Study finds that the CCPA needs stronger enforcement but “authorized agents” like DoNotPay can make it much easier for consumers to opt out of data collection
Kaveh Waddell / Consumer Reports : Tweets: @cradvocacy , @jbrowder1 , @pennywriter , @mxmahoney5 , @cradvocacy , and @stephtngu Tweets: @cradvocacy : CR's Digital Lab signed up 124 volunteers to see how easy it would be for Californians to use CR as an authorized agent. CR's authorized agents issued legally valid opt-outs to 21 companies on their behalf. https://www.consumerreports.org/ ... Joshua Browder / @jbrowder1 : Every day, DoNotPay sends thousands of deletion requests to data brokers, stopping consumer data from reaching law enforcement, political campaigns and marketers. Great to see us mentioned in this @ConsumerReports study on the ways they try and stop us! https://www.consumerreports.org/ ... Penelope Wang / @pennywriter : A new California law gives consumers the right to tell companies to stop selling their personal data. In practice, it's pretty hard to do @kavehwaddell https://www.consumerreports.org/ ... Maureen Mahoney / @mxmahoney5 : We've been doing a ton of work to help consumers exercise their CCPA privacy rights - including by opting them out of data sales on their behalf (with their permission). Check out what we found! https://www.consumerreports.org/ ... @cradvocacy : 🧵 How easy is it for Californians to opt-out of their online data being collected or sold? We put CA's privacy law (#CCPA) to the test. See our new study: https://advocacy.consumerreports.org/ ... Stephanie T. Nguyen / @stephtngu : .@CRAdvocacy worked with 124 consumers to ask 21 companies (Starbucks, Equifax, Oracle) to stop selling their personal information, building a stronger case for ‘authorized agents’. Congrats @ginnyfahs @mxmahoney5 @dmarti who led this great research! https://www.consumerreports.org/ ... https://twitter.com/...
Context & Ripple Effects
DoNotPay has been building this lane since it launched a $3/month tool that automates CCPA deletion requests in early 2020, part of a broader wave of vendors selling privacy compliance and exercise tooling. What was missing was independent evidence that the 'authorized agent' route actually produces legally effective opt-outs for ordinary people.
First-order effects
- Consumer Reports' Digital Lab signed up 124 volunteers and, acting as their authorized agent, issued legally valid opt-outs to 21 companies — proof the delegation mechanism works where direct, self-service opt-outs are often difficult for Californians to complete.
Second-order effects
- Data brokers are the immediate losers: DoNotPay says it already sends thousands of deletion requests daily, cutting off the broker-supplied data that reaches law enforcement, political campaigns, and marketers.
- One-size-fits-all opt-out tools face a credibility problem — later California AG enforcement case examples suggest companies cannot rely on trade groups' blanket tools not tailored to the CCPA, pushing buyers toward agent-based or compliant-specific mechanisms.
Third-order effects
- If the pattern holds, privacy rights shift from individual self-service portals to delegated agents acting at scale on consumers' behalf — making agent permissioning and verification standards, not website forms, the load-bearing part of consent architecture.
The trend: Consumer privacy rights under laws like the CCPA are migrating from per-company self-service requests to authorized third-party agents exercising them at scale.