Data rights, explained

A. What information exists about you?

“Your data” is not one thing. Different categories carry different legal weight, and the difference explains why deleting some of it is straightforward and deleting all of it is not.

Identifying information

Name, aliases, date of birth, government identifiers such as a driver’s licence or Social Security number.Government identifiers are treated as “sensitive” under several statutes (e.g. 15 U.S.C. § 9901(c)(7)(A)).

Contact information

Postal addresses, email addresses, phone numbers.Often the minimum needed to match a record. Frequently the part people are most annoyed to see published.

Location information

Home and work locations, visits, travel patterns, device-derived location.“Precise geolocation information” has a specific legal definition — street level, or within 1,850 feet (§ 9901(c)(6)).

Browsing & advertising data

Sites and apps used, device identifiers, advertising IDs, inferred interests.Frequently shared for “targeted advertising” even where no money changes hands — which is why laws define “sharing” separately from “sale”.

Purchasing patterns

Orders, subscriptions, loyalty activity, grocery and retail history.Purchase signals are often used to infer health, financial or life-event status.

Inferred attributes

Assumptions derived from other data — income band, life stage, likelihood of a condition.Inferences can be as revealing as facts, and are treated as personal information under several regimes.

Public records

Voter files, property and court records, licensing data.“Publicly available” information is excluded from some deletion regimes — a big limit on what any tool can erase.

Consumer-reporting data

Credit, rental, employment and background-check data held by consumer reporting agencies.Governed by the FCRA — an accuracy regime with dispute rights, not a general deletion right.

Sensitive personal information

Health, biometric, genetic, financial-account, precise location, private communications, credentials and more.Usually gets the strongest protections and the most explicit opt-outs.

B. How does personal information spread?

The diagram below is conceptual. It shows the kinds of relationships that appear in the public record — regulatory actions, settlements and statutes — not a scan of your data and not a claim that every path is used for every person.

C. What harms can arise?

Not every transaction causes every harm. These are the concerns that recur in the public record and in consumer research.

• Loss of privacy — information you did not choose to make public becomes findable.
• Unwanted solicitation — contact details drive marketing, scams and harassment.
• Profiling — inferences used to decide what you are offered, or charged.
• Exposure of sensitive details — health, financial or location information leaving its original context.
• Risks from inaccurate data — wrong facts can follow you into eligibility and pricing decisions.
• Location tracking — patterns of movement are difficult to un-know once sold.
• Aggregation — combining datasets reveals more than either part.
• Secondary uses you did not expect — data collected for one purpose used for another.

D. When does conduct become unlawful?

This is where most privacy writing goes wrong. These five levels are not interchangeable.

1. 1
   Lawful processing

   A business collects and uses data within the rules that apply to it — with notice, a lawful basis, and any required opt-outs honoured.

2. 2
   Invasive but not prohibited

   Data sharing that people find unsettling may still be legal where no statute reaches it, an exemption applies, or the business is out of scope.

3. 3
   Potentially non-compliant

   Conduct that may breach a specific requirement — e.g. failing to register as a data broker, ignoring a valid opt-out, or selling sensitive data without the required consent.

4. 4
   Alleged in an investigation or suit

   A regulator or plaintiff alleges a violation. An allegation is a claim, not a finding.

5. 5
   Confirmed by a decision or order

   An agency decision or final order establishes findings — the strongest form of public evidence short of adjudicated liability.

A regulator describing conduct as “illegal” in a press release is level 3 or 4 language; an agency decision or final order is level 5. A settlement is often accompanied by no admission of liability — which does not make it meaningless, but it is not a court finding.

E. What rights may you have?

Eligibility depends on jurisdiction, the business, the category of information, and exemptions.

California and Florida are shown because both are verified in this library. Absence of a jurisdiction here means we have not verified it — not that no rights exist there.

F. What can the visitor do?

• California residents: use DROP — the state's free deletion platform for registered data brokers. Read what it does and doesn't do →
• Check the registry: see whether a company is a registered California data broker in the CPPA registry.
• Credit-file errors: dispute with the consumer reporting agency. How the FCRA dispute right works →
• Complain: California consumers can file a privacy complaint with CalPrivacy.
• Exercise a specific right against a specific business: use that business's privacy request channel. See the Florida rights map →

These are free statutory routes. No service should imply you must pay to use your own legal rights.

G. What Sheila proposes to do

Sheila is prelaunch. Being precise about that is part of the product's posture, so here is the honest split.

The site's home page and its request-record interaction are illustrative, using synthetic data, and are labelled as such. Nothing on this site is a live account or a completed outcome.