’s most comprehensive data privacy protections. [事实] Since 2024, the DELETE Act has required state registration of data brokers and requires them to provide deletion request mechanisms and report request statistics. [事实] A Stanford report found that registered data brokers are largely ignoring the law. [事实] Jennifer King says only 9% of data brokers are in compliance.

[01:31] Dark Patterns In Deletion Requests

[事实] King says companies added friction to rights request processes even though they are technically not allowed to do so. [事实] Examples included extra captchas, asking for more data than needed, making forms harder to submit, and failing to report required statistics. [推测] These tactics may discourage consumers from exercising privacy rights even when those rights exist on paper.

[02:04] Why Brokers May Risk Noncompliance

[事实] King says data brokers may be gambling on whether they will actually be investigated by California’s privacy agency. [事实] California’s privacy agency has devoted significant resources to data broker sweeps. [事实] The agency recently fined two brokers that failed to register at all. [事实] King says the agency has not yet shown investigations into the specific practices highlighted in the Stanford report.

[02:50] The DROPS System As A One-Stop Deletion Tool

[事实] The DELETE Act created the DROPS system, a centralized platform for consumers to send deletion requests to all data brokers at once. [事实] King describes DROPS as a potential game changer for data rights. [事实] Without DROPS, consumers usually have to contact companies one by one to request deletion or limit sale of personal information. [事实] King says the process is time-consuming, repetitive, and not something people want to do individually. [推测] Centralizing deletion requests could make privacy rights more practical for ordinary consumers.

[04:14] Persistent Opt-Outs And Scale

[事实] King says users sign up once through DROPS rather than returning multiple times a year. [事实] Data brokers must check the system every 45 days for new sign-ups. [事实] King says the system is more or less persistent after data is deleted. [事实] She says there were more than 450,000 registrations after sign-ups began in January. [推测] If registrations reach the millions, the system could materially shrink the amount of consumer data available in the broker ecosystem.

[06:04] Strengthening Enforcement Through Private Lawsuits

[事实] King says California’s privacy law cannot be weakened and can only be strengthened. [事实] She says the report recommends adding a private right of action to California’s privacy law. [事实] Currently, consumers who believe a company has not honored their data rights must complain directly to CalPrivacy. [事实] King argues that class action suits could help enforce the law at larger scale because regulatory agencies have limited resources. [事实] She says the United States does not have federal consumer privacy rights.

[07:43] AI Developers And Brokered Personal Data

[事实] King says the DELETE Act now requires the registry to indicate which data brokers sell data to generative AI developers. [事实] She says researchers have suspected that companies continue buying individual-level data for AI development, but the scope has been unclear. [事实] King says some newer AI companies are looking toward advertising and consumer-facing business models. [推测] She believes data purchased by AI companies may be used for ad targeting or targeting particular individuals. [推测] King sees the beginning of the consumer ad-targeting ecosystem being replicated among new AI developers.

播客点评/总结

This episode is valuable because it turns a technical privacy law into a concrete enforcement story: consumer rights exist, but data brokers may still evade them through friction, non-reporting, and risk calculations around enforcement.

Its strongest section is the explanation of DROPS. The interview clearly shows why one centralized deletion request could matter more than individual forms scattered across hundreds of companies.

A limitation is that the discussion relies mainly on the Stanford report and King’s interpretation; the episode does not include responses from data brokers or California regulators beyond references to enforcement actions.

[推测] This episode is best suited for listeners interested in consumer privacy, platform regulation, data brokerage, and the way AI business models may intersect with personal data markets.