Millions of Social Security Numbers Listed for Sale on the Dark Web

Millions of Americans’ Social Security numbers have surfaced on the dark web, offered for sale due to large-scale data breaches in recent years. This availability poses significant risks, enabling identity thieves to open credit cards using someone else’s Social Security number, file false tax returns, and steal refunds, government benefits, and medical care assistance.

California’s Efforts: The Delete Act

In response, Californians are working to address this issue. They are utilizing the state’s Delete Act, which expands privacy rights by enabling residents to request the deletion of personal data held by data brokers. This process is streamlined through a centralized platform called DROP, or the Delete Request and Opt-out Platform.

Personal data, including Social Security numbers, precise locations, browsing history, email addresses, phone numbers, health information, and shopping habits, can be erased upon request. However, data directly provided to a business, exempted data, and publicly available data are not subject to deletion.

Data brokers must comply with requests and stop selling a person’s data in the future. Following deletions commencing August 1, brokers have 45 days to inform the agency, CalPrivacy, and requesters about actions taken. Non-compliance incurs a penalty of $200 daily per affected individual.

Data Deletion Requests: A Glance at Numbers

As of July 1, 332,292 Californians sought data erasure through the Mercury News report. Among roughly 600 registered brokers, data pertaining to locations, Social Security numbers, gender identities, reproductive health, and union memberships are spread across various brokers.

Minors can participate in data deletion with parental involvement. Several brokers sell information to federal and state governments, law enforcement, foreign entities, and AI developers.

Why Hesitation to Request Deletion?

The number of Californians making deletion requests remains low. CalPrivacy Executive Director Tom Kemp emphasizes the unchecked proliferation of personal data among brokers. He encourages the public to request deletions, aiming to reduce targeted ads, scams, spam emails, and identity fraud attempts.

Eligibility and application for data deletion on DROP’s platform are available until August 1.

Broader Implications: Nationwide Efforts

No comprehensive federal law governs data brokers’ sale of personal information. Instead, various state laws offer different levels of privacy protection and opt-out options. California leads in privacy regulations, with similar measures being considered or enacted by other states.

Connecticut plans to implement a centralized deletion system by mid-2028. New Jersey has enacted laws restricting the sale of sensitive data, requiring broker registration, and enabling deletion upon request. Oregon, Texas, and Vermont mandate broker registration but lack centralized deletion mechanisms.