Comcast Xfinity CCPA Policy

Question

I have an old login with Comcast under a relative’s primary (billed) account that I'd like to have deleted under CCPA. The relative lives in Florida, but I am a California resident. I'm attempting to request the deletion of my login and personal information through CCPA.

After many emails and calls to Comcast's privacy department, I finally got them to proceed with my account deletion about a month ago. But a few days ago I got a voicemail that it hadn't gone through because the "primary account holder needed to approve it". Since I've already been authenticated and this CCPA request is solely for my own account and personal information, I don’t see why this is necessary. The primary account holder could call to delete their own account, but that would be subject to Comcast’s national policy and not covered by CCPA.

Is this a valid reason to deny a CCPA request? I’ve made it clear in writing multiple times that it is only for my own personal information.

Answer 1

Update: I've filed a complaint with the CA Attorney General. They automatically forwarded the complaint to Comcast and sent me a notice in the mail.

If you have filed a complaint against a business, we will forward your complaint to that business and request that it contact you promptly to resolve the issues you raised. Please note that we cannot represent you, advocate for you with the business, or force the business to satisfy individual requests for relief. Please contact the business directly to discuss your complaint.

While we cannot provide specific legal advice, please see the information below, which may help address your concern. For more information about the CCPA, please see https://oag.ca.gov/privacy/ccpa and https://cppa.ca.gov/.

[...]

If a business has violated the CCPA, you may notify the Office of the Attorney General by filing a consumer complaint. While we cannot file an action on behalf of an individual consumer over an individual violation, consumer complaints are an important source of information for the office. We will review consumer complaints to identify patterns of misconduct and to determine what law enforcement actions to take.

You can sue a business under the CCPA only if your unencrypted and un-redacted personal information was stolen in a data breach as a result of the business's failure to maintain reasonable security procedures and practices to protect it. You must generally give the business written notice of its violations and 30 days to fix the violations before you can sue. For more information about when you can sue for a CCPA violation, visit https://oag.ca.gov/privacy/ccpa

If you want to consult an attorney, you can obtain a referral to a certified lawyer referral service through the State Bar at (866) 442-2529 (toll-free in California) or (415) 538-2250 (from outside California), or online at https://www.calbar.ca.gov. If you cannot afford to pay an attorney, contact your local legal aid office to see if you qualify for free or reduced-rate legal assistance. For a referral to local legal aid offices, visit https://lawhelpca.org/ and click on the Search for Legal Help tab.

Comcast responded immediately to the forwarded complaint and appears to have deactivated my login, but nearly a month later have still not confirmed whether any personal information has been deleted.

I'd strongly recommend anyone in a similar situation to file a complaint as well. There's no guarantee the Attorney General or California Privacy Protection Agency will act on it, but it can increase the civil penalty to the company by $5,000 per complaint (see section 1798.155) and makes it more likely they will comply. Don't waste your time with any unnecessary calls from the business or obfuscating information yourself as a commenter here mentioned. Just submit your CCPA request in writing, complete the identity verification, wait the 45 days as allowed by the law (or 90 if an extension is requested, see section 1798.130), and file a complaint if it's not completed.

Update 2: I received a forwarded letter from Comcast to the Attorney General in response to my complaint. They lied and backdated their alleged completion date of the deletion request to fall within the 45 day deadline, despite emails I sent past their claimed date repeating the request as I was still able to login. Before filing a complaint, make sure to take screenshots showing you logged into the account and email it to the business in order to document it.