[Paper Review] Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

Rex Chen, Fei Fang+3 more|arXiv (Cornell University)|Sep 28, 2021

Privacy, Security, and Data Protection36 references6 citations

TL;DR

This study evaluates the clarity of privacy disclosures under California's CCPA by analyzing 95 popular websites' privacy policies and surveying 364 Californian consumers. It finds that inconsistent terminology, vague language, and divergent interpretations of CCPA terms like 'sale' and 'business purpose' significantly impair consumer understanding, undermining the law's goal of enabling informed privacy choices.

ABSTRACT

Vagueness and ambiguity in privacy policies threaten the ability of consumers to make informed choices about how businesses collect, use, and share their personal information. The California Consumer Privacy Act (CCPA) of 2018 was intended to provide Californian consumers with more control by mandating that businesses (1) clearly disclose their data practices and (2) provide choices for consumers to opt out of specific data practices. In this work, we explore to what extent CCPA's disclosure requirements, as implemented in actual privacy policies, can help consumers to answer questions about the data practices of businesses. First, we analyzed 95 privacy policies from popular websites; our findings showed that there is considerable variance in how businesses interpret CCPA's definitions. Then, our user survey of 364 Californian consumers showed that this variance affects the ability of users to understand the data practices of businesses. Our results suggest that CCPA's mandates for privacy disclosures, as currently implemented, have not yet yielded the level of clarity they were designed to deliver, due to both vagueness and ambiguity in CCPA itself as well as potential non-compliance by businesses in their privacy policies.

Motivation & Objective

• To assess how clearly CCPA-mandated privacy disclosures inform consumers about data practices.
• To investigate the impact of wording variation in privacy policies on consumer understanding of CCPA rights.
• To identify specific ambiguities in CCPA terminology that lead to misinterpretation by both businesses and consumers.
• To evaluate the effectiveness of CCPA's notice-and-choice framework in enabling informed consumer decisions.

Proposed method

• Systematic analysis of 95 privacy policies from top U.S. websites to assess compliance and clarity of CCPA disclosures.
• Identification of key ambiguities in terminology such as 'sale', 'business purpose', and 'service provider' across policy texts.
• Design and execution of a user survey with 364 Californian participants to test comprehension of policy excerpts with varying wording.
• Comparison of survey responses against ground truth answers to measure accuracy of consumer understanding of data practices.
• Use of controlled policy excerpts to isolate the effect of wording on perception, minimizing brand-based priming.
• Qualitative analysis of survey rationales to validate that respondents interpreted disclosures based on text, not brand associations.

Experimental results

Research questions

• RQ1 To what extent do businesses consistently interpret and apply CCPA’s definitions of 'sale', 'business purpose', and 'service provider' in their privacy policies?
• RQ2 How does variation in the wording of privacy disclosures affect consumers’ understanding of their data sharing practices and privacy rights under CCPA?
• RQ3 What specific ambiguities in policy language lead to misinterpretation by consumers, even when the legal ground truth is consistent?
• RQ4 How do consumers’ perceptions of opt-out capabilities and data deletion outcomes vary across different disclosure styles?
• RQ5 To what extent do current CCPA disclosures meet the standard of clarity required by the law?

Key findings

• Businesses inconsistently applied CCPA terms: many claimed not to 'sell' data, while others acknowledged that their data sharing practices fell under the CCPA’s definition of 'sale'.
• Disclosure quality varied significantly, with many policies failing to specify which categories of personal information were shared, with whom, or what outcomes consumers could expect from deletion requests.
• Survey respondents showed substantial confusion about data sharing recipients, opt-out effectiveness, and post-deletion data retention, even when the legal interpretation was unambiguous.
• Different wording in policy excerpts led to significantly different consumer perceptions, demonstrating that linguistic variation directly affects understanding.
• The study found evidence of non-compliance and inconsistent interpretation, suggesting that CCPA’s clarity mandates have not yet been fully realized in practice.
• Despite CPRA’s intended clarifications, new terms like 'contractors' may introduce additional ambiguity, highlighting the need for standardized, enforceable disclosure frameworks.