DeepAI
Log In Sign Up

(Un)clear and (In)conspicuous: The right to opt-out of sale under CCPA

09/16/2020
by   Sean O'Connor, et al.
0

The California Consumer Privacy Act (CCPA)—which began enforcement on July 1, 2020—grants California users the affirmative right to opt-out of the sale of their personal information. In this work, we perform a manual analysis of the top 500 U.S. websites and classify how each site implements this new requirement. We find that the vast majority of sites that implement opt-out mechanisms do so with a Do Not Sell link rather than with a privacy banner, and that many of the linked opt-out controls exhibit features such as nudging and indirect mechanisms (e.g., fillable forms). We then perform a pair of user studies with 4357 unique users (recruited from Google Ads and Amazon Mechanical Turk) in which we observe how users interact with different opt-out mechanisms and evaluate how the implementation choices we observed—exclusive use of links, prevalent nudging, and indirect mechanisms—affect the rate at which users exercise their right to opt-out of sale. We find that these design elements significantly deter interactions with opt-out mechanisms (including reducing the opt-out rate for users who are uncomfortable with the sale of their information) and that they reduce users' awareness of their ability to opt-out. Our results demonstrate the importance of regulations that provide clear implementation requirements in order empower users to exercise their privacy rights.

READ FULL TEXT

page 6

page 7

page 8

06/21/2022

The Impact of Visibility on the Right to Opt-out of Sale under CCPA

The California Consumer Protection Act (CCPA) gives users the right to o...
09/05/2019

(Un)informed Consent: Studying GDPR Consent Notices in the Field

Since the adoption of the General Data Protection Regulation (GDPR) in M...
11/28/2017

Intelligent Notification Systems: A Survey of the State of the Art and Research Challenges

Notifications provide a unique mechanism for increasing the effectivenes...
09/09/2022

SSOPrivateEye: Timely Disclosure of Single Sign-On Privacy Design Differences

The number of login options on websites has increased since the introduc...
09/28/2021

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

Vagueness and ambiguity in privacy policies threaten the ability of cons...
05/19/2022

An Empirical Evaluation of the Implementation of the California Consumer Privacy Act (CCPA)

On January 1, 2020, California passed the California Consumer Privacy Ac...