So I asked #CalPrivacy if my various identifiers are sent bundled together (which could enable linking them) or somehow disaggregated.

Good news! Their GREAT response:

***

CalPrivacy collects the minimal amount of information from consumers and, currently, the data is "debundled" and divided into 6 separate lists: email addresses, phone numbers, MAIDs, ConnectedTV IDs, VIN + Name, and (name, date of birth, zipcode).

Data brokers must select the list(s) that will make the most matches within their data bases. For example, some data brokers may only need the email address list, while others may need MAIDS and (name, date of birth zipcode). When data brokers pull the hashed list(s) of identifiers from DROP, each identifier is pulled separately. Therefore, they will not be able to link identifiers to other personal information that you submit to DROP.

Data brokers are legally obligated to only use the information provided by CalPrivacy to effectuate a deletion request and no other purpose.

***

🤓🎉 🏆