OK, new evening project. I'm going to attempt to exercise my rights under CCPA from @joinClubhouse. I am not a user, but they harvest contact information and I believe that they have contact information about me.

First, I need to find out how to exercise my rights under CCPA....

Since they have no available privacy policy where they're supposed to disclose my rights, I'll attempt try [email protected].

This is kind of the legal/privacy version of pentesting.

Here's what I sent for those who are curious. Reminder - ALWAYS be kind to folks when exercising your rights or contacting support.

I emailed:
[email protected]
[email protected]

I've not received a bounce back for either, yet.

I would expect to hear some response (probably asking for more information) from them by EOD Tuesday. I sent my request after 4pm PT today, so someone may work on it tomorrow, and get back to me on Tuesday since Monday is a US holiday.

This is reasonable and under CCPA they have to "disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer."

When does the 45 day clock start? After I was verified or at my request?

Is my request a "verifiable consumer request" once I've provided more info? Or is it presumed verifiable when I make the request?

These are the ambiguities of CCPA that make it hard to operationalize.

I'd probably argue that if the company asks for additional verification shortly after I make the request, that the clock starts when I make the original request.

Because its a "verifiable" request not a "verified" request, meaning the request can be verified in the future.

But it doesn't seem fair to the company if I made a request on Day 1, company responds on Day 3 asking for verification, and then I don't respond until day 35, that the response would be due from the company on day 45. That gives the company 10 days instead of 45 to execute...

In practice, it's generally accepted that the clock would pause when it's not the company creating the delay. So, follow up with your verification requests if you're exercising your rights.

Not surprising, but I have not heard from @joinClubhouse about my request to access my data. 40 days left...

For clarity and education, they have to acknowledge within 10 biz days under the new CCPA AG regs.

Since Monday was a holiday that's Friday the 26th. Some inconsistencies in counting regime: initial response is 10 biz days, but full response to the request is 45 calendar days.

Still no word from @joinClubhouse. 10 biz day mark is Friday.

Hmm... @joinClubhouse missed their 10 day response timeline under the CCPA's AG Regs. Not a single peep from them re: facilitating my rights under CCPA.

Has anyone else been successful?

They’ve responded! And I explained again I don’t have an account but still want to know what they have about me as a result of their social graph “feature).

(Ignore the 519 unread emails... my inbox is a disaster)

Another day passes without a word from @joinClubhouse about my data access request under CCPA. No info on authentication Deadline to provide all my data to me & fully respond to my request is Sunday, March 28, 2021.

Anyone get a full response from them yet? cc @AGBecerra

For those following along on via the thread, here's a recent update: https://twitter.com/wbm312/status/1360014416087945222?s=20

I emailed them again this week. No response. Since no one at [email protected] or [email protected] responds. Anyone have emails for any of the current @joinClubhouse employees? DM me plz. I'm trying legal@ and paul@ too.

Honestly I'm tempted to pay for linkedin premium and try linkedin messages next. I'm *determined* to exercise my rights.

Hi @rohanseth @pdavison @mayawatson I've been trying to exercise my privacy rights under CCPA since Feb 11 but haven't gotten much of a response from @joinClubhouse. I've tried reaching out to [email protected] perhaps that email isn't checked by anyone? Help pls.

Since I got an initial response from them on Mar 1, I've emailed them follow ups on:
Mar 1
Mar 30
April 7

And am now getting desperate but still determined, so I'm pinging someone in their CX Ops group via LinkedIn. I think I have to give up on email.

Seriously, an AG complaint via their online form is fine, and one way to approach it-- they've clearly got legal issues. @joinClubhouse is clearly a scofflaw.

But really....I just want my data.

I just want to be able to exercise my privacy rights.

I'm sure you're all following along thinking, "wow this woman is needs a hobby—does she have nothing else to do?"

I do have stuff to do, but I don't think you realize what a determined person I am. It's very hard for me to give up on stuff like this—otherwise CCPA means nothing.

Dear @joinClubhouse,