Privacy Violations Through Obscurity

A recent investigation by The Markup and CalMatters uncovered a troubling trend among data brokers: many are deliberately hiding the web pages that allow consumers to request deletion of their personal data. Despite California’s Consumer Privacy Act requiring these opt-out mechanisms, over 30 companies were found using code to prevent search engines like Google and Bing from indexing their deletion instructions, making them virtually invisible to the average user.

This tactic, while technically compliant, undermines the spirit of transparency and consumer control. Some companies buried links deep within privacy policies, behind pop-ups and tiny text, while others claimed the exclusion was an “oversight.” One data broker even buried the hyperlink to their data removal page 7000 words into their privacy policy! After being contacted by reporters, several removed the code, but many remained silent.

This situation underscores the urgent need for stronger user awareness and digital literacy. Organizations must invest in training employees and clients alike to recognize deceptive practices and understand their rights under evolving privacy laws. On an individual level, practicing good cyber hygiene—like regularly checking data broker registries and using reputable opt-out tools—can help mitigate exposure.

As public scrutiny grows and investigative reporting continues to shine a light on these tactics, we can expect more restrictive legislation to follow. Businesses should prepare now by aligning with not just the letter, but the intent of privacy laws. Transparency and accessibility aren’t just regulatory checkboxes—they’re the foundation of trust in the digital age.

Forrest Palamountain – Security Lead, Tech Heads Inc. – CISSP