Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the compliance of California-registered data brokers with consumer opt-out and deletion requests mandated by the California Consumer Privacy Act (CCPA). Despite a majority of brokers appearing compliant, a significant number failed to respond to requests, and many imposed intrusive identity verification processes that violate CCPA regulations. The findings highlight a troubling disparity in the request submission process and underscore the urgent need for improved standardization and enforcement mechanisms to protect consumer privacy rights effectively.
A significant number of data brokers ignore consumer privacy requests, revealing critical gaps in compliance with the CCPA that could jeopardize personal data security.
Data brokers are a largely American phenomenon. They collect vast amounts of personal information about most adult U.S. consumers, mainly without the latter's knowledge or consent. Accumulated data can be sold to anyone, including employers, landlords, insurance agencies, banks, governments (local, state, federal, and even foreign), as well as various malicious actors. This, in turn, enables discrimination, surveillance, identity theft, and stalking. Recent regulations -- such as the California Consumer Privacy Act (CCPA) modeled after EU's General Data Protection Regulation (GDPR) -- were introduced to bolster consumer privacy, e.g., the rights to: (1) opt-out of the sharing or selling one's personal information, (2) delete one's personal information, and (3) obtain a copy of that information. However, exercising these rights is not easy, as shown by our comprehensive study of the data broker ecosystem. We submitted both opt-out and deletion requests (using synthetic consumer identities) under the CCPA to all California-registered data brokers and investigated their responses and lack thereof. While the majority seem to be compliant, a significant fraction is not and many failed to reply to (and/or acknowledge) consumer requests. Furthermore, some data brokers require intrusive consumer identity verification in order to exercise one's opt-out rights, which is explicitly disallowed by the CCPA. There is also great disparity in the request submission process among data brokers as well as an extremely heavy (time and effort) overall consumer burden. This motivates an urgent need for streamlining and standardization of the consumer interface, stronger enforcement, and meaningful consequences for (especially sustained) non-compliance.