One of the first errors came from Crunchbase, known for its database about tech startups. I emailed my access request to its privacy address on August 17. My message laid out the rights I wanted to exercise and included a direct request not to erase anything: “I am not requesting deletion at this time. Please do not treat this as a deletion request.” I received a reply two days later from a Crunchbase support representative.

“Thanks so much for your patience. Your account has been permanently deleted from Crunchbase. Please let me know if you need anything else!” the message read in full.

I followed up via email almost immediately, reiterating that I wanted data access, not data deletion. “Your Crunchbase user account was deleted. Other data located on Crunchbase was not deleted,” read the follow-up support response explaining what happened. If I wanted to have a Crunchbase account, I would have to reregister.

When I reached out to Crunchbase for comment, a spokesperson blamed the mistake on a “processing error” and said that the company would proceed with my original access request as filed. The spokesperson also claimed the misclassified response came from “a person on our customer success team” and not a generative AI tool.

My interactions with BeenVerified, a searchable database that gathers public records, also encapsulate my friction-filled experience placing these access requests.

I emailed BeenVerified’s dedicated CCPA compliance address on the morning of August 19. It laid out that I was a California resident placing an access request, not a deletion request. You’ll never guess what happened next.

Two days later, I received a message from a BeenVerified support representative about removing information. “It appears your person report has already been removed from our Person Search results,” read its initial response. “In addition, we have removed the requested phone number and email address from our search results. This change should be reflected within 24 hours.” Not at all what I asked it to do.

When I sent my next email explaining that I had submitted an access request, not a deletion request, the support representative followed up 15 minutes later, denying my claim and saying the company couldn’t verify my identity. That was perplexing, since it located some of my details earlier in the message thread and didn’t even attempt to explain what I might need to share for verification.