Measuring Compliance with the California Consumer Privacy Act Over Space and Time

Abstract

The widespread sharing of consumers' personal information with third parties raises signicant privacy concerns. The California Consumer Privacy Act (CCPA) mandates that online businesses oer consumers the option to opt out of the sale and sharing of personal information. Our study automatically tracks the presence of the opt-out link longitudinally across multiple states after the California Privacy Rights Act (CPRA) went into eect. We categorize websites based on whether they are subject to CCPA and investigate cases of potential non-compliance. We nd a number of websites that implement the opt-out link early and across all examined states but also nd a signicant number of CCPA-subject websites that fail to oer any opt-out methods even when CCPA is in eect. Our ndings can shed light on how websites are reacting to the CCPA and identify potential gaps in compliance and optout method designs that hinder consumers from exercising CCPA opt-out rights.