Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Abstract

On June 28, 2018, the California State Legislature passed the California Consumer Privacy Act (CCPA), arguably the most comprehensive piece of online privacy legislation in the United States. Online services covered by the CCPA are required to provide a hyperlink on their homepage with the text “Do Not Sell My Personal Information” (DNSMPI). The CCPA went into effect on January 1, 2020, a date that was chosen to give data collectors time to study the new law and bring themselves into compliance. In this study, we begin the process of investigating whether websites are complying with the CCPA by focusing on DNSMPI links. Using longitudinal data crawled from the top 1M websites in the Tranco ranking, we examine which websites are including DNSMPI links, whether the websites without DNSMPI links are out of compliance with the law, whether websites are using geofences to dynamically hide DNSMPI links from non-Californians, how DNSMPI adoption has changed over time, and how websites are choosing to present DNSMPI links (e.g., in terms of font size, color, and placement). We argue that the answers to these questions are critical for spurring enforcement actions under the law, and helping to shape future privacy laws and regulations, e.g., rule making that will soon commence around the successor to the CCPA, known as the CPRA.

Opted Out, Yet Tracked: Are Regulations Enough to Protect Your Privacy?

“…Prior research has identified that online services design unintuitive and hard to navigate interfaces [39,52], trick users into giving positive consent [59], and do not include controls to opt-out of data selling [67]. Alizadeh et al [39] conducted a user study to understand data rights under GDPR and identified that the participants find data access interfaces unintuitive and hard to navigate.…”

“…Specifically, websites often register consent before the user has made any choice, register positive consent regardless of user's choice, or nudge users to give pre-selected positive consent. More recently, Nortwick and Wilson [67], conducted a measurement study of top 500K English websites and identified that only 2% of the websites provided controls to users to opt-out of data selling, i.e., "Do Not Sell My Personal Information" (DNSMPI), under CCPA.…”

“…Specifically, as per Section 1798.140 (c) (1), CCPA applies to online services, that have an annual revenue of more than $ 25 million, annually sell data of more than 50K California residents, or earn more than 50% of their revenue from the sale of personal data of California residents. Since most information required to determine applicability is not publically available, it is challenging to determine the applicability criteria at scale [67]. Thus, for our study, we did not strictly follow the CCPA applicability criteria.…”

“…However, despite strict enforcement, prior research has found that online services often trick users into giving positive consent [59], do not include controls to opt-out of data collection and processing [67], or deploy user interfaces that are unintuitive to navigate in terms of providing consent [39,52]. In cases where users are indeed able to exercise their rights, user data is poorly handled.…”

“…Regulators have mostly focused on auditing compliance of large well-known corporations, such as Amazon [5] and Google [29], perhaps because of the lack of systematic mechanisms to automatically detect infringements at scale [15]. Prior research [39,52,59,67] has focused on auditing the implementation deficiencies in consent management platforms/tools but it has largely ignored the instances where compliance is correctly conveyed but online services fail to comply. Though, negligence in implementation raises doubts on the seriousness of online services in protecting users' privacy, it does not by itself imply non-compliance.…”