Putting the CCPA into Practice: Piloting a CR Authorized Agent

Consumer Reports wants to help consumers meaningfully exercise their data rights, which is why we’re exploring emergent, consumer-facing services now possible under the CCPA.

Image courtesy of Afsal CMK and OpenIDEO’s Cybersecurity Visuals Challenge

This year the nation’s first comprehensive commercial privacy law, The California Consumer Privacy Act (CCPA) went into effect. For the first time, California residents have the legal right to (1) require that their personal information not be sold; (2) get a copy of information that certain companies have about them; and (3) request that companies delete their personal information. However, CR’s own reporting has revealed just how tough it can be for California consumers to use the new privacy rights the CCPA grants.

Fortunately, the authors of the CCPA anticipated how potentially time-consuming it could be for individuals to make requests about their data. They added a provision to allow an “authorized agent” to represent the consumer in their interactions with companies.

Under the CCPA, an authorized agent can make requests on behalf of consumers, which means the agent can:

• Help individuals opt-out of the sale of their information by companies
• Issue legally-enforceable requests to delete an individual’s data
• Request a copy of an individual’s data by certain companies

So with an authorized agent, consumers don’t need to do any work — all they need to do is give their permission and the agent can facilitate data-related requests on their behalf. For access or deletion requests, consumers will also need to validate that they are who they say they are — but that’s it.

CR wants to help consumers meaningfully exercise their data rights, which is why today we are launching a lightweight pilot to act as an authorized agent on behalf of a handful of our members. In this pilot, we will work with select CR volunteers to quickly and simply opt-out of the sale of their information by various companies.

The pilot is the first in a series of experiments we’re launching at CR Digital Lab to explore what emergent, consumer-facing services are possible under the CCPA. If you’re a California resident and would like to participate in our upcoming CCPA experiments, you can sign up here.

We expect to learn a lot from offering an authorized agent and welcome any questions about the pilot or ideas about future privacy products you’d like the Digital Lab to test out. Let us know what you think by commenting here or dropping us a note at datarightsstudy@cr.org.