Open Security | Thoughts & Commentary

The first thing I notice is not the words. It is the hand.

On the shirt, a yellow caution triangle holds a simple pictogram: a hand, palm out, with a diagonal bar through it. Above or beside it, in the blocky lettering of a hazard placard, the words NOT FRIENDLY DO NOT TOUCH are set. The design borrows the grammar of industrial warning signage — the triangle, the high-visibility yellow, the imperative verb — and applies it to a person rather than a machine, a chemical, or a high-voltage cabinet.

That borrowing is the whole joke, and it is also the whole argument. A warning sign is not a personality. It is a promise about consequences. This shirt takes a format built to prevent injury and uses it to describe a social preference. The gap between those two things is where the design does its work.

What the sign actually says

Warning signs are a specific genre. They are terse because they have to be read at a glance, by someone who may be moving, distracted, or already in danger. The triangle is a standard shape for caution in many road and workplace systems; the yellow is chosen for contrast; the crossed-out hand is a prohibition pictogram, the same visual family as “no entry” or “do not touch” on a hot surface.

None of that is a claim about this particular shirt’s compliance with any standard. It is simply the visual vocabulary being quoted. The design does not invent a new symbol. It takes symbols most readers already know how to parse — caution, prohibition, imperative — and reassembles them into a sentence about a person.

The wording matters too. Not friendly is a description, not an instruction. Do not touch is an instruction. Put together, they read as a label someone else might have applied, now worn by the person it describes. The shirt is not asking for sympathy. It is not explaining why. It is posting a notice.

The difference between a slogan and a boundary

There is a useful distinction here that has nothing to do with merchandise and everything to do with how people communicate limits.

A slogan is a phrase you wear or repeat because it signals affiliation. It says I am this kind of person or I belong with these people. A boundary is a statement about what you will and will not accept. It says this is the edge of what I am offering right now.

The shirt sits awkwardly between the two, and that awkwardness is what makes it interesting. It is a slogan in form — printed on cotton, meant to be seen — but it borrows the authority of a boundary. The caution triangle does not say please. It says caution. The crossed-out hand does not say I would prefer. It says do not.

Whether that reads as funny, rude, or simply honest depends entirely on who is wearing it and where. The design does not resolve that. It hands the ambiguity to the wearer.

Why the pictogram carries more weight than the text

If the shirt said only NOT FRIENDLY, it would be a mood. If it said only DO NOT TOUCH, it would be a command without context — possibly unsettling, possibly a joke about personal space, possibly both.

The crossed-out hand is what turns the two phrases into a single coherent sign. It supplies the missing piece: the thing being warned against is contact. Not conversation, not eye contact, not proximity in general — touch. The hand is the specific hazard. The bar through it is the specific prohibition.

That specificity is what makes the design legible as a joke rather than a threat. A sign that said do not approach would be colder. A sign that said do not perceive me would be absurd. Do not touch is narrow enough to be funny and broad enough to be useful. It is the kind of boundary that many people would like to post and few feel entitled to.

The introvert framing and what it does not prove

The listing title includes the word introvert, and the design is often read in that context. I understand the association: the shirt presents a preference for limited social contact as a formal warning, which is a recognizable introvert joke. But I want to be careful here. The artwork itself does not contain the word introvert. It contains a warning sign. The introvert reading is an interpretation supplied by the title and by the audience, not a claim the design makes on its own.

That distinction matters because it keeps the design from being reduced to a personality label. The sign works whether or not you identify as an introvert. It works as a joke about workplace small talk, as a joke about being interrupted mid-task, as a joke about the difference between being polite and being available. The introvert framing is one reading among several, and the shirt does not require it.

What the shirt is not

It is not a security control. It is not a substitute for saying no out loud. It is not a diagnostic tool, a personality test, or a statement about anyone’s mental health. It is a printed design that quotes the visual language of caution signage and applies it to social contact.

I have not worn it, tested it, or observed how strangers respond to it. I am reading the artwork as it is described in the listing: the warning-sign lettering, the yellow caution triangle, the crossed-out hand. That is enough to make an argument about the design. It is not enough to make claims about comfort, fit, durability, or social outcomes, and I am not making those claims.

What I can say is that the design is unusually disciplined. It does not add a caption, a second joke, or a decorative element that would dilute the sign. It trusts the pictogram to carry the meaning, and the pictogram is strong enough to do it.

The useful question to ask of any boundary object

If you are considering a shirt like this — or any object that posts a limit on your behalf — the question worth asking is not is this funny. It is does this say what I actually mean, and does it say it to the right people.

The Not Friendly Do Not Touch shirt says something narrow and specific: contact is the hazard, and the warning is posted in advance. That is a usable boundary in the right setting and a confusing one in the wrong setting. The design does not pretend otherwise. It gives you the sign and lets you decide where to stand.

That is, in the end, what a good warning sign does. It does not negotiate. It does not explain. It tells you what to expect and leaves the rest to you.

Editorial note: This publication and Quirky Cotton Collective share an owner. This is not an independent review.

If you go looking for a single EU database that shows you who is paying to target your neighbourhood, your language group, or your voters with political ads, you will not find it. Not because the transparency is missing, but because the premise is wrong. Two different legal instruments create two different repositories, at two very different stages of maturity. Conflating them wastes the one resource you cannot recover: the time before a vote, a procurement hearing, or a statutory response clock runs out.

Here is the distinction that matters, and then a workflow you can run today with what actually exists.

Two repositories, two legal bases

The DSA ad repositories. Under Article 39 of the Digital Services Act (Regulation (EU) 2022/2065), providers of very large online platforms (VLOPs) and very large online search engines (VLOSEs) must maintain publicly accessible repositories of the advertisements displayed on their services. The European Commission describes these repositories — commonly called ad libraries — as providing information on the content of advertisements, who paid for them, the period during which they were displayed, how many users the advertisements reached, and the main criteria used to decide who saw them. The Commission frames them as tools for public scrutiny of online advertising, including safeguarding the integrity of elections, and states that they enable researchers, civil society, journalists and national authorities to detect risks including disinformation campaigns. Source: Commission call for evidence on advertising repositories and the related news item.

The EU political-advertising repository. This is a separate instrument. Regulation (EU) 2024/900 on the transparency and targeting of political advertising entered into full application on 10 October 2025. It requires political ads at EU, national and local level to be clearly labelled and to indicate who paid for them, their costs, and — when targeting or ad delivery techniques are used — the specific audience being targeted. On 12 October 2026 the Commission launched a pilot version of the European Repository for online political advertisements. The Commission says the repository will facilitate the work of researchers, civil society organisations, political actors, electoral observers and journalists in scrutinising the political advertising landscape. Source: Commission page on transparency and targeting of political advertising.

So: the DSA repositories are per-platform, cover ads generally, and are operating now. The EU political-ads repository is a single portal, purpose-built for political advertising, and is in pilot. Neither is a finished civic tool. Both are usable, with discipline.

One more trap to name before we start. The DSA transparency database is not an advertising repository. It collects statements of reasons — platforms’ explanations of content moderation decisions, i.e. why content was removed or restricted. It answers a different question from “who paid for this ad.” Keep the two evidence types separate or your findings will not survive scrutiny.

Step 1: Check whether the platform is in scope at all

Article 39 obligations attach to designated VLOPs and VLOSEs. If the platform your community actually uses — a local forum, a regional classifieds site, a niche messaging app — is not designated, the absence of an Article 39 repository is a scope fact, not a transparency failure. Write that down before you write anything else. The Commission publishes the list of designated platforms; check it against your community’s actual media diet rather than against the platforms you read about in Brussels coverage.

This step protects you from the most common error in civil-society ad monitoring: concluding “nothing found” means “nothing hidden.” Sometimes it means “not covered.”

Step 2: Build a search protocol before you open a single repository

Browsing an ad library aimlessly produces screenshots, not evidence. Decide in advance what you are looking for and how you will know you found it. A workable protocol has four parts:

• Community terms. The place names, language variants, transliterations, and misspellings your community actually uses. Include the terms your opponents use.
• Candidate sponsors. Parties, campaigns, PAC-equivalents, advocacy groups, and the opaque intermediary names that appear as payers. Search the payer field, not only the ad text.
• Time window. Anchor it to a real deadline — an election date, a planning decision, a reauthorization vote — and record the exact dates you searched.
• Platform list. Only the designated platforms from Step 1, in the order your community actually uses them.

Log every query, the date, the platform, and the result count. This log is the difference between a finding and an anecdote. It also lets a colleague, a lawyer, or a regulator reproduce your work.

Step 3: Read each record against the Article 39 fields

For every ad you pull, check whether the record gives you the five things the Commission says the repositories should provide: the ad content, who paid, the display period, the reach figure, and the main criteria used to decide who saw it. Note which are present, which are blank, and which are present but unusable — a reach figure with no date range, a payer name that is a shell, targeting criteria described only as “interests.”

Record gaps as findings. A missing field is a documented fact about the repository. It is not proof of wrongdoing by the advertiser, and it is not proof of coordination, illegality, or foreign interference. Those are conclusions that require evidence beyond a repository record. If your report implies otherwise, the platform’s lawyers will have an easy day and your community will have learned nothing durable.

Step 4: Separate political advertising from everything else

The DSA repositories do not classify ads for you. A record in a platform ad library may be commercial, issue-based, or political in the sense of Regulation (EU) 2024/900 — and the repository will not necessarily tell you which. The political-advertising Regulation’s own definitions and the Commission’s October 2025 guidelines on identifying political advertising are the reference point for that judgment, not the ad library’s category labels. Treat classification as an analytical step you perform and document, not a field you read off.

This matters most for the ads that sit on the boundary: a small-business association buying “issue” ads before a referendum, a trade group running “informational” content during a procurement consultation. Those are exactly the ads your community needs to see, and exactly the ones a naive keyword search will miss.

Step 5: Put the coming EU portal on your calendar, not in your workflow

The single EU political-ads portal is not ready. The Commission’s timeline is documented and worth diarising:

• 9 April 2026: the Commission adopted an Implementing Act setting out the common data structure, standardised metadata, authentication and API for the European repository for online political advertisements.
• 12 October 2026: pilot version of the repository launched.
• 2 December 2026: the call for evidence on upcoming DSA advertising-repository guidelines closes. The Commission invites responses from researchers, civil society organisations, journalists, VLOP/VLOSE providers and the advertising industry.
• Second quarter of 2028: publication of those guidelines is planned, following a targeted public consultation in 2027.

Sources: the Commission political-advertising page and the call for evidence page.

Two practical consequences. First, until the guidelines land, search quality across platform repositories will vary, and that variation is itself a finding worth documenting. Second, the call for evidence closing 2 December 2026 is the nearest open channel for telling the Commission what your community actually needs from a searchable ad repository — for example, that “how users are targeted and reached” be described in terms a non-specialist can verify. If you have run Steps 1–4, you have concrete material to submit. The Commission’s own list of what the guidelines will advise on includes making repositories easily searchable, providing insights on targeting and reach, and making ad content accessible.

What this workflow does not do

It does not give you a single search box across all platforms. It does not tell you whether an ad is lawful. It does not establish who is behind a shell payer, and it does not detect coordination between advertisers. It does not cover platforms outside the VLOP/VLOSE designation, and it does not substitute for the political-ads repository once that becomes operational. Where you need those things, you need different sources: company filings, campaign finance records, national electoral authorities, or the DSA transparency database for moderation decisions — each with its own limits.

A reproducibility checklist

Before you publish or file anything, confirm you can answer yes to each of these:

1. Did I record the date and time of every search, and the exact query string?
2. Did I confirm each platform’s designation status against the Commission’s list, and note any platform I excluded and why?
3. For each ad cited, did I capture the five Article 39 fields — content, payer, display period, reach, targeting criteria — and mark which were missing?
4. Did I keep repository records and DSA transparency-database records in separate evidence files?
5. Does every claim in my write-up trace to a saved record, a cited legal text, or a named Commission document — and does every interpretive claim say so?
6. Have I stated plainly what my evidence does not show?

If you can answer yes to all six, you have something a journalist can check, a regulator can act on, and a community can use. That is the standard the deadlines deserve.

Questions readers actually ask

Is there one EU database where I can search all political ads?

Not yet. The DSA Article 39 repositories are run by individual designated platforms. The single EU-wide repository for online political advertisements, created under Regulation (EU) 2024/900, launched in pilot form on 12 October 2026. Until it is fully operational, cross-platform searching means visiting each platform’s repository and logging your queries.

Does a missing ad from a repository mean it was never shown?

No. It may mean the platform is not designated, the ad fell outside your search terms or date window, the repository’s search is weak, or the record is incomplete. Each of those is a different finding with a different remedy. Document which one you are looking at.

Can I use the DSA transparency database to find ad buyers?

No. That database holds statements of reasons explaining content moderation decisions — why content was removed or restricted. It is a companion source for a different question, not an advertising repository.

What is the nearest deadline I can act on?

The Commission’s call for evidence on advertising-repository guidelines closes on 2 December 2026. It is open to civil society organisations and journalists, and it is the most direct route to shaping what a usable repository looks like before the guidelines are published, which is planned for the second quarter of 2028.

The shirt reads, in full capitals, LET’S ROOT FOR EACH OTHER AND WATCH EACH OTHER GROW. The words form a ring around four smiling root vegetables — a carrot, a radish, a beet, and an onion — each drawn with its roots visible in the soil. The pun is immediate: root as in cheer, root as in the part underground. But the design does something more specific than the pun alone, and it is worth reading closely before deciding whether the slogan is a promise you would actually want to make.

The four vegetables are not generic. They are the parts of a garden you pull up. The carrot is orange and tapered; the radish is round and red; the beet is deep magenta with a swollen root; the onion is layered and pale. Each has a face — eyes, a smile — and each is shown with roots descending into a band of soil. The roots are not decorative. They are the visual anchor of the whole composition, the thing that makes the second half of the sentence literal. Watch each other grow is not about applause. It is about the part you cannot see from above.

That distinction matters for anyone who has sat through a team meeting where mutual support was announced as a value. The shirt’s first clause — root for each other — is the easy half. Cheering is visible, cheap, and often performed. The second clause — watch each other grow — is the harder half. Watching growth requires attention over time, a willingness to notice change that is slow and underground, and the patience to let someone else’s root system develop without pulling it up to check. The design puts the roots in the picture precisely because that is the part the slogan is actually asking you to care about.

There is a second reading, and it is less comfortable. Watch each other grow can also mean monitor each other’s growth. In a work culture that treats development as a metric, the phrase can slide from encouragement into surveillance. The smiling vegetables soften that reading, but they do not erase it. A slogan is not a policy. The shirt does not tell you how to distinguish support from scrutiny, and it should not be asked to. What it does is put both meanings on the same line and let the roots carry the ambiguity.

The visual arrangement reinforces the point. The text surrounds the vegetables rather than sitting above them. The sentence is a frame, not a caption. That is a small design choice with a real effect: the words become the environment in which the roots grow, which is exactly the relationship the slogan describes. Mutual support is not a banner you hang over a team. It is the soil they are planted in. The shirt’s composition makes that metaphor visible without stating it.

For technical readers, there is a useful parallel that is not an analogy to software. The design distinguishes between the visible part and the root system. Most of what makes a team or a project work is underground: the undocumented decision, the quiet fix, the person who noticed the problem before it surfaced. A slogan that only celebrates the visible harvest misses the point. This shirt, whatever else it does, puts the roots in the frame. That is a more honest picture of growth than a row of perfect vegetables with no soil at all.

The shirt is available as a standard t-shirt from Quirky Cotton Collective. If you are looking for the lets root for each other shirt, that is the listing. The design is what it is: a pun, four smiling roots, and a sentence that asks you to mean both halves of it. Whether you do is not something a shirt can settle.

Disclosure: This publication and Quirky Cotton Collective share an owner.

The garment preview shows a dark shirt with very small, centered lowercase lettering: meh. No animal. No illustration. No slogan in a bold sans-serif shouting across the chest. The word sits in the middle of the fabric at a scale that asks you to lean in, and the period at the end does most of the work.

That period is the argument. Without it, meh is a sound — a shrug rendered in letters, open-ended, almost friendly in its vagueness. With it, the word becomes a complete sentence. A verdict. The smallest possible unit of written dismissal, punctuated and filed.

I keep thinking about this in the context of how technical teams write to each other. The most consequential messages in a newsroom, a security team, or a small business are rarely the long ones. They are the two-word replies that close a thread. The period is what makes meh. read as a decision rather than a mood.

What the artwork actually shows

The native garment preview for this listing — the Meh Funny Sarcastic Introvert Minimalist Saying shirt from Quirky Cotton Collective — shows very small, centered lowercase meh. lettering on a dark shirt. That is the whole design. The retail title uses words like “funny,” “sarcastic,” “introvert,” and “minimalist,” but those are marketing descriptions, not printed text. What is printed is four letters and a period, set small, centered, lowercase.

I want to be precise about that distinction because it matters for reading the object. The title tells you how the seller hopes you will categorize it. The artwork tells you what it actually is. A shirt that says meh. at small scale is not the same object as a shirt that says MEH in forty-point type. The scale changes the speech act. Large type performs the feeling for an audience. Small type registers it privately, almost as a note to self.

The period as a boundary marker

In work culture, the difference between a slogan and a usable promise is often punctuation and scope. “We should improve security” is a slogan. “We will rotate the signing key by Friday” is a promise you can check. The period in meh. does something similar at a much smaller scale: it converts an ambient attitude into a closed statement.

I read the shirt as a boundary object, not a joke object. The word is small enough that it functions less like a broadcast and more like a label you wear for yourself. It says: this is the current setting. It does not say why, and it does not invite a meeting about why. The period is the part that declines the follow-up question.

That is a useful thing to have language for, especially for readers who spend their days writing incident reports, procurement comments, and public-records requests. A lot of professional communication fails because people cannot distinguish between “I have a concern” and “I have decided.” The shirt is a tiny grammar lesson in the difference.

Minimalism as a design claim, not a personality claim

The retail title calls this “minimalist,” and visually that holds: one word, one color of text on a dark ground, centered, no border, no secondary graphic. But minimalism in design is not the same as minimalism in personality. The shirt does not prove the wearer is an introvert, and the listing does not claim it does. It is a garment with a small word on it.

What interests me is how the design uses restraint to make the word feel heavier. A large meh is a costume. A small meh. is closer to a caption. The period lands differently at that scale because your eye has to travel to the center of the shirt to find it. The design rewards a second look, which is an odd thing to ask of a t-shirt and also a quietly effective one.

What this shirt is not

It is not an animal design. The preview shows no illustration, and the listing’s own visual observation confirms no animal is present. It is not a pride variant. It is not a diagram, a chart, or a technical joke. Readers who come to this column for document requests and reproducible procedures will find none of that here — and that is fine. This is an off-duty object column, and the object is a small word with a period after it.

I am not going to tell you it improves your mood, your boundaries, or your team’s communication. A shirt does not do that. What I will say is that the design makes a specific visual argument about scale and finality, and that argument is legible in the preview without any additional context.

The useful question to ask of any slogan shirt

When you look at a shirt like this, the question is not “is it funny.” The question is “what does the typography commit to.” Here, the commitment is small, centered, lowercase, and punctuated. That is a coherent set of choices. It reads as deliberate rather than accidental, and the period is the clearest evidence of deliberation.

If you are the kind of reader who keeps a running list of phrases that do useful work in a meeting — “noted,” “declined,” “out of scope,” “meh.” — this shirt is a wearable entry in that list. If you are not, it is a dark shirt with a small word on it. Both readings are honest. The artwork supports the first and does not require the second.

Editorial note: This publication and Quirky Cotton Collective share an owner.

The shirt shows four words in white capitals — I HAD POTENTIAL — above a white curved ramp that descends from an upper-left ledge to a lower-right flat ledge. On the upper ledge sits a dashed, empty circle. On the lower ledge rests a solid white ball. The ramp is curved, not a straight diagonal. That is the whole design. No caption, no equation, no arrow. The joke lives in the difference between the two circles and the path between them.

I want to take the drawing seriously for a moment, because it is doing something more precise than the usual slogan shirt. The phrase “I had potential” is a familiar piece of self-deprecation — the past tense does the work, implying that whatever potential existed has since been spent, lost, or converted into something less impressive. But the diagram underneath complicates that reading. It is not a picture of failure. It is a picture of conversion.

In physics, potential energy is stored energy — the energy an object has because of its position. A ball at the top of a ramp has gravitational potential energy relative to the bottom. As it rolls down, that potential becomes kinetic energy: motion. The ball does not lose energy; it changes form. The dashed circle at the top represents the ball before it moves — the potential state, the could-be. The solid ball at the bottom represents the ball after the descent — the actual, the has-been. The dashed outline is the ghost of what might have been; the solid fill is what is.

That is a more interesting joke than “I wasted my potential.” It is a joke about the difference between a diagram and a life. In the diagram, the conversion is clean: potential becomes motion, motion becomes position, and the ball arrives. In a life, the conversion is messier. The dashed circle does not always become a solid ball on a tidy lower ledge. Sometimes it becomes a different shape entirely, or rolls off the page, or sits at the top for years because nobody built the ramp. The shirt does not say any of that. But the drawing leaves room for it, and that room is where the humor lives.

The design is also unusually restrained for a garment that could have been loud. The palette is white on whatever the shirt color is — no accent color, no second joke, no arrow labeled “kinetic energy” to make sure you got it. The capitals are even and unadorned. The ramp is a single curved line. The two circles are the only shapes that differ from each other, and that difference is the entire argument. A lesser design would have added a caption like “energy cannot be created or destroyed” or a small figure of a person watching the ball roll away. This one trusts the reader to see the dashed circle and the solid ball and understand that they are the same object at two different moments.

I find that restraint worth noting because it is rare in novelty printing. Most joke shirts over-explain. They put the punchline in the text and the text in the largest possible font, and the image, if there is one, is decoration. Here the text and the image are doing separate jobs. The text supplies the self-deprecating voice — the first-person confession, the past tense, the sigh. The image supplies the correction. The image says: actually, the potential did not disappear. It became something. Whether that something is disappointing is left to the wearer.

That split between voice and diagram is what makes the shirt work as an object rather than a slogan. A slogan asserts. A diagram demonstrates. When you put them together, you get a small argument between what the wearer says about themselves and what the drawing shows. The wearer says “I had potential.” The drawing says “potential is a state, not a verdict.” The joke is that both are true, and neither cancels the other.

For readers who spend their working lives around diagrams — network topologies, decision trees, state machines, incident timelines — there is a familiar pleasure in seeing one used this way. A good diagram does not tell you what to conclude. It shows you the relationships and lets you draw the conclusion yourself. This shirt does that with two circles and a curve. The dashed circle is the input; the solid ball is the output; the ramp is the process. The process is not judged. It is just drawn.

I would not claim the shirt teaches physics, or that it makes a scientific argument, or that it improves anything. It is a piece of printed cotton with a joke on it. But the joke is well built, and the building is worth noticing. The curved ramp matters: a straight diagonal would have read as a slide, a playground object, something a child goes down. The curve reads as a track, a path with a shape, something an object follows. The dashed circle matters: a solid circle at the top would have made the joke about arrival rather than transformation. The empty outline is what makes the past tense funny instead of sad.

If you are the kind of person who keeps a whiteboard covered in boxes and arrows, or who has ever explained a state machine to a colleague using a napkin, the shirt is a small, wearable version of that pleasure. It is available as the I Had Potential shirt from Quirky Cotton Collective. The design is white on the garment shown, with the four words above the ramp and the two circles below. That is what the listing shows, and that is what the drawing is.

The rest is interpretation. I read the dashed circle as the before and the solid ball as the after. I read the curve as a process rather than a fall. I read the past tense as a joke about conversion rather than a confession of waste. None of that is printed on the shirt. It is what the shirt leaves room for, and the room is the point.

Editorial note: This publication and Quirky Cotton Collective share an owner.

If you live in California, you have a legal right to ask a business to delete the personal information it collected from you. That right is real, it is written into statute, and it comes with obligations the business owes you in return. What it does not come with — at least not in any primary source I could verify — is a 45-day response deadline. This article was originally framed around that number. I went looking for the text that establishes it and could not find it. So rather than repeat a figure I cannot trace, I am going to show you what the statute and the Attorney General’s office actually say, and then give you a procedure you can run today that does not depend on a number nobody has shown you.

That is the method this publication uses: every claim traceable to a primary document, an open standard, or a procedure you can reproduce. When a number fails that test, it gets dropped, not softened.

Who the right belongs to

The CCPA right to delete belongs to California residents. The Attorney General’s office defines a California resident as “a natural person (as opposed to a corporation or other business entity) who resides in California, even if the person is temporarily outside of the state” (OAG, CCPA FAQs, FAQ 2). If you are a journalist on assignment abroad, a student on exchange, or an activist temporarily out of state, your residency does not lapse because your body crossed a border.

Two limits matter here. First, the CCPA generally does not apply to nonprofit organizations or government agencies (OAG FAQ 6). Second, it applies to for-profit businesses that do business in California and meet at least one threshold: gross annual revenue over $25 million; buying, selling, or sharing the personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling Californians’ personal information (OAG FAQ 5). A small business you deal with may simply not be covered. That is not an excuse for bad practice, but it changes what you can demand under this law.

What the right to delete actually covers

The Attorney General’s summary is plain: “You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information)” (OAG FAQ 1).

The statute behind that summary is Civil Code § 1798.105. Subdivision (c)(1) sets out what a business must do when it receives a verifiable consumer request: delete the information from its records, notify any service providers or contractors to delete it from their records, and notify all third parties to whom the business sold or shared the information to delete it — “unless this proves impossible or involves disproportionate effort” (reproduced text of § 1798.105).

Read that sentence as a checklist, because it is one. A complete response tells you, at minimum, that the business deleted from its own records, that it directed its service providers and contractors to do the same, and that it notified third parties it sold or shared with — or it explains why notification was impossible or disproportionate. A response that says only “we have deleted your data” addresses one of three obligations and is silent on the other two.

The exceptions you should expect to see cited

Section 1798.105(d) lists the grounds on which a business need not comply. They include maintaining the information to: complete the transaction for which it was collected or otherwise perform a contract with you; ensure security and integrity where reasonably necessary and proportionate; debug to identify and repair errors; exercise free speech or protect another consumer’s free-speech rights; comply with the California Electronic Communications Privacy Act; engage in public or peer-reviewed scientific, historical, or statistical research under specified conditions; enable solely internal uses reasonably aligned with your expectations and compatible with the context in which you provided the information; or comply with a legal obligation.

This list is the vocabulary a legitimate refusal uses. If a business declines your request without naming which of these applies, the refusal is incomplete on its face — not necessarily unlawful, but not yet an answer you can evaluate. Your reply can be short: Which subdivision of § 1798.105(d) are you relying on, and which service providers and third parties were notified under § 1798.105(c)(1)? That question requires no legal training and produces a checkable record.

Verification is the step where requests stall

The statute conditions the business’s duty on a verifiable consumer request. The CCPA regulations exist in part to govern “how to verify the identity of consumers making requests” (OAG, CCPA Regulations). Expect the business to ask you to confirm you are who you say you are. That is the law working as designed, not obstruction — though a request for more data than verification reasonably requires is worth questioning.

If you are filing on someone else’s behalf, plan ahead. The Attorney General’s office confirms you may authorize another person, or a business entity registered with the California Secretary of State, to submit a request on your behalf. It also warns that businesses “may require the authorized agent to provide proof that you gave that agent signed permission to submit the request” and “may also require you to verify your identity directly with the business or directly confirm with the business that you gave the authorized agent permission” (OAG FAQ 12). Have the signed permission ready before you file. An agent who has to go back for paperwork loses time and creates ambiguity about when the request was actually received.

A procedure you can run today

1. Find the business’s designated method. Start with its privacy notice. The CCPA requires businesses to disclose consumers’ rights to request deletion (§ 1798.105(b), pointing to § 1798.130). The notice should tell you how to submit a request. If it does not, that gap is itself worth recording.
2. Write the request in plain language and date it. State that you are a California resident, that you are exercising your right to delete under Civil Code § 1798.105, and that you want deletion from the business’s records and direction to its service providers and contractors, plus notification of third parties to whom it sold or shared your information. Keep a copy with the date and time you sent it and the channel you used.
3. Respond to verification promptly, and only as far as needed. If you use an agent, attach the signed permission with the first message.
4. Read the response against the statute, not against a blog. Check for the three actions in (c)(1) and, if the business refuses, for a named ground in (d).
5. If the response is incomplete, ask the two questions above in writing. You are building a record, and the record is the point.

One hypothetical to make the last step concrete: suppose a reader receives a one-line email saying “your request has been processed” with no further detail. The reply is not a demand or a threat. It is a request for the specific statutory basis and the specific notifications. Either the business supplies them — and the reader now has documentation of what happened — or it does not, and the reader has a dated record of an unanswered question.

What to do when a business does not comply

Be clear-eyed about remedies. The Attorney General’s office states that you cannot sue businesses for most CCPA violations; private suits are limited to data-breach circumstances, and even then only under narrow conditions (OAG FAQ 7). For other violations, “only the Attorney General or the California Privacy Protection Agency may take legal action against non-compliant entities.” The Attorney General “does not represent individual California consumers” but uses complaints and other information “to identify patterns of misconduct that may lead to investigations and actions on behalf of the collective legal interests of the people of California” (OAG FAQ 7).

That is the honest frame for a deletion request: it is evidence-gathering for collective enforcement, not a personal remedy. You can file a consumer complaint with the Attorney General’s office, explaining exactly how the business violated the CCPA and when and how it happened. Since July 1, 2023, you can also file complaints with the California Privacy Protection Agency for violations occurring on or after that date (OAG FAQ 7). Neither office will represent you or give you legal advice on your individual complaint.

What this article does not cover

It does not tell you that a business must respond within 45 days, because I could not verify that deadline in the sources I retrieved. The regulation section that would govern deletion requests (11 CCR 7022) returned only its title when I checked, with no operative text. If a response deadline exists in the current regulations, it belongs in a follow-up once the text is in hand — and readers deserve the citation, not the assertion. This article also does not cover the separate obligations in § 1798.130 in detail, the complaint intake mechanics beyond the Attorney General’s general statement, or any specific company’s handling of any specific request. No such record was retrieved, and I will not invent one.

Questions readers actually ask

Can I ask a business to delete data it collected about me indirectly, not from me? The statutory right in § 1798.105(a) is framed around personal information “which the business has collected from the consumer.” How far that reaches in practice depends on facts and on the regulations; this article does not resolve it, and you should not assume the broadest reading.

Does the business have to delete everything? No. Section 1798.105(d) preserves information reasonably necessary for the listed purposes, including legal obligations. A refusal that names one of those grounds is a different thing from a refusal that names nothing.

Can I use an agent? Yes — another person or a registered business entity — but expect to document the authorization and possibly to verify your identity directly (OAG FAQ 12).

Can I sue if they ignore me? For most CCPA violations, no. Enforcement for non-breach violations runs through the Attorney General and the California Privacy Protection Agency (OAG FAQ 7).

What is the single step I can take today? Open the privacy notice of one business that holds your data, find its deletion-request method, and send a dated written request that quotes § 1798.105 and asks for the three actions in (c)(1). Save the copy. The record you create is the thing a regulator can act on — and the thing you can check a response against.