Study finds that the CCPA needs stronger enforcement but “authorized agents” like DoNotPay can make it much easier for consumers to opt out of data collection
A CR study reveals progress, along with problems, when Calif. consumers use “authorized agents” to stop their data from being sold Tweets: @cradvocacy , @mxmahoney5 , @cradvocacy , @pennywriter , @jbrowder1 , and @stephtngu Tweets: @cradvocacy : CR's Digital Lab signed up 124 volunteers to see how easy it would be for Californians to use CR as an authorized agent. CR's authorized agents issued legally valid opt-outs to 21 companies on their behalf. https://www.consumerreports.org/ ... Maureen Mahoney / @mxmahoney5 : We've been doing a ton of work to help consumers exercise their CCPA privacy rights - including by opting them out of data sales on their behalf (with their permission). Check out what we found! https://www.consumerreports.org/ ... @cradvocacy : 🧵 How easy is it for Californians to opt-out of their online data being collected or sold? We put CA's privacy law (#CCPA) to the test. See our new study: https://advocacy.consumerreports.org/ ... Penelope Wang / @pennywriter : A new California law gives consumers the right to tell companies to stop selling their personal data. In practice, it's pretty hard to do @kavehwaddell https://www.consumerreports.org/ ... Joshua Browder / @jbrowder1 : Every day, DoNotPay sends thousands of deletion requests to data brokers, stopping consumer data from reaching law enforcement, political campaigns and marketers. Great to see us mentioned in this @ConsumerReports study on the ways they try and stop us! https://www.consumerreports.org/ ... Stephanie T. Nguyen / @stephtngu : .@CRAdvocacy worked with 124 consumers to ask 21 companies (Starbucks, Equifax, Oracle) to stop selling their personal information, building a stronger case for ‘authorized agents’. Congrats @ginnyfahs @mxmahoney5 @dmarti who led this great research! https://www.consumerreports.org/ ... https://twitter.com/...
Context & Ripple Effects
Consumer Reports' Digital Lab signed up 124 Californians and, acting as their authorized agent under the CCPA, issued legally valid opt-outs to 21 companies including Starbucks, Equifax, and Oracle — evidence that the law's delegation mechanism works in practice even as the study concludes the statute needs stronger enforcement. The finding lands a year after DoNotPay turned the same provision into a product with its $3/month Digital Health tool that automates CCPA deletion requests.
The study also arrives amid a crowded market: hundreds of vendors have been selling CCPA compliance to enterprises since early 2020, and the California AG has since signaled through enforcement case examples that generic trade-group opt-out tools not tailored to the CCPA don't cut it. Delegated opt-out is moving from legal curiosity to contested infrastructure.
First-order effects
- Californians gain a working path around per-company friction: an authorized agent like CR or DoNotPay can file valid opt-outs on their behalf, hitting data-heavy firms such as Equifax and Oracle without each consumer navigating 21 separate flows.
- Companies receiving these opt-outs must honor them as legally valid requests, adding a new class of inbound demand they can't dismiss as informal complaints.
Second-order effects
- Compliance vendors and trade groups selling blanket opt-out tools face pressure to tailor products to the CCPA specifically, given the AG's case examples suggesting generic tools won't shield companies.
- Data brokers and ad-tech intermediaries see request volumes scale beyond what individual consumers would ever file manually, raising the cost of the sell-data default.
Third-order effects
- If authorized-agent delegation holds up against enforcement scrutiny, privacy rights start exercising like subscriptions — third parties acting at scale on consumers' behalf — which would push regulators to define who may act as an agent and on what proof.
- The gap between working delegation tools and weak statutory enforcement points toward a structural split: consumer-side agents professionalize while company-side obligations stay under-enforced until regulators close it.
The trend: Privacy compliance is shifting from per-consumer self-service toward delegated, agent-mediated rights enforcement, with regulator tolerance for blanket tools setting the ceiling.