HOPE. @lutalical - Tumblr Blog

California’s privacy obstacle course

Hey, UK folks! Waterstones is having a 3-day pre-order sale that includes the UK paperback of Enshittification (which drops on Sept 1). Use SUMMER26 to get 25% off.

Data brokers are a cancer. There's a direct line from the unrestricted collection, retention and processing of our data to a host of evils, from deepfake porn to phishing scams; from racial discrimination in hiring to ICE roundups of migrants; from targeted election interference to identity theft:

https://pluralistic.net/2023/12/06/privacy-first/#but-not-just-privacy

Why do data brokers exist? Because we let them. Congress hasn't passed a new federal consumer privacy law since 1988, when they made it illegal for video stores to disclose your VHS rentals. All other acts of consumer surveillance are legal. Data brokers spy on us for the same reason your dog licks its balls: because they can, and we don't stop them:

https://pluralistic.net/2026/03/10/ice-tech/#foreseeable-outcomes

Getting rid of data brokers wouldn't solve all our problems, but it sure would go a long way to solving many of them. Rather than legally requiring platforms to spy on kids (to exclude them from being targeted by platforms' algorithms), we could prohibit platforms from spying on anyone, including kids, meaning kids couldn't be identified (much less targeted) by algorithms or ads:

https://pluralistic.net/2026/06/23/destroy-the-village/#to-save-it

Data brokers produce mountains of raw material used for every form of scam and torture. It's data brokers who power the gig economy's "algorithmic wage discrimination" system, where nurses and other workers are offered less pay based on how much credit card debt they're carrying:

https://pluralistic.net/2024/12/18/loose-flapping-ends/#luigi-has-a-point

Banning data brokers would make great sense, which is why Biden's CFPB banned data brokers (only to have Trump un-ban them):

https://pluralistic.net/2025/05/15/asshole-to-appetite/#ssn-for-sale

So the feds (both Congress and the executive branch) have surrendered, and that leaves states alone on the battlefield fighting the privacy wars alone. State legislatures have taken some big steps, but – crucially – they've stopped short of banning data brokers from operating within their borders. Having taken a ban on data brokers off the table, states are left with complex, often unworkable "compromises" that go nowhere.

This is where DROP comes in. DROP stands for "Delete Request and Opt-out Platform," and it's a new phase of California's privacy regime that kicks off next month. Under DROP, you fill in some paperwork and then the state requires every data brokerage operating in California to delete your data, as well as any inferences they've made about you based on that data:

https://www.eff.org/deeplinks/2026/07/what-you-need-know-about-californias-drop-tool

Implementing DROP is nowhere near as good as banning data brokers. The idea that data brokers should be able to collect, retain and process your data unless you tell them not to implies that everyone starts off wanting to be spied on, and therefore data brokers should assume that unless they hear otherwise, we're delighted to be the subject of commercial surveillance. This is an incredibly stupid supposition, contradicted by all available evidence. For example, when Apple offered iPhone owners a one-click option to block Facebook from spying on them, 96% of iPhone owners clicked the button:

https://applescoop.org/story/facebook-must-inflict-pain-on-apple-says-mark-zuckerberg

Indeed, given this fact, one wonders why Apple bothers with the "don't spy on me" button at all. Why not have a "do spy on me" button that is unchecked by default, and leave users to dig through their settings to find the option to opt in to being surveilled? Of course, then it would make the fact that Apple spies on its customers and uses the data to target ads (with no way to opt out) a little awkward:

https://pluralistic.net/2022/11/14/luxury-surveillance/#liar-liar

In the absence of a ban on surveillance without explicit, opt-in consent, we are left with the bizarre fiction that most of us want to be spied on, a fiction that pervades the DROP process, making the entire procedure nearly impossible to complete.

To start the DROP process, you must first create a Login.gov ID. This is an incredibly invasive process that involves photographing multiple pieces of ID and taking several selfies using special apps and webpages that hijack your device's camera and processor in a bid to prevent bad actors from spoofing the process. There's a plausible reason for this rigmarole: Login.gov is the authentication system for multiple federal, state and local IT systems in the US, so a fake or stolen Login.gov ID could be used to access your IRS, Social Security, and other very sensitive accounts.

The corollary of this is the promise of Login.gov: once you create your ID (a lengthy, multi-stage process) you won't have to jump through lots of painful bureaucratic hoops to access a wide variety of government services.

DROP didn't get the memo.

After you log in to DROP via Login.gov, you are sent a text message – to the phone number in your Login.gov profile – with a link to access a "secure" website that takes over your camera to let you take a "secure" photo of the front and back of your California driver's license or your US passport. What if you don't have either of those? I guess that means you want to be spied on by data brokers.

Note that these are the same credentials you have to supply to get the Login.gov ID that you've just used to get to this step in the process. In other words, in order to get to the stage where they ask you to photograph your driver's license, you have to have already photographed and validated your driver's license.

Once you complete this (pointless, redundant) step, you're directed back to your computer, where the process continues. Here, you must fill in all kinds of biographical detail, as well as specialized pieces of information, including your car's VIN. This is a piece of information that most people don't have – but which the California DMV does have and could auto-feed into the system, given that you've repeatedly affirmatively identified yourself to the service.

You also have to provide your mobile advertising identifier, a long, unique number that you may or may not be able to extract from your phone, depending on the model and the OS version. If you can't get it that way, you can install an app like AAID, which comes with a long list of – you guessed it – permissions to extract, store and process your private information.

Here's the thing: the whole point of a mobile ad identifier is that apps can access it (this is how they identify and track you). That step, where the system made you switch to your phone and use your camera to photograph your driver's license? That step could have automatically pulled this data off your device. That's the whole fucking point of this exercise: that web-pages and apps can request your mobile ad identifier.

Instead, DROP wants users to dig through their phone's deepest settings and/or install an app to retrieve a 32-digit number, which they then must key into a webform on their computer or in a different app on their phone.

Once you've done this, you must fill in another page of biographical information, including information that you've already provided to Login.gov and information you've already filled in on previous screens.

On this screen, you must also verify your phone number by sending yourself a text and then pasting in a unique number the system sends to you. But remember how this whole thing started? The first step is that you authenticate with Login.gov, which sends a text to your phone so you can take a (redundant) picture of your driver's license. There is no way you could get this far in the process unless you controlled the phone number you've just "verified" with the system.

Next, you must verify your email address, by receiving an email with a unique code in it and keying or pasting that into the webform, too. Again, remember how this process started: with you logging in with Login.gov, using your email address, which the system has already treated as verified since the very start of this (very) long and (very) complicated process.

This whole thing is terrible, and it is predicated on the absurd premise that Californians have to be defended from the threat of strangers who pretend to be them in order to sneakily opt them out of surveillance. DROP requires stronger authentication than any other US government system I've ever interacted with. I file my tax returns with fewer authentication steps. I renew my car's DMV registration with fewer authentication steps. I became a US citizen with fewer authentication steps.

This is either a system with no coherent threat model, or (far more probably), its threat model is that people will use it. This is California's answer to "a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard'":

https://en.wikiquote.org/wiki/The_Hitchhiker%27s_Guide_to_the_Galaxy

It's especially instructive to compare this process to the steps you have to take in order to "opt in" to having a data broker open a file on you and stuff it full of your sensitive, personal information, which is then sold to all comers:

Step one: Exist.

Step two: There is no step two.

It's also instructive to compare this process to the steps a data broker has to take to spy on you and sell your data:

Step one: Exist.

Step two: There is no step two.

Though there are many obvious ways this could be made better, I want to stress here that you shouldn't have to do this at all. It's entirely backwards. The process for not being spied on should look like this:

Step one: Exist.

Step two: There is no step two.

If anyone is going to be forced to jump through hoops to participate in the mass collection and catastrophic mishandling of private data, it should be the data brokers, not the people they spy on.

This kind of malicious compliance is the inevitable outcome of a process that starts by taking the obvious best measure off the table. The answer to the problem of data brokers is banning data brokers, not creating a demented hairball of form-filling that maintains the fiction that data broker surveillance is consensual.

In its own way, this process reminds me of the whole "carbon credit" fiasco. The answer to too many carbon emissions is to democratically decide to ban certain kinds of carbon emissions. But that would require states to do things, rather than simply "nudging" a process that is guided by "the market." So we end up with these junk "credits" that companies manufacture by promising not to log forests, many of which are already wildlife preserves and/or subsequently burn down:

https://pluralistic.net/2023/10/31/carbon-upsets/#big-tradeoff

The best critique of this whole thing came in 2021 from the Climate Ad Project, who produced a short video in which people were allowed to kill one another provided they purchased "murder offsets":

https://pluralistic.net/2021/04/14/for-sale-green-indulgences/#killer-analogy

In a state of nature, murder exists. We, as a society, have decided this is bad. Rather than creating "incentives" not to murder, we just banned murder. Admittedly, we still get some murders, but when these happen, we don't treat it as "a mispricing of the anti-murder incentive" – we treat it as a crime.

The commercial surveillance industry may not be a criminal enterprise (yet), but it is the source of a torrent of crime, a flood of crime, a tsunami of crime. Every piece of your information that a data broker possesses exposes you to the risk of being victimized by a criminal. For this reason, I strongly believe that you should go through the tedious, performatively difficult DROP process:

https://consumer.drop.privacy.ca.gov/

But let's not pretend that this is good – or even adequate. There is no demand for being spied on. There is no basis for taking such enormous care in making sure people aren't maliciously removed from surveillance databases. If these databases exist at all (they should not), then we should make spies go through all this paperwork, to prove that you do want to be spied on, and unless they manage it, then spying on us should be treated as the crime it is.

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2026/07/23/drop-a-dime/#privacy-theater

Trending Blogs

Recently Viewed Blogs

HOPE.