Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

TL;DR

This study evaluates how effectively the CCPA's privacy disclosure requirements improve consumer understanding, revealing significant variability and ambiguity in policies that hinder informed decision-making.

Contribution

It provides an empirical analysis of privacy policies and consumer perceptions, highlighting gaps between CCPA mandates and actual clarity in disclosures.

Findings

Significant variance in how businesses interpret CCPA definitions

Consumers struggle to understand data practices due to policy vagueness

Current disclosures do not achieve intended clarity

Abstract

Vagueness and ambiguity in privacy policies threaten the ability of consumers to make informed choices about how businesses collect, use, and share their personal information. The California Consumer Privacy Act (CCPA) of 2018 was intended to provide Californian consumers with more control by mandating that businesses (1) clearly disclose their data practices and (2) provide choices for consumers to opt out of specific data practices. In this work, we explore to what extent CCPA's disclosure requirements, as implemented in actual privacy policies, can help consumers to answer questions about the data practices of businesses. First, we analyzed 95 privacy policies from popular websites; our findings showed that there is considerable variance in how businesses interpret CCPA's definitions. Then, our user survey of 364 Californian consumers showed that this variance affects the ability of users to understand the data practices of businesses. Our results suggest that CCPA's mandates for privacy disclosures, as currently implemented, have not yet yielded the level of clarity they were designed to deliver, due to both vagueness and ambiguity in CCPA itself as well as potential non-compliance by businesses in their privacy policies.