Are Current CCPA Compliant Banners Conveying User's Desired Opt-Out Decisions? An Empirical Study of Cookie Consent Banners

TL;DR

This study reveals a significant gap between users' perceived and actual Opt-Out decisions on CCPA-compliant cookie banners, highlighting the need for clearer privacy communication.

Contribution

It provides empirical evidence of user misunderstandings and discrepancies in cookie consent choices under CCPA, emphasizing the importance of transparent privacy practices.

Findings

Users often misjudge their Opt-Out status.

Most users desire clearer privacy information.

Actual Opt-Out rates are lower than perceived.

Abstract

The California Consumer Privacy Act (CCPA) secures the right to Opt-Out for consumers in California. However, websites may implement complex consent mechanisms that potentially do not capture the user's true choices. We investigated the user choices in Cookie Consent Banner of US residents, the plurality of whom were from California, through an online experiment of 257 participants and compared the results with how they perceived to these Cookie Consent Banner. Our results show a contradiction between how often participants self-report their Opt-Out rates and their actual Opt-Out rate when interacting with a complex, CCPA-compliant website. This discrepancy expands the context with which modern websites may implement the CCPA without providing users sufficient information or instruction on how to successfully Opt-Out. We further elaborate on how US residents respond to and perceive the GDPR-like Opt-In model. Our results indicate that even though very few consumers actually exercised their right to Opt-Out, the majority of US consumers desire more transparent privacy policies that the current implementation of CCPA on websites lacks.