I Built AI Agents That Ask Companies to Delete Their Data. Most Never Answered

I still vividly remember when GDPR was being implemented. LinkedIn was suddenly filled with GDPR gurus and insightful posts about how impactful the laws are, lawyers were constantly producing new contract templates and forms, companies were sending bulletins informing their users about their updated policies. I had to sign 6 documents related to GDPR when buying a car (we counted it with the dealer).

Developers had it easy, because all they had to do was putting a new page on the website, maybe add a cookie banner when they were at it (it didn't have to do anything besides being an annoyance to the user; lawyers didn't care about the technical aspect since they wouldn't know what a cookie was to begin with).

No client I was contracting for has ever asked about what would it take to actually satisfy the erasure request or whether we only store the data we actually need. Suggesting removal of the data or not collecting them at all and respecting prior consent to marketing campaigns (which the law here actually mandates) were often frowned upon or just ignored.

Outside of the big companies where the fines are likely, GDPR was mostly just a legal excercise from the start. I sent probably like 20 requests over the years (usually as a retaliation to spam), I remember maybe 3 companies acting on them and few more at least unsubscribbing me from their newsletters. One of those companies was a real-estate agency that I contracted for few years later; found my full record in the CRM database with a note saying I'm a dick.