To help identify trends in privacy representations, BCLP randomly sampled 33% of the Fortune 500 that are identified as primarily operating in the “retailing” sector. The sample includes a broad cross-section of retailers that focus on home goods, apparel, automotive, and office supplies (among others), and that have revenues which range from $100 Billion to $6 Billion in revenue. The metrics reflect public disclosure of privacy practices with a specific focus on CCPA requirements.
The date shows that there is no one strategy for disclosing privacy practices to consumers, or for complying with the federal and state laws (including the CCPA) that govern data privacy. The following summarizes current trends within the retail industry:
- Privacy notices are, on average, a month old.
- The vast majority of retailers updated their privacy notices at the end of December for the CCPA.
- Retailer privacy notices that reference enumerated categories tend to use lists instead of tables.
- Retailers that had previously been silent about whether they “sold” information, are now disclosing that they do “sell” as that term is defined under the CCPA.
- There was a 46 point increase in the number of retailers that offer a “Do Not Sell” option. .
- A small, but significant, number of retailers that don’t sell personal information are still providing a “Do Not Sell” option.
- Retailers are evenly split on whether they include a “Do Not Sell” link on their homepage.
- Even if they offer a “Do Not Sell” option some retailers are choosing not to include a “Do Not Sell” link on their homepage.
- Almost all retailers now offer access and deletion rights (at least to Californians).
- Most retailers have created a toll free telephone number and an online interactive form.
- Many retailers created a “home grown” request portal.
- Retailers deploy, on average, 22.4 behavioral advertising cookies on their homepages.
- Most retailers continue not to deploy a cookie notice.
- A small, but significant, percentage of retailers began displaying in January a cookie notice that asserts visiting a website constitutes consent to cookies.