San Francisco, Calif. – Consumer Reports today released findings from a new study of California’s landmark privacy law, and submitted the findings to the Attorney General of California as part of its work to strengthen consumer data rights.
The California Consumer Privacy Act (CCPA) was signed into law on June 28, 2018 and became effective on January 1, 2020, giving consumers the rights to access, delete, and stop the sale of their personal information. The CCPA has an “authorized agent” provision that allows a consumer to designate a third party to perform data requests on their behalf, allowing a practical option for people to exercise their privacy rights under the CCPA.
In this new study, Digital Lab researchers at Consumer Reports signed up 124 California volunteers to an authorized agent service and issued legally valid opt-outs to 21 companies on their behalf. A range of companies were included in the study, from low-profile data brokers to big consumer brands such as Airbnb, Amazon, AT&T, Comcast, Equifax, Intuit, Oracle, and Starbucks.
The study finds that the authorized agent provisions hold promise to help consumers exercise their data rights, but additional rulemaking and industry norms are needed to make authorized agents effective at scale for California’s 40 million residents.
According to the report, some companies claimed that the opt out did not apply to them. Others required extra, inappropriate steps for opt-out processing. Many companies processed opt outs only partially, and some made it difficult, if not impossible, to submit opt outs in the first place.
Below is a quick snapshot of the findings:
- 12 of 21 companies (57%) ultimately confirmed that they stopped the sale of at least some data in response to all of the opt-out submissions.
- 5 of 21 companies (24%) claimed not to sell consumer data and dismissed the opt-out requests.
- 3 of 21 companies (14%) did not provide confirmation that all of the opt outs had been processed.
- 1 of 21 companies (5%) requested non-standard information that we had not collected from consumers, so we did not complete the opt-out process.
- Of the companies that responded to the Consumer Reports agent-submitted opt-out request, the average response time was 7 business days.
CR’s authorized agents often met confusing web forms and ambiguous communications from companies, which posed challenges in submitting opt outs and gauging their effectiveness. Some companies did not confirm with the agent that the opt-out request was received, in process, or completed, and some who did confirm did so with confusing language. Without certainty about whether requests had been received and acted upon, it was hard for the CR agent to keep volunteers informed as to the state of the data requests made on their behalf.
The report also shows that some companies made changes to their practices after being alerted to CR’s findings. Companies including Acxiom, Brandwatch, LiveRamp, and Oracle have updated their interfaces to make them easier to navigate.
Consumer Reports is calling on consumers to sign a petition asking the California Attorney General’s office to step up enforcement and ensure targeted advertising is covered by the opt out process.
“We were very glad to see several companies address the issues that surfaced in our research given how anxious consumers are ready to exercise their digital rights in California. An authorized agent, such as the one we launched, will be helpful in serving as a trusted third party to make it significantly easier for people to manage their data and personal information,” said Ben Moskowitz, director of the Digital Lab at Consumer Reports.
However, Consumer Reports has found that the law is not fully protecting the digital rights of consumers. The law puts the burden on consumers to submit requests at hundreds, if not thousands, of companies to protect their privacy, and opt-out processes can be cumbersome.
A key provision of the CCPA is that consumers have the right to direct a company to stop the sale of their personal information to third parties—and to authorize someone to opt out on their behalf. California Proposition 24, a Consumer Reports supported ballot initiative to reform the CCPA, was approved by California voters last fall. The ballot initiative will eliminate some of the loopholes that companies in this study have used to continue to deliver behavioral advertising outside of the opt out. However, regulators will need to continue to refine the CCPA regulations—including by requiring companies to notify consumers or agents when opt-out requests have been honored—to help ensure that the agent-submitted requests are effective.
Maureen Mahoney, policy analyst at Consumer Reports, added, “The authorized agent provision in the CCPA is key to making the law more workable for consumers. But the California Attorney General must step up efforts to ensure that is working effectively. The AG should clarify that targeted advertising falls under the opt out, and strengthen enforcement of the CCPA to ensure that companies honor requests in good faith. The results of the study show that the law needs to be enforced more aggressively and enhanced so that consumers can more easily exercise their privacy rights. ”
This study is part of an ongoing series of data rights investigations that is funded in part by Craig Newmark Philanthropies and the Omidyar Network.
Consumer Reports is calling on consumers to sign a petition asking the California Attorney General’s office to step up enforcement and ensure targeted advertising is covered by the opt out process.
Media Contact: Cyrus Rassool, cyrus.rassool@consumer.org
About the Digital Lab
The Digital Lab at Consumer Reports is a growing hub where technologists, lawyers and journalists are working together to advance consumer rights in today’s marketplace. The Digital Lab also appoints non-resident fellows to advance public interest technology research. Learn more at lab.cr.org.