Let’s talk about the one form that is supposed to delete you from the data broker industry — and everything it still cannot reach.
Picture a man who moved house eighteen months ago. Same city, new number, new address. And the calls follow him anyway. Insurance, solar, a debt collector looking for a name that sounds a lot like his, a recruitment agency that somehow knows what he earns. He has never spoken to any of these companies. He has never signed anything. But he is in their systems with his old street, his ID number, and a reasonable guess at his income band.
He can ask any one of them to delete him. That is the part people assume they already have. What he cannot do is find out how many of them there are.
That was the whole business model. You cannot exercise a right against a company you do not know exists.
Now something real changed. In California, the Delete Act — SB 362 — took the old individual deletion right and industrialised it. The law required the state’s privacy agency to stand up a single deletion mechanism by the start of this year. One form. One request. It propagates to every data broker registered in the state, and those brokers have to act on it on a rolling cycle instead of waiting for him to chase them one by one.
That is a genuine improvement and I’m not going to be cute about it. For the first time in a serious jurisdiction, the burden of the deletion request sits on the industry instead of on the person. That is how a right is supposed to work.
But here is what people are missing, and it is the entire episode.
The register is self-declared.
The mechanism can only reach brokers who registered. Enforcement sweeps by the state’s privacy agency keep surfacing companies trading in personal data that never registered at all. Which means the operations with the least interest in the rules are also the furthest outside the machinery built to enforce them. You get the brokers who are organised, the ones who are sloppy, and the ones who registered because they need the licence to sell to big clients. The ones sitting in the dark stay in the dark.
So the first thing the form cannot do is tell you how big the problem actually is.
The second thing is worse.
Deletion is downstream. It removes rows. It does not remove what was built on top of the rows.
That is the mechanism the older frameworks never caught up to, and it is boring in the way that the most important things are boring. His address getting deleted is easy. The model that learned his behaviour, the inference that predicts what he does next quarter, the score that already left the building and now lives inside a partner’s risk engine — none of that is a row. A system designed to delete records of you has no natural way to delete a conclusion about you.
Picture him again, a year from now. He files. He gets the confirmations. Maybe a receipt he can screenshot. And his insurance quote does not move — because the thing pricing him was never a dataset with his name on it. It was a shape of him, trained before anyone asked.
And there is a third thing, quieter.
Deletion becomes a product. The moment the state makes erasure a legal obligation, you get an entire layer of businesses selling help exercising a right you already have — a monthly fee, a friendly dashboard, and the usual fight on the cancel button. That is not a conspiracy. It is just what happens when compliance gets expensive and the person affected has no time. A right that you need a subscription to use properly is not really a right. It is a service tier.
So what is the actual lesson? Two of them, and the second one is yours if you build anything.
The first: when someone deletes you, the paperwork says the job is done. It is not done. You removed evidence, not influence. Until erasure reaches conclusions — the derived score, the trained model, the profile that already walked out the door — the right to disappear is going to feel like a receipt rather than a result.
The second is for the operators. If you are building anything that touches personal data — a booking tool, an agent that reads customer messages, a lead engine, a weekend project that scrapes reviews — the non-collection decision is the only one that ages well. Collecting context “just in case” is borrowing against a bill that arrives later, usually at the worst possible moment, usually while you are trying to raise money or sell the thing. The durable advantage is not hoarding data. It is being able to say, precisely and provably, what you hold, why you hold it, and how fast you can let it go. Provenance beats retention. It always did. People just hadn’t put a price on it yet.
There is a temptation, writing about this, to end on the dark version. Everything is captured, nothing can be undone, the machine already won.
I don’t buy it. The form is a real win. It is the first time a serious jurisdiction said the broker carries the burden, not the target.
But a list of the people willing to answer the phone is not a door out of the room.
The right to disappear was never going to be won by asking nicely, after the fact, one company at a time. It gets won at the front — in what never gets collected, what never gets inferred, and what gets engineered so it cannot be reconstructed later, no matter who ends up holding the pieces.
Until then, you are not deleting yourself. You are filing paperwork with the people who admit they have you.