23 Jul 2025 Search

Getting set up with an authorized agent service is a key part of any effective privacy plan. The big problem, though, is that many of the surveillance companies I need to have my data deleted from are companies that have me identified by a third-party cookie or a mobile ad identifier (MAID). I can’t get them to delete my location data or whatever by asking using my email address or other identifiers for myself that I actually know. As Tony Ficarrotta writes, in Some authorized agent providers are selling privacy snake oil and why it needs to stop,

One common scenario businesses encounter is being contacted by an agent who requests deletion of personal information for a consumer. But in making that request, the agent includes excessive and unencrypted personal information about the consumer, such as full name, birth date, physical address and even photos of their driver’s license.

However, many businesses to whom these requests are sent process only pseudonymous information like device IDs and IP addresses. In those cases, it is not possible for the business to act on the request because they cannot associate names and physical addresses provided by agents with device IDs and IP addresses in their databases.

So, if I know my email address and phone number, but the company needs some other identifier to look me up, what can I do? One approach is to have the authorized agent run its own mobile app. Two problems with that.

  • A user who is signing up with an authorized agent is probably doing it as part of a personal privacy checklist that includes delete or reset MAID. So there is a good chance that the MAID the agent app sees will be different from the old MAID that companies already have.

  • The app can only see the MAID for the device it’s on. So any tracking using different identifiers, associated with different devices, isn’t going to be found.

But it looks like there’s a better way to do it. A Right to Know (RtK) to LiveRamp will result in a bunch of data, including two really helpful files: ps_ids.csv and ps_links.csv. Those files include the user’s MAIDs and third-party cookie values. So now an authorized agent can have a crib, to map user email addresses and phone numbers to multiple MAIDs that have been applied to that user, not just the MAID in effect on the current device. (Note: check number format if opening these files in a spreadsheet. Sometimes a long number gets displayed as scientific notation)

The fix for the missing MAID problem is to do an RtK on LiveRamp first, then do Right to Delete (RtD) to other companies that are likely to have MAID but not other identifiers.

Because MAIDs are long, hard-to-guess, strings, it would be hard for the recipient of an RtK with MAIDs to justify a complex verification process. Anyone who knows the MAID either already proved their identity to LiveRamp or has access to the device. This approach adds an extra step, since the agent has to wait for the LiveRamp RtK to go through, but greatly multiplies the power of the authorized agents that use it.Maybe we need to get some expert Magic The Gathering players to read the CCPA regulations and some sample RtK data, and come up with more combos. LiveRamp: Legendary Data Broker. If you successfully cast Right to Know on LiveRamp, all Obfuscated Identifier shields held by other players have no effect when you cast Opt Out or Right to Delete.

LiveRamp isn’t the only company that holds both user-known identifiers like email address and phone numbers and obfuscated identifiers like MAIDs. An authorized agent that uses this method should periodically send out RtKs to other likely sources. Reading privacy policies can provide some useful hints but it’s important to look at the data too.