The California Consumer Privacy Act (CCPA), which took effect in January 2020, gives residents important rights, including the right to see the personal information businesses have collected about them, the right to delete some of that information, and the right to ask businesses not to sell it. But a survey of Californians commissioned by Consumer Action and Consumer Federation of America (CFA) showed that while more than two-thirds of respondents had seen a notice about their CCPA rights on the websites of businesses they visited in the previous 12 months, many had not exercised the law’s three key rights, and the top reason given for not doing so was that they did not realize they could.
The survey is part of a project, The California Privacy Initiative, that Consumer Action and CFA launched with support from the Rose Foundation to educate Californians about the law and encourage them to exercise their CCPA rights. “People are increasingly being tracked, online and offline, as they go about their daily lives, and the information collected about them can determine what offers they receive—not only for products and services, but for employment, credit, housing and other economic opportunities—and the prices or rates they pay,” said Ken McEldowney, executive director of Consumer Action. “The rights to see, delete and stop their data from being sold helps Californians protect themselves from unwanted, unfair and harmful uses of their personal information.”
The online survey, conducted in English and Spanish by Engine Insights from Oct. 7 to Oct. 12, 2021, collected responses from 1,507 California residents who are 18 or older. In addition to asking about their awareness of and experience with their CCPA rights, the survey asked whether businesses should be required to obtain people’s consent before collecting, using, selling or sharing their personal information for purposes other than to provide the goods or services they requested.
Nine out of 10 survey respondents said that businesses should be required to get their permission if they want to collect, use or share their personal information for any purpose other than to provide the product or service they requested. “Californians clearly want more limits on the information businesses can collect about them and its use beyond what is necessary to fulfill their requests,” observed McEldowney. “The notice and opt-out model places too much of a burden on individuals to understand businesses’ data practices and take action.”
“It’s clear that the prominent ‘Do Not Sell My Personal Information’ option that businesses covered by the CCPA must display on their website homepages is being seen,” said Susan Grant, a senior fellow at CFA. Sixty-three percent of the survey respondents said they made this request at least once to businesses whose websites they visited, compared to 47 percent who asked businesses to delete their data and 46 percent who asked to see the information that had been collected about them. “Still, 42 percent of those who didn’t ask businesses not to sell their personal information said they didn’t know they could, and even more gave the same reason for not asking to see or delete their data,” noted Grant. “It needs to be more obvious and easier for Californians to exercise their rights so they can get the full measure of privacy protection to which they’re entitled under the CCPA.”
Compared against the responses of older and White people, younger, Black and Hispanic Californians more frequently said they did not know they could make these requests. More survey respondents at the lower end of the income and educational scales also gave that reason for not making these requests.
Survey participants who did make these requests were not entirely satisfied with the businesses’ responses. Of those who asked to see or delete their data, 73 percent were very or somewhat satisfied with the responses; 71 percent of those who asked for their data not to be sold were very or somewhat satisfied with the responses. More than a quarter were not too satisfied or not satisfied at all. “The new California Privacy Protection Agency should explore the reasons for consumer dissatisfaction with how these types of requests are handled,” said Linda Sherry, director of national priorities at Consumer Action.
An executive summary of the survey findings is here. The full survey, with more details, is here.
Consumer Action and CFA have created a consumer guide for Californians about their CCPA rights and how to exercise them, which will be available on both organizations’ websites. A webinar for consumer educators for community-based organizations, consumer and privacy groups, and consumer agencies that operate in California will also be offered. If you would like more information about these materials, contact Linda Sherry or Susan Grant (see Contacts at top of release).
Contact:
Susan Grant, Consumer Federation of America, sgrant@consumerfed.org
Linda Sherry, Consumer Action, 202-544-3088