Last year, Consumer Reports launched an Authorized Agent pilot to help consumers stop the sale of their data by companies. The results inspired the continued development of authorized agents and a new pilot to help consumers retrieve copies of their data from companies.
Image courtesy of Afsal and OpenIDEO’s Cybersecurity Visuals Challenge.
The California Consumer Privacy Act (CCPA) went into effect on January 1, 2020, and inspired our team at CR’s Digital Lab to start exploring what privacy-enabling services were possible under the nation’s first comprehensive commercial privacy law.
The first chapter of this exploration was launching an authorized agent pilot; we reached out to companies on consumers’ behalf and told them to stop selling consumers’ data. We learned a lot! Our consumer volunteers were enthusiastic about the service, and we decided to make authorized agents a focal point of our ongoing research.
The CCPA says that an authorized agent can make requests to companies on consumers’ behalf. These requests can be to opt out of the sale of your personal data (“Do Not Sell”), like the requests we issued in last year’s pilot. Agents can also request on consumers’ behalf that a company sends an individual a copy of their information, or that a company deletes data collected about the consumer. Such “access” and “deletion” rights come with a higher legal threshold to show that the agent was authorized by the consumer.
CR wants to help consumers meaningfully exercise their data rights, which is why today we are launching a new pilot to send data access requests on behalf of participating CR members as their authorized agent. The plan is to communicate learnings from this pilot to industry and regulators to continue making the exercise of data rights more practical for consumers.
In this pilot, we will work with CR volunteers in California and ask companies to send these volunteers a copy of their data. The data file will be for the volunteers’ eyes only; the pilot is designed so that we will not be able to see what information companies have about our volunteers. We’ll email volunteers throughout the process and ask how companies are communicating about their data access requests.
If you’re a California resident and would like to participate in this upcoming CCPA experiment, you can sign up here. We hope you’ll consider participating! You can let us know what you think by commenting here or dropping us a note at datarightsstudy@cr.org. Thanks for being part of this journey to strengthen data rights for all consumers.
This research is possible thanks to the generous support of Craig Newmark Philanthropies and Omidyar Network. The Digital Lab would also like to acknowledge the project’s research leads Maggie Oates and Arushi Saxena.
