To help identify trends in privacy representations, BCLP randomly sampled the websites and privacy notices of 10% of the Fortune 500 companies.
The data shows that there is no one strategy for disclosing privacy practices to consumers, or for complying with federal and state laws – including the CCPA – that govern data privacy. The following summarizes current industry trends:
- Privacy notices are, on average, less than six months old.
- The majority of companies have updated their privacy notices for the CCPA.
- Privacy notices that reference enumerated categories are predominantly using tables to convey information.
- The majority of companies state that they do not sell personal information.
- 30% of privacy notices are silent or unclear about selling practices.
- The vast majority of privacy notices do not include a “Do Not Sell” option.
- Those companies that are disclosing the sale of information are complying with the CCPA’s requirement to provide a “Do Not Sell” option.
- No single standard has emerged for effectuating a “Do Not Sell request.”
- Most companies offer access and deletion rights.
- The average quantity of behavioral advertising cookies on a corporate homepage is 8.1.
- Most companies are not deploying a cookie notice or banner.
- Those that do are split in terms of whether to use an opt-in, notice, or deemed consent banner.
- Most companies that use behavioral advertising cookies do not consider themselves to have sold information.