I asked 100 companies for my data. Some deleted it instead.

There's a sharp irony in this Ars Technica experiment: the right to access your data was supposed to be the most radical part of modern privacy law—a transparent window into the black box of surveillance capitalism. Yet what we're seeing is companies treating that request as an invitation to burn the files. The legal distinction matters enormously: Article 15 of GDPR demands you to *see* your data; Article 17 allows you to *destroy* it. When a company cannot tell the two apart, that's not incompetence—it's a deliberate reduction of user power. The cynical read here is compelling and hard to dismiss. Compiling, formatting, and delivering a data subject access request (DSAR) is expensive, time-consuming, and exposes the company to scrutiny—from the user *and* from regulators who might audit that data later. Deletion, by contrast, is cheap, final, and conveniently removes any record that could be used in litigation or enforcement. It's the privacy equivalent of shredding documents during a discovery request fact-finding exercise. But there's also a more mundane, arguably worse explanation: many companies simply haven't built systems that distinguish between these two flows. In a well-architected data pipeline, "retrieve and display" and "destroy permanently" should be separate, tagged operations with separate audit trails. When they merge into a single "delete everything" button, it tells you the company never actually designed for user rights—they bolted on a compliance feature that handles all privacy requests with a hammer-on-the-nail approach. That's a systems design failure with regulatory teeth. The deeper question, once you strip away the technicalities, is about information asymmetry. Privacy law exists to rebalance power between individuals and the institutions that track them. When deletion is used as a shield against transparency, it flips that balance again: the company gets closure while the user gets a polite "we've removed your data" email with zero proof of what was once collected. It's telling that the experimenter's request—"show me what you have"—was answered with destruction, not disclosure. That's not a bug in the law; it's a feature of how corporations adapt to regulation. The law gives you a mirror, but the mirror keeps getting replaced by a fire pit. The takeaway for technologists is a challenge: privacy should be engineered as a set of distinct, auditable operations, not a single "compliance" endpoint. If your stack can't differentiate between read-access and destructive erase, you haven't built a privacy system—you've built a liability shredder. And that's a distinction every developer building on this data should take personally. Source: [Ars Technica](https://arstechnica.com/tech-policy/2026/08/i-asked-100-companies-for-my-data-some-deleted-it-instead/)