Exercising the CCPA Opt-out Right on Android: Legally Mandated but Practically Challenging

TL;DR

This study reveals that most Android apps do not effectively support the CCPA opt-out right, with current methods like UI options and GPC signals being largely ineffective, highlighting a significant compliance gap.

Contribution

The paper provides empirical evidence of low compliance with CCPA opt-out rights on Android and proposes re-purposing the AdID setting to improve user privacy.

Findings

Only 48% of tested apps have a CCPA opt-out setting.

GPC signals are largely ineffective in exercising the opt-out right.

Disabling AdID access does not significantly improve compliance.

Abstract

Many mobile apps' business model is based on sharing user data with ad networks to deliver personalized ads. The California Consumer Privacy Act (CCPA) gives California residents a right to opt out. In two experiments we evaluate to which extent popular Android apps enable California residents to exercise their right. In our first experiment -- manually exercising the right via app-level UIs -- we find that only 48 out of 100 apps implement a respective setting, which suggests that CCPA opt-out right compliance on the Android platform is generally low. In our second experiment -- automatically exercising the opt-out right by sending Global Privacy Control (GPC) signals -- we find for an app dataset of 1,811 apps that GPC is largely ineffective. While we estimate with 95% confidence that 62%--81% of apps in our app dataset must respect the CCPA opt-out right, many apps do not do so. Our evaluation of disabling apps' access to the AdID -- which is technically not intended for exercising the CCPA opt-out right but could be practically effective -- does not change our conclusion. For example, when sending GPC signals and disabling apps' access to the AdID, 338 apps still had the ccpa status of the ad network Vungle set to opted_in while only 26 had set it to opted_out. Overall, our results suggest a compliance gap as California residents have no effective way of exercising their CCPA opt-out right on the Android platform; neither at the app nor at the platform-level. We think that re-purposing the Android AdID setting as an opt-out right setting with legal meaning under the CCPA and other laws could close this gap and improve users' privacy on the platform significantly.