(Un)clear and (In)conspicuous: The Right to Opt-out of Sale under CCPA

The California Consumer Privacy Act (CCPA)---which began enforcement on July 1, 2020---grants California users the right to opt-out of sale of their personal information. In this work, we perform a series of manual observational studies (conducted in July 2020, January 2021, and July 2021) to understand how websites implement this right. We find that the vast majority of sites that implement opt-out mechanisms do so with a Do Not Sell link rather than with a privacy banner, and that many of opt-out controls exhibit features such as nudging and inconvenience factors (e.g., fillable forms). We then perform a pair of user studies with 4357 unique users (recruited from Google Ads and Amazon Mechanical Turk) in which we observe how users interact with different opt-out mechanisms and evaluate how the observed implementation choices---exclusive use of links, nudging, and inconvenience factors---affect the rate at which users exercise their right to opt-out of sale. We find that these design elements significantly deter interactions with opt-out mechanisms---including reducing the opt-out rate for users who are uncomfortable with the sale of their information---and that they reduce users' awareness of their right to opt-out.