| California this week sued to fine a data-harvesting company, in a rare step to put muscle behind one of the strongest online privacy laws in the United States. Starting next year in California, state residents will be able to make a single request to require that all data brokers delete their private information. Privacy advocates are excited about the law, and they said the lawsuit was unusual in a country in which data privacy laws, if they exist at all, have scarcely been enforced. With the federal government paralyzed over national standards for online privacy, the future of your data privacy rights is being decided in U.S. states. California shows the promise if strong privacy protections are paired with government watchdogs making sure that companies actually fulfill your commands to stop stockpiling data. Let’s dig into what California is doing to protect people’s online privacy, why it’s so hard to stop companies from hoarding and selling your information, and steps you can take now to fight for your privacy. Delete your data in one easy step Among the lesser-noticed pistons of the data economy are data brokers that might assemble and sell thousands of pieces of information about you. An insurance company might buy information from a data broker on how fast you drive, or a stalker can buy the home address and church location of a federal judge. “Scratch at an issue today, look close enough, and you’ll find data brokers somewhere making the issue worse,” including in data breaches, identity theft and government surveillance, said Emory Roane, associate director of policy for the nonprofit Privacy Rights Clearinghouse. Even when states have tried to restrict data brokers, it has been tough to make those laws stick. That has generally been a problem for the 19 states that have passed broad laws to protect personal information, said Matt Schwartz, a policy analyst for Consumer Reports. He said there has been only 15 or so public enforcement actions by regulators overseeing all those laws. Partly because companies aren’t held accountable, they’re empowered to ignore the privacy standards. “Noncompliance is fairly widespread,” Schwartz said. “It’s a major problem.” That’s why California is unusual with a data broker law that seems to have teeth. To make sure state residents can order all data brokers operating in the state to delete their personal records, California is now requiring brokers to register with the state or face a fine of $200 a day. The state’s privacy watchdog said Thursday that it filed litigation to force one data broker, National Public Data, to pay $46,000 for failing to comply with that initial phase of the data broker law. NPD declined to comment through an attorney. Privacy advocates believe the California measure, the Delete Act, will be a powerful privacy right. (It only applies to state residents.) This first lawsuit for noncompliance, Schwartz said, shows that California is serious about making companies live up to their privacy obligations. What you can do to protect your personal information Some state privacy laws give people the right to tell most businesses not to sell or share information they collect or in some cases to delete data about you. (Some companies apply those state privacy protections to everyone.) To take advantage of those privacy rights, though, you often must fill out complicated forms with dozens of companies. But there are ways to make it easier to exercise your privacy rights. • Use a web browser from Firefox, Brave or DuckDuckGo, which can automatically tell websites not to sell or share your data. Those demands from the web browsers are legally binding or will be soon in at least nine states, including California, Colorado, Connecticut, Montana and Oregon. Read more about those browser opt-out options. As I noted above, just because something is legally binding doesn’t necessarily mean companies are complying with the law. • Or download Privacy Badger from the consumer advocacy group the Electronic Frontier Foundation. The add-on for Google Chrome, Firefox or the Microsoft Edge browser also automatically tells websites not to sell or share your data including where it’s required by state law. • Use the free Permission Slip app from Consumer Reports. The app makes it easier to take advantage of state privacy rights to order companies to delete your personal information and secrets. • Consider supporting stronger privacy laws in your state. Privacy advocates worry that the Trump administration won’t prioritize protecting consumers’ online privacy. That puts states even more in the hot seat to give you control over your personal data. Maryland has a sweeping new privacy law that will go into effect this fall and is considered to have among the strongest consumer privacy protections in the country alongside California’s. And while only Californians can take advantage of the Delete Act, Schwartz said lawmakers in others states, including Vermont and Nebraska, are considering copying California’s approach to data broker restrictions. “If they can successfully build it and show it works, it will create a blueprint for other states interested in this idea,” he said. | 
