The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply with the provisions of the CCPA that require them to provide consumers with accurate privacy notices and respond to "verifiable consumer requests" (VCRs) by disclosing personal information that they have collected, used, or shared about consumers for a business or commercial purpose. We compared the actual network traffic of 109 apps that we believe must comply with the CCPA to the data that apps state they collect in their privacy policies and the data contained in responses to "right to know" requests that we submitted to the app's developers. Of the 69 app developers who substantively replied to our requests, all but one provided specific pieces of personal data (as opposed to only categorical information). However, a significant percentage of apps collected information that was not disclosed, including identifiers (55 apps, 80%), geolocation data (21 apps, 30%), and sensory data (18 apps, 26%) among other categories. We discuss improvements to the CCPA that could help app developers comply with "right to know" requests and other related regulations.
翻译：《加利福尼亚消费者隐私法》（CCPA）为加利福尼亚居民提供了一系列增强的隐私保护和权利。我们的研究调查了Android应用开发者遵从CCPA规定的程度，该规定要求他们向消费者提供准确的隐私声明，并通过披露已收集、使用或分享的有关消费者的个人信息来回应“可验证消费者申请权”（VCR）。我们比较了我们认为必须遵守CCPA的109个应用程序的实际网络流量与应用程序在隐私政策中陈述的数据以及我们提交给应用程序开发人员的“知情权”要求的响应中包含的数据。在69名实质上回答我们的请求的应用程序开发者中，除一个之外，所有人都提供了具体的个人数据（而不是仅分类信息）。然而，有相当一部分应用程序收集了未披露的信息，包括标识符（55个应用程序，80%），地理位置数据（21个应用程序，30%）以及感官数据（18个应用程序，26%）等其他类别。我们讨论了如何改善CCPA以帮助应用程序开发者遵守“知情权”请求和其他相关法规。
相关内容
微信扫码咨询专知VIP会员