Consumer Reports appreciates the opportunity to submit comments in response to the Notice of the Third Set of Modifications to Proposed Regulations Implementing the California Consumer Privacy Act. We welcome these proposed changes, especially those prohibiting the use of dark patterns—methods that substantially interfere with consumers’ efforts to opt out of the sale of their information. Consumer Reports has recently documented that some consumers are finding it very difficult to opt out of the sale of their information. In our recent study, over 500 consumers submitted opt-out requests to companies listed on the California data broker registry. Many of them encountered challenges: opt-out links too often were missing from the home page or difficult to find; opt-out processes were unnecessarily complicated, and companies asked consumers to submit sensitive information to verify their identities. In response, consumers sent over 5,000 messages to the AG, urging him to step up enforcement efforts and close up loopholes in the CCPA that companies have exploited. The guidance on opt outs, including the prohibition on dark patterns, in this latest proposal will go a long way to addressing these problems. But more work is needed to ensure that consumers can properly exercise their privacy rights. We recommend that the AG:
- Finalize the proposed guidance on opt outs, including the prohibition on dark patterns;
- Finalize a design for the opt-out button;
- Require companies to confirm that they have honored opt-out requests;
- Finalize the authorized agent provisions as proposed;
- Close up loopholes in the definition of sale and tighten protections with respect to service providers, to ensure that consumers can opt out of behavioral advertising;
- Clarify that financial incentives in markets that lack competition is an unfair and usurious practice; and
- Establish a non-exclusive list of browser privacy signals that shall be honored as a universal opt out of sale.