San Francisco, Calif. – A Consumer Reports study finds that the new California Consumer Privacy Act (CCPA), which was signed into law on June 28, 2018 and became effective on January 1, 2020, is not fully protecting the digital rights of consumers, needs meaningful reform, and stronger enforcement.
The CCPA is the first law in the nation to give consumers the right to access, delete, and stop the sale of their personal information, rights that are particularly important as consumers spend even more of their time online during the ongoing COVID-19 pandemic.
In May and June 2020, Consumer Reports’ Digital Lab conducted a mixed methods study to examine whether the CCPA is working for consumers. The study, “California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? ” found:
- Consumers struggled to locate the required links to opt out of the sale of their information. For 42.5% of sites tested, at least one of three testers was unable to find a DNS link. All three volunteers failed to find a “Do Not Sell” link on 12.6% of sites, and in several other cases one or two of three testers were unable to locate a link.
- At least 14% of the time, burdensome or broken DNS processes prevented consumers from exercising their rights under the CCPA.
- At least one data broker used information provided for a DNS request to add the user to a marketing list, in violation of the CCPA.
- At least one data broker required the user to set up an account to opt out, in violation of the CCPA.
- Consumers often didn’t know if their opt-out request was successful. Neither the CCPA nor the CCPA rules require companies to notify consumers when their request has been honored. As a result, about 46% of the time, consumers were left waiting or unsure about the status of their request.
- About 52% of the time, the tester was “somewhat dissatisfied” or “very dissatisfied” with opt-out processes.
California Proposition 24, the ballot initiative to reform the CCPA that will be voted on by Californians on November 3, would address some, but not all of these problems with the CCPA. While the measure would strengthen enforcement and eliminate some loopholes in the CCPA that companies have exploited, it would introduce new loopholes as well.
“Despite the CCPA being signed into law, this study shows that the digital rights of Californians are still not fully protected,” said Justin Brookman, director of consumer privacy and technology at Consumer Reports. “Policymakers in California need to adopt crucial reforms to the CCPA in order to ensure that consumers can enjoy their right to privacy under the California Constitution.”
Maureen Mahoney, policy analyst at Consumer Reports, added, “Attorney General Xavier Becerra must strengthen enforcement of the CCPA to address non-compliance. While the CCPA is an important first step, the results of the study shows that the law needs to be enforced more aggressively and enhanced so that consumers can more easily exercise their privacy rights. ”
Media contact: Cyrus Rassool, cyrus.rassool@consumer.org