DROP is pretty significant considering that it's the first compliance system meant to have an immediate effect (delete the data), backward-looking effect (forward a legally-binding deletion request to everyone that data was sold to or shared with), and a forward-looking effect (never let that record re-enter your system, in perpetuity). This is significantly more tracking and auditing infrastructure than anyone in the industry has ever normally run, not to mention that the request volume is 100-10000x what most of these brokers would process in previous years.

We'll see how well companies actually managed to comply when audits are performed for every registered broker in 24 months. I also think the impending prosecutions (and likely bankruptcies) of several unregistered data brokers will encourage the others to take it more seriously.

All of the requests are SHA-256 hashvalues, they aren't transmitting any usable information in the process of sending the deletion requests.

Does it apply to Google? Well that's an interesting question. I think the answer is yes but the practical matter is that the CPPA is going to get some legal precedent and some more lawyers on staff before they take on Google. At the current number of requests in the DROP platform they could determine Google is an unregistered data broker and fine them $25B+, but I don't think they are going to do that this year.

I think within 36 months they will take the legal victories from prosecuting the first set of unregistered data brokers and apply it to the real players in the data ecosystem. At least, that's what I would do if I were Michael Macko.

https://ccpa.world/enforcement/sephora-sale-of-pi

I'll second this observation, as well as add that apart from AI slop most people around here associate the data center push with the sudden proliferation of Flock cameras at every major intersection and along every highway. Provo defeated a major data center project that was going into an empty industrial park, arguably the kind of place that would fit that sort of development. The actual cost-benefit calculation for most people is heavily weighted towards the negative and this should not continue to surprise people. The perceived downside with no upside is just going to get worse if the government gatekeeps the most useful models.

I'm also already busy building Forgetmenaut and enabling data deletion at scale: forgetmenaut.com

And thanks for saying it should have worked, I agree. My chagrin has increased over the years as I have realized the magnitude of my ill-timing.

Trying to train an LLM on two 1080ti's on the StackOverflow corpus in my living room was a vibe though. Good times.

I will note that many "data brokers" will just honor non-California residents' requests as if they were California residents and subject to the CCPA, simply because they would rather remove a potentially litigious consumer from their databases. Given the relatively low potential revenue for a single consumer's data it just doesn't make sense to hold on to information for the kind of person who currently goes out of their way to make that kind of request.

At the same time, many data brokers do go out of their way to deny as many privacy requests as possible. Given that the CPPA/CalPrivacy is starting audits very soon I don't see this as a winning strategy for them in the long run.

I also built this site for educating potential customers and other privacy professionals about the increasing tempo of CCPA enforcement actions driving compliance: https://ccpa.world/enforcement

I could have probably coded this from scratch quicker considering that it took me two weeks to remove all of the hallucinated imaginary enforcement actions against real companies and also the citations to non-existent California law that the models kept injecting into my enforcement summaries.

Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver

https://news.ycombinator.com/item?id=39709991

https://news.ycombinator.com/item?id=42734260

https://news.ycombinator.com/item?id=39793903

The real impact of this case is that it's the first time we've seen a serious data minimization case in the US. California's investigation showed that they will prosecute if legitimately collected data is repurposed and resold after the fact.

Comments URL: https://news.ycombinator.com/item?id=48069303

Points: 8

# Comments: 1

If you are selling SaaS consider that a vibe-coding customer is validating your feature roadmap with their own time and sweat. It's actually a very positive signal because it demonstrates how badly that product is needed. If they could vibe code a "good enough" version of something to get themselves unstuck for a week, you should be able to iterate on those features and build something even better in short order, except deployed securely and professionally.

Everyone's going to talk about how cool their custom vibe-coded CRM is until they get stuck in a failed migration.