Gaining or Losing Control? An Empirical Study on the Real Use of Data Control Rights and Policy Implications

Privacy concerns are on the rise, and lawmakers and regulators around the world are responding with widespread legislative action led by the United States and the European Union. The California Consumer Privacy Act (“CCPA”) and many other state laws across the United States, together with congressional proposals, the European Union’s General Data Protection Regulation, and similar laws in the rest of the world, all provide people with new data control rights. The formal objective of these rights is to provide control over people’s personal information, and they include the right to access one’s personal information, the right to delete it, and the right to opt-out of its sale to third parties. Data control rights are the centerpiece of all these new laws and the ultimate response we are seeing to concerns about surveillance capitalism. But do data control rights work in practice? This Article empirically investigates whether consumers use their data control rights. It leverages a unique opportunity to answer this crucial and thus far open question, presented by the CCPA. This Article is based on an original dataset: It collects and analyzes, for the first time, usage metrics reported by firms under a CCPA Regulations requirement. This Article adds a novel contribution to the discussion about data control rights and the regulation of the information economy more broadly—part theoretical, part empirical, and part normative. First, this Article explores the origins of data control rights and the goals that have shaped them. To study the effectiveness of a law, it is necessary to compare its intended goals and idealized theoretical outcomes with a measurement of the real-world outcomes that the law has generated. Second, this Article’s data analysis reveals that only a tiny fraction of consumers are exercising data control rights. The Article further analyzes different usage trends amongst the various rights and the gap between the results and the idealized theoretical expectations. Third, this Article argues that normatively it is crucial to measure the real-life effects of the laws that govern the information economy. The Article further proposes ways to enhance current regulatory approaches in light of the California experience.