Deletion Request With a Fraud Flag and a Broken GPC Signal
Northline Outfitters is a multichannel retailer with 4.2 million loyalty members and stores nationwide. On March 3, a California customer submits a deletion request through the web form and separately emails asking that her purchase history be erased 'including the fraud flag.' Her account shows a chargeback opened 11 days earlier and a $1,240 outstanding balance already referred to collections. The web form request came from an email address matching the account, but the requestor cannot answer the security question because she no longer has the phone number on file. A quarterly privacy scan shows that Northline's website honors Global Privacy Control signals, but the iOS app, which drives 61 percent of e-commerce revenue, does not, because the vendor SDK never reads the signal. The company also sends roughly 400,000 marketing texts a month under a consent checkbox that was pre-checked until last year, when it was changed to unchecked.
1. How should the deletion request be handled: verification, deadline, and any data that may or must be retained?
Read the worked answer
Start with verification. An email match plus an authenticated account session may be sufficient for low-sensitivity loyalty data; refusing solely because she cannot answer a phone challenge is weak, because verification must be reasonable and must not demand data the consumer no longer has. Offer an alternative method and log the decision.
The clock is 45 calendar days, extendable once by 45 days with notice. Substantively, deletion is not absolute. Records tied to the open chargeback, the collection account, and the fraud flag can be retained to detect and prevent fraud and to establish or defend legal claims; tax and accounting records support a legal-obligation exception. Everything else (marketing profile, browsing history, loyalty preferences, non-essential analytics) should be deleted or deidentified, including copies held by service providers.
The exam-relevant point is method: apply exceptions category by category, retain the minimum, document which exception covers each retained field, and respond in writing confirming what was deleted and what was retained and why. Blanket refusal invites a complaint; blanket deletion destroys the company's defense in its own chargeback.
2. Assess the GPC gap in the mobile app: exposure and required changes.
Read the worked answer
Global Privacy Control is a recognized opt-out of sale and sharing under the CCPA regulations when it clearly communicates the consumer's intent, and a business that detects it must treat the consumer as opted out. The website behavior is correct; the app is not. The app is almost certainly sharing data through the SDK, which passes device identifiers and app activity to ad partners for cross-context behavioral advertising.
Exposure: each non-compliant consumer interaction is a potential violation, with administrative fines up to $2,500 per violation and $7,500 for intentional violations. CPRA removed the automatic 30-day cure, so the agency is not obliged to offer a fix-it window. Colorado's universal opt-out requirement and Connecticut's opt-out preference signal requirement make the same conduct actionable in additional states.
Remediation is not just an SDK patch: capture the signal server-side so it survives app updates, propagate the opt-out to every tag and partner, test both platforms after each release, and add a visible in-app Do Not Sell or Share control. Convert the quarterly scan into an audit control with an owner, test evidence, and a remediation tracker rather than a one-off finding.
3. What is the exposure on the pre-checked text marketing consent, and how should it be remediated?
Read the worked answer
TCPA marketing texts require prior express written consent that is clear and conspicuous, identifies the number and type of messages, is not a condition of purchase, and is not pre-checked. A pre-checked box fails that standard, so the 400,000 monthly texts include messages sent without valid consent. Statutory damages run $500 per message, trebled to $1,500 for willful violations. The aggregate exposure is significant, and switching to an unchecked box last year does not cure messages sent earlier if those recipients stayed in the program.
Remediation: freeze texting to anyone whose consent originated in the pre-checked flow; run a documented re-consent campaign with an unchecked box and clear disclosure; record consent with timestamp, source, and exact language displayed; honor STOP immediately and reconcile against the internal opt-out list. Review state mini-TCPA statutes, several of which are enforced more aggressively than the federal rule.
Log the finding on the risk register and check other channels, because the same dark-pattern design that broke consent capture was probably used for email and loyalty enrollment.