When the consumer internet was getting built back in the 1990s, privacy wasn’t part of the design. Almost by accident, the economy of the internet built up around trafficking user data, which Ethan Zuckerman describes as the internet’s “original sin.”
CR is one of the non-profit organizations working to correct this. We believe consumers deserve the right to control their personal information and how it is being used. Since helping secure the passage of California’s landmark privacy law in 2018, we’ve helped shape similar privacy laws in other states and have extensively studied how well companies are honoring consumer opt-out and deletion requests
But what good are new rights if you can’t exercise them? That’s why alongside the more traditional consumer protection work we do at CR, we’ve been working hard to deliver solutions like Permission Slip that directly empower consumers to exercise their data privacy rights.
We launched Permission Slip back in 2022, a first-of-its-kind “authorized agent” service that helps you exercise your legal rights to get companies to stop sharing your data, or delete your data entirely.
In that time, it’s grown substantially, mainly through media coverage and word of mouth. And there are now several other authorized agent services offered by for-profit companies.
We’ve learned a lot about how to effectively operate an authorized agent at scale, approaches to identity verification, and the impact of data rights requests. We’ve made recommendations to rulemakers about how to make data rights more workable, and we created the Data Rights Protocol to help companies process data rights requests from agents more efficiently.
Two years after launching Permission Slip as a free service, we’re introducing Permission Slip Plus: an optional paid upgrade that provides additional features like automatically telling over a hundred data brokers—companies that profit from building profiles of you—to stop selling your data. And, we’re experimenting with additional features that we’ll look to introduce over time. (If you’re already using Permission Slip, don’t worry: the free tier will remain available.)
Why are we launching a paid subscription in Permission Slip? A few reasons.
First, delivering privacy requests on users’ behalf still requires a lot of human power and transactional work with companies. We do a lot of work on our users’ behalf for free, and many competitors charge for those services. At the same time, we want to be able to offer a more robust service to those who want to save even more time. The features we’re introducing in Permission Slip Plus cost us more money to operate, including employing humans to talk to companies on your behalf. The fee helps us support these additional features for those who choose to pay for the premium service.
Second, we’re interested in the many ways CR can helpfully serve consumers as their “authorized agent,” beyond what we already offer around data privacy rights. To do that at scale, we need this work to be financially sustainable—and that starts with offering a well-crafted solution to a specific user problem, and ensuring that it’s competitive with other solutions in the market.
Permission Slip Plus offers “set and forget” data broker requests, and it’s cheaper than many subscription plans offered by other data removal companies. Based on feedback from our users, we’ll work to continue iterating and differentiating Permission Slip with unique features and benefits that help people manage their relationships with companies.
We are always exploring new ways to generate revenue to support our non-profit mission. For decades, CR has generated most of its revenue by offering products for a subscription fee (most famously, the magazine and digital content that comes with your CR membership).
This is a virtuous cycle for organizations that can get it right. When you sign up for Permission Slip Plus, you can get a product that delivers direct value, while supporting Consumer Reports and its work to shape laws and represent the interests of consumers, including helping to make data rights accessible to all.
A common question we get about data removal services: do they actually work? The answer is, yes, but they’re not a silver bullet.
The privacy laws that regulate the collection and use of consumer data are a complex patchwork, spanning multiple jurisdictions and different kinds of data, and providing exemptions for different kinds of collectors. The same request that a company processes for a consumer in one state may not be honored in a state without a privacy law on the books (though in our experience, we’ve seen that many companies will honor requests even when it’s not strictly required by law).
Until consumers exercise their rights more broadly, many companies (especially data brokers without consumer-facing brands) will be focused on the bare minimum of compliance (which in some states, is virtually nothing).
This means that getting some requests processed requires persistence, and jumping through complex hoops (such as requiring additional identity verification steps to process your requests). There’s some evidence that manually opting out and requesting deletion of your data is the most effective way to get it done, which is what we found when researching services that focus specifically on people search sites (if you’re interested in doing this, we recommend consulting the Big Ass Data Broker Opt-Out List, a project maintained by Consumer Reports’ Yael Grauer in her personal capacity).
That said, data removal services—including people search removal services—can provide value, because in practice, very few people will take the time needed to manually opt-out and delete data from hundreds of companies and data brokers. It’s confusing, time consuming, and the kind of thing that you’d probably much prefer someone just take care of for you. So if it’s a choice between 1) doing nothing, 2) spending a ton of time to reduce your data footprint, or 3) paying for a service to do it for you, for many people the last option makes sense.
What makes Permission Slip different from other services on the market? Permission Slip is designed around giving people control of their data, by explaining companies’ data practices and giving consumers tools to exercise their rights. This is reflected in the interface of the app, where—in addition to tools for requesting opt out, data removal and account deletion— we’ve summarized the privacy policies of hundreds of consumer brands. This reflects our philosophy that, while consumers surely get value from exchanging their data for services and personalization, this kind of exchange needs to be fair, transparent, and informed.
With Permission Slip Plus, you can authorize Consumer Reports to automatically take actions on your behalf, based on our recommendation and judgment. We think this is a valuable service for consumers who want a little help managing their data. And it’s just the beginning—we have a host of additional features we plan to offer via Permission Slip Plus and will be responsive to your feedback and suggestions for additional features you would like to see.
There are other services designed for customers at higher risk. For instance, Consumer Reports recently evaluated services that help remove people from “people search” sites, which are especially relevant to people who are likely to experience targeted harassment, doxxing, or abuse. And our report showed that, indeed, people search removal services aren’t a silver bullet.
When we published this report, we got some questions about whether we can fairly comment on the ecosystem and evaluate possible competitors, given that we offer a data removal product of our own in Permission Slip. It’s a fair question to ask. But as we noted in the report, “Permission Slip does remove data from some people-search sites, [but] it was not evaluated in this report because it does not offer comprehensive people-search site removal at this time.”
Additionally, some media coverage of our report interpreted our observed success rates to mean these services “aren’t worth it”, which may not be true depending on your priorities. If you’re at higher risk and looking to reduce your digital footprint, getting help through a service that’s built and specialized for this purpose may save you a lot of time, even if it’s not 100% effective—and that may well be worth it to you.
We’re proud of Permission Slip as a product—it’s introducing data rights to people all over the country, and building awareness for change in how companies treat your personal information. But it’s just the most visible part of our work to strengthen consumer data rights. We are building out open source tools and technologies for companies to process your data requests more effectively; reporting on companies whose actions may not comply with state privacy laws, and advocating for strong privacy laws nationally and in state houses.
CR is proud to be part of a growing movement to give consumers back control of their data. And when you join us, together we can work to nudge industry towards more consumer-friendly privacy behavior.
If you want to give this a try, or support CR’s non-profit mission, please consider signing up for Permission Slip Plus. And if you’ve never tried Permission Slip, now’s a good time to check out the app. We’d love to hear your feedback, so please get in touch!
