CA AG’s investigation includes a focus on businesses that failed to process consumers’ privacy requests submitted through authorized agents
California Attorney General Rob Bonta recently announced an investigative sweep, sending letters to businesses with mobile apps that may be failing to comply with the California Consumer Privacy Act (CCPA). This announcement included a focus on businesses that failed to process consumer requests submitted through authorized agents, including Permission Slip, an experimental authorized agent created by Consumer Reports.
Consumer Reports and other groups have been working to advance privacy laws in states such as California to protect the data of consumers. However CR’s research shows that companies’ approaches to data privacy can be confusing, inconsistent, and difficult to navigate. The CCPA anticipated these challenges and built in a provision for authorized agents that could help consumers exercise their data rights by serving as an intermediary between consumers and companies. Under the law, consumers can enlist an individual or institution to be their authorized agent and make data requests on their behalf, such as opting out of information sharing or deleting their personal data.
Since then, many intermediaries have entered the market, and many consumers have chosen to enroll an intermediary to help manage their data. One such intermediary is Permission Slip by Consumer Reports, a mobile app that aims to make it easy for consumers to take control of the personal data companies have about them. CR made Permission Slip available in the iOS app store in November and plans to formally launch the service later this year, when it will also be available on the Play Store for Android.
“We’re delighted to see the Attorney General’s office holding companies accountable to privacy laws that protect consumers,” said Ginny Fahs, Director of Product R&D, Innovation Lab at Consumer Reports. “In particular, the office’s attention to requests sent by authorized agents is significant. People often struggle to use their privacy rights, and enrolling an agent can help simplify the process. This is a win for consumers and for the privacy of their data.”
In addition to Permission Slip, CR has been incubating a new open standard for data rights with industry called the Data Rights Protocol. The protocol is being co-developed by a consortium of Consumer Reports and nine organizations across marketplace roles: authorized agents, b2b privacy infrastructure provider companies, and businesses that need to comply with CCPA. The protocol and the app are the latest efforts by CR to elevate digital rights.