{"id":63070,"date":"2020-04-28T00:00:00","date_gmt":"2020-04-28T00:00:00","guid":{"rendered":"http:\/\/blog.mozilla.org\/foxtail\/2020\/04\/28\/data-request-ccpa\/"},"modified":"2021-05-21T21:59:33","modified_gmt":"2021-05-21T21:59:33","slug":"data-request-ccpa","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/en\/privacy-security\/data-request-ccpa\/","title":{"rendered":"Now that my entire life is online, how do I protect my personal data?"},"content":{"rendered":"

by Astrid Rivera<\/i><\/p>\n

For the past month or so I\u2019ve been living my life exclusively indoors and online. This new normal means that everything has shifted to a virtual realm \u2014 working, connecting with family and friends, and even going to the gym. We\u2019re all left with no choice but to use online services in order to live a normal-ish life.<\/p>\n

So what can we do if we\u2019re not comfortable with sharing every personal detail of our lives with the companies that provide those services? It turns out, we can fight back. Especially now that we have more free time.<\/p>\n

Earlier this year California rolled out the California Consumer Privacy Act (CCPA)<\/a>, a law that allows you to request and\/or delete any personal data a company has on you*. Even if you\u2019re not in California, a lot of companies that collect data on you like Microsoft<\/a>, for example, are extending these rights to all Americans.<\/p>\n

I decided to see for myself how it works by trying to control my data and requesting it from half a dozen companies. Along the way I figured out where to go if you want to attempt your own data quest. It sounds simple enough but it turns out if you want to get what’s yours, you\u2019ll have to work for it.<\/p>\n

Uber & Uber Eats<\/h2>\n

Request your Uber data here<\/b><\/a><\/p>\n

I started my journey with a company I have a lot of history with, Uber. Previously I used Uber for rides, and now I use Uber Eats to support local businesses with food delivery. For some reason my login was giving me issues, so I had to go through a bunch of \u2018forgot password<\/i> and password was already used\u2019<\/i> battles before actually logging in.<\/p>\n

Then I had an option to opt-in<\/i> or opt-out<\/i> for selling my data (I opted out. If anyone is making money off of me, it should be me). Then I scrolled down to an FAQ section and under the How do California residents exercise these rights<\/b> option, I found the option to Request an export<\/b> of my data.<\/p>\n

*drum roll*<\/p>\n

Uber then asked me why I’m requesting this data, which seemed kind of obvious. Ummm because I want to know what personal info you have on me? <\/i>I clicked the \u201cI\u2019m just curious\u201doption.<\/p>\n

\"Why<\/p>\n

An email from Uber confirmed my data request and said that it would take a few days to process.<\/p>\n

A few days later I actually received my data! It was a downloadable zip file that had both Rides and Eats information. It was A LOT to take in. With every file I opened, I found myself endlessly scrolling through every single ride and food order I had ever made. It wasn\u2019t surprising that Uber knows what I\u2019m doing when I\u2019m on their app but the amount of detail they know surprised me a bit.<\/p>\n

For example, they know the phone carrier I\u2019m using, the model of my phone, exact location coordinates and more. I really wish it had every rating I\u2019ve ever received but, alas, that\u2019s not in there. In case you\u2019re wondering, I\u2019m a solid 4.8.<\/p>\n

Here\u2019s what was included in the zip drive:<\/p>\n

\"Downloaded<\/p>\n

Yelp<\/h2>\n

Request your Yelp data here<\/b><\/a><\/p>\n

The first time I tried requesting my data from Yelp, I had some difficulty. I followed the instructions and requested my data download directly from Yelp\u2019s website. I got an email indicating I should get all of my data in two days but for some reason, I never actually received it.<\/p>\n

I decided I would try requesting again, thinking maybe I made a mistake or it didn\u2019t actually go through. Either way, I logged back into my account and went into my privacy settings. There\u2019s a handy link to download a copy of your Yelp data, so I followed those instructions.<\/p>\n

This time around I got my data back! Pretty quickly too, which was surprising. Here\u2019s what it looks like:<\/p>\n

\"Downloaded<\/p>\n

Yelp knows where I\u2019ve been, not just check-ins but they\u2019re getting my phone\u2019s location (which I\u2019ve now turned off). They also save any direct messages, business that I follow or have bookmarked, places I\u2019ve searched for, any waitlists I\u2019ve joined, and my profile information. They have a pretty good idea of who I am and what places I usually frequent or want to go to.<\/p>\n

Airbnb<\/h2>\n

Request your Airbnb data here<\/b><\/a><\/p>\n

Requesting my data from Airbnb required some work. I had to read so much legal jargon before finding clear instructions on how to email them. I started an email draft, but first I had to find my profile ID number. I used the app on my phone since it\u2019s already logged in, but this profile ID number was nowhere to be found. I would have to sign in on my laptop, ugh.<\/p>\n

I used my password manager<\/a> to locate my username and password, logged in, and then went to my profile. I was looking for this ID number and couldn\u2019t find it (again), only to realize they were looking for the numbers located in the URL after my name.<\/p>\n

I finally emailed them, and a few days later I got this note:<\/p>\n

\"Airbnb<\/p>\n

So basically if you want your data from Airbnb, you have to send them a picture of your ID over email (not super secure!) and you have to request AGAIN. Not a top-rated experience, Airbnb. Next!<\/p>\n

Instagram<\/h2>\n

Now onto my favorite social media platform, Instagram. It was surprisingly easy to access my data from Instagram, which is owned by Facebook. Next time you\u2019re on your profile, tap the Settings<\/b> option, then hit Security<\/b>, and you\u2019ll get a screen that looks like this:<\/p>\n

\"Instagram<\/p>\n

To look at my data, I hit Access Data<\/b> and there it was: every comment, like, follow, post and basically everything I\u2019ve ever done or looked at on Instagram. The most unexpected thing by far was they had everything I had ever searched for and even just typed in the search bar. Instagram is my prime social snooping spot so I can\u2019t imagine if this data ever got out and my 5th grade crush found out I was looking at his profile. I quickly proceeded to the Clear Search History<\/b> section and cleared it asap.<\/p>\n

Facebook, as we all know, has its problems, and we\u2019re all probably better off limiting its reach<\/a>. But I was actually impressed at how easy they made it to view and download my data from Instagram.<\/p>\n

Spotify<\/h2>\n

Request your Spotify data here<\/b><\/a><\/p>\n

I use Spotify daily so it\u2019s one of the apps that has the most dirt on me. I checked out the Privacy Center<\/a>, and found a lot of information that I didn\u2019t want to sift through.<\/p>\n

After scrolling for a while, I found a Contact Us<\/b> option. I went through all the prompts and finally arrived at 1: Request your data.<\/b> I clicked to request and then received an email noting that this process can take up to 30 days so sit tight. Cool.<\/p>\n

A few days later, my data arrives via email in something that looks like code. (A coworker later told me it\u2019s a database download. I\u2019m obviously not a tech person). Spotify has all of my search terms, every single song I\u2019ve ever listened to, every playlist I\u2019ve ever created, who I follow and how I pay. Again, nothing mind blowing. We all expect Spotify to have this information.<\/p>\n

But I can\u2019t imagine if this was leaked and every song I\u2019ve ever listened to in the past decade was on display for strangers to see. It\u2019s pretty cringe-worthy. This is a sample of how my data looked:<\/p>\n

\"Downloaded<\/p>\n

LinkedIn<\/h2>\n

Request your linkedIn data here <\/b><\/a><\/p>\n

Requesting my data from LinkedIn was also easier than I expected. I was able to quickly download everything into a zip file directly from the privacy settings. Like the others, it was a lot of information to go through.<\/p>\n

LinkedIn had an interesting section that detailed how they target me for advertising. It had a full profile on who I am based on what computer I use, my locations, who I know and follow. They also had every communication I\u2019ve ever sent, if I\u2019m currently open to jobs or not, and a lot of information about who I was connected with.<\/p>\n

\"LinkedIn<\/p>\n

LinkedIn had more than I realized they would have on me, so I\u2019m going to keep playing around with settings to see what I\u2019m able to delete from the platform.<\/p>\n

*\u00a0\u00a0\u00a0\u00a0 *\u00a0\u00a0\u00a0\u00a0 *<\/b><\/p>\n

My biggest takeaway from this experience is that it\u2019s a pain to request your data, and once you get your copy, it\u2019s hard to know what to do with it. Some companies do actually allow you to delete the data and remove yourself from future data collection, but it should be easier to get there.<\/p>\n

Yet, whenever I was able to find the option to delete or remove my data, I took advantage of it. Using Firefox<\/a> browsers on my computer and phone also provides a layer of privacy protection by automatically preventing many third-party trackers, meaning random companies won\u2019t be able to follow me around the internet collecting information.<\/p>\n

It might not be easy to hunt down your data or delete it but because of CCPA, you now have the power to do it. If you\u2019re looking for a place to start, Common Sense Media has a tool at DoNotSell.Org<\/a> that allows you to look up how to delete and\/or request your data from a variety of companies. If you can\u2019t find the company you\u2019re looking for, try searching the company\u2019s website for \u201cCalifornia\u201d to see if they have a CCPA section.<\/p>\n

Tweet us @Firefox<\/a> to let us know how your data request journey is going.<\/p>\n

*\u00a0\u00a0\u00a0\u00a0 *\u00a0\u00a0\u00a0\u00a0 *<\/b><\/p>\n

If you want to request your data back from any of the companies mentioned in this article, all the links are below:<\/p>\n