You can’t have privacy alone

Last week Chris wrote in Internet, Less, “We shouldn’t judge a privacy control by whether it can be found, clicked, or described in a policy. We should judge it by whether it produces a visible, verifiable result.” It turns out that this is a hard problem. We don’t have the tools to see how our data looks in their computers. When a person changes a privacy setting, Chris opined, we essentially get nothing more than a promise that something meaningful has changed.

I don’t believe a promise is good enough for something as important as privacy. That’s why Yorba started keeping receipts. We now have a trail of evidence based on an open schema called Eulogy. While this provides us several interesting technical guarantees, I’d rather reflect on what we’ve learned about the state of privacy and the web.

A year of data deletion requests has generated a list of companies that appear to be violating privacy laws. Consider claim #169,444 from August 2026: Tumblr denied a deletion request on behalf of a resident of California. Tumblr told us that it’s because the company never processes requests from authorized agents. This is a violation of the California Consumer Privacy Act (CCPA). Square told us in September that a different Yorba member from California had to log into Square to delete their account - another type of CCPA violation. That request, #172,643, took about 15 days to reach denial. Companies regularly tie up the resources of the requester, which makes this process even more arduous for any individual who wants to exercise their right to privacy.

The story isn’t much different in the European Union/United Kingdom, which benefit from the General Data Protection Regulation (GDPR)/(UK GDPR). Yorba members in Berlin, Barcelona, and London were denied their basic GDPR rights from Apple, Netflix, Adobe, and Meetup. Quora tied up Yorba resources for nearly a month of back and forth en route to ultimately settling on a GDPR violation.

According to Yorba’s 2024 State of Clutter report, the average Yorba member has 246 accounts online. The smart legislators who wrote the GDPR and the CCPA recognized the burden privacy enforcement would place on the individual and specifically carved out ways for people to hire help. That’s what Yorba does in full compliance with local laws. Of the tens of thousands of requests we have served, many companies are also in compliance - showing not only a deference to the law, but a commitment to their customers. For example, dozens of requests from all over the United States and Europe were sent to Vimeo, Kickstarter, and ParkMobile, all of which were quickly fulfilled.

I love naming names of companies and organizations that are committed to privacy. Conversely, the callouts for poor behavior are stressful but necessary. I believe it is incumbent on Yorba to help these companies along to everyone’s benefit. Based on our 2025 State of Clutter, we estimated that stalled requests and high-friction data deletion processes have cost 1,226 hours of professional labor. Certainly that’s bad for Yorba and it’s bad for anyone who tries to delete their personal data alone, but it’s also a cost center for the companies themselves. Everybody wins if the process goes smoothly.

So the team at Yorba has done everything from brokering special processes with companies like Verizon to being the first company to fully implement the Data Rights Protocol (DRP) open standard. DRP is an easy win for any company or organization serious about their customers’ privacy. It eliminates all the emails, turning a process that generally takes days or weeks into something that takes seconds. It also makes the process systematic and consistent. Remember the mention of Tumblr earlier? They have actually fulfilled dozens of other requests from Yorba - directly contradicting what they told us in #169,444. Was it a change in policy? Was the privacy person on their end having a bad day? We’ll never know.

We must work together for the right to be left alone. Democracies have spoken and citizens want their piracy respected. But things won’t change as long as every individual must proactively administer every request from every company and organization. The goal for Yorba in 2027 is to publish our data to a commons. That way folks can verify the claims, identify systemic violations, and help add teeth to enforcement efforts while highlighting those in compliance. People on Yorba who are taking individual actions to reclaim their privacy are actually contributing back to a healthier, more democratically aligned ecosystem - which will only be a benefit to personal privacy in the future.

Image: Martin Johnson Heade, Approaching Thunder Storm, 1859, oil on canvas, 71.1 × 111.8 cm, The Metropolitan Museum of Art, New York. Public Domain.