By Kathryn Frankenberg
Data has commercial value, but what happens when privacy protections could threaten the value of the product the data helped create? In response to increasingly aggressive data-collection efforts, many states have passed privacy laws to giving consumers greater control over the personal data they give to organizations.[1] These rights include the right to view a copy of personal data, export personal data, and request personal data be deleted, among others.[2] Though these laws often include anti-retaliation provisions[3] and provisions limiting the ability to waive these rights,[4] they do not explicitly address whether a business can condition continued access to its services on a consumer’s decision to exercise any right. Organizations may view some data rights, like access and deletion, as affecting the integrity and commercial utility of their data-driven products and services. For example, consider a certification service with a business model that rests on participants only having one chance to take their proprietary assessment: allowing a consumer to access her results or allowing her to delete her attempt and retake could undermine the integrity and value of the service it sells. Accordingly, a problem underlies the emerging privacy landscape: when consumer interests and business interests conflict, who wins? Do businesses retain the same discretion they had before consumer rights were enacted, or is there actually a new sheriff in town?
The deletion right presents the most straightforward version of the problem. Unlike other privacy rights, the deletion right is the greatest signal of a consumer distancing herself from the organization (besides account termination) because she is removing data from the organization that could be driving its product and creating value. Some state laws already recognize that the deletion right is not absolute; some laws permit an organization to retain some personal data after a deletion request when that data is necessary to continue providing the requested service.[5] Provisions like these distinguish between requesting the deletion of a consumer’s personal data and terminating a consumer’s relationship with the organization through complete account deletion. By permitting the retention of personal data after deletion requests, these laws recognize that there may still be a reasonable justification for a business’s retention of some personal data, including where retention is necessary to continue providing the service.
From there, a question arises: what is stopping an organization from receiving a deletion request and going one step further in deleting the consumer’s account, perhaps even permanently restricting access? California privacy law permits businesses to charge more for their product or service or provide reduced quality when the “difference is reasonably related to the value provided to the business by the consumer’s data.”[6] Could permanent account deletion be an extension of reduced quality? Some state privacy laws include language exempting controllers from “provid[ing] a product or service that requires the personal data of a consumer that the controller does not collect or maintain.”[7] Could a controller argue that it does not ‘maintain’ a consumer’s personal data after processing her a deletion request, therefore it no longer needs to offer access to that consumer?
Though the spirit of state privacy regulations may imply that this would be going too far, proposed federal legislation follows a different direction. The proposed American Privacy Rights Act of 2024 limited the retaliation ban to not “prohibit a covered entity from declining to provide a product or service” when the “collection, processing, retention, or transfer [. . .] is necessary, proportionate, and limited to providing such product or service.”[8] This phrasing at least suggests that the drafters contemplated circumstances when exercising a privacy right could legitimately affect access to a service and when it could arise. If businesses could invoke this exception when the utility of their product is threatened by administering privacy rights, the benefit conferred to consumers under these rights is reduced.
Until the ambiguity about whether these kinds of acts are a form of retaliation under enforceable privacy laws is resolved, consumers are right to be wary. Though organizations could be more transparent and disclose their ‘delete it and beat it’ policies, in terms or privacy notices, they have little incentive to do so. Data-subject rights were intended to increase consumer control over personal information, and this control is less meaningful if consumers bear the burden of choosing between exercising a statutory right and continued access to a service.
Kate Frankenberg is a 2L at Vanderbilt Law School and an IAPP CIPP/US, CIPP/E, and CIPM professional. She will spend the summer at a firm Washington, D.C., working within a Privacy and Cybersecurity group.
[1] See Frequently Asked Questions (FAQs), Cal. Priv. Prot. Agency, https://cppa.ca.gov/faq.html (last visited Aug. 26, 2026); see, e.g., Cal. Civ. Code §§ 1798.105–125 (Deering 2026); Va. Code Ann. § 59.1-577(A) (2026).
[2] See Cal. Civ. Code §§ 1798.105–125; Va. Code Ann. § 59.1-577(A)(3).
[3] See Cal. Civ. Code § 1798.125; Va. Code Ann. § 59.1-578(A)(4); Tex. Bus. & Com. Code Ann. § 541.101(b)(3) (West 2025).
[4] See Cal. Civ. Code § 1798.192; Va. Code Ann. § 59.1-578(B); Tex. Bus. & Com. Code Ann. § 541.054.
[5]See Cal. Civ. Code § 1798.105(d); Va. Code Ann. § 59.1-582; see generally Tex. Bus. & Com. Code Ann. § 541.202 (explaining that requirements may not restrict a controller’s retention of data if it is compatible with processing operations a consumer would expect or requested).
[6] Cal. Civ. Code § 1798.125(b)(1).
[7] Tex. Bus. & Com. Code Ann. § 541.101(c). See Va. Code Ann. § 59.1-578(A)(4).
[8] American Privacy Rights Act of 2024, H.R. 8818, 118th Cong. § 108(b)(3) (2024).