Privacy Should Be the Default, Not a Form You Have to Fill Out

In California’s Privacy Obstacle Course, Cory Doctorow argues that the real problem with data brokers is not simply that they are difficult to opt out of. It is that they are allowed to collect and sell personal information by default.

“The process for not being spied on should look like this: Step one: Exist. Step two: There is no step two.”

California’s new Delete Request and Opt-out Platform, or DROP, is a meaningful improvement. A California resident can submit one request directing every active, registered data broker to delete their personal information and stop selling it. The request also applies to data collected again in the future. Brokers begin processing requests on August 1, 2026, and must check for new requests at least every 45 days. (privacy.ca.gov)

DROP does not cover everything. It applies to California residents and registered data brokers, while some first-party information, public records, and legally exempt data may remain. It is still much better than discovering and contacting hundreds of companies individually.

Other useful consumer tools include:

• Permission Slip from Consumer Reports, which can submit deletion and do-not-sell requests to companies on a consumer’s behalf.
• Privacy Badger from the Electronic Frontier Foundation, which blocks hidden trackers and sends the Global Privacy Control signal. It helps reduce new collection, but it does not erase profiles that brokers already hold.
• Global Privacy Control, a browser-level signal telling websites not to sell or share personal information. It is legally recognized as an opt-out mechanism in California and several other states.
• Commercial removal services such as DeleteMe, Optery, and Incogni, which repeatedly search people-finder and broker sites and submit removal requests. These can reduce the manual work, but none can promise that every record will be found or permanently removed.

Doctorow’s larger criticism remains valid even with these tools.

A data broker can begin building a profile without asking permission or establishing any relationship with the person being cataloged. The person then has to verify their identity, submit requests, monitor compliance, and repeat the process when the information reappears.

That burden is backwards.

Privacy tools are worth using, and Californians should submit a DROP request. But a healthy privacy system should not require a collection of government forms, browser extensions, mobile apps, and paid subscriptions just to approximate the privacy we had before the surveillance economy was built.

The simplest action is to start here:

Submit a California DROP request

Then install Privacy Badger, enable Global Privacy Control, and use Permission Slip for companies and services that may already hold your data.

Read Cory Doctorow’s full article, California’s Privacy Obstacle Course.