Here's the exact text from Section 1798.135(a)(5) of the CCPA: "For a consumer who has opted-out of the sale of the consumer’s personal information, respect the consumer’s decision to opt-out for at least 12 months before requesting that the consumer authorize the sale of the consumer’s personal information."
Data brokers can often have a very liberal interpretation of what it means for the consumer to "authorize" the sale of their personal information. I would guess 99% of data sales were never actually “authorized” by the consumer to begin with, and are usually done through some backdoor implicit authorization that the consumer has no knowledge of whatsoever.
> Does this mean users have to keep opting out every 12 months? If yes, that sounds...dumb, isn't it? Maybe I am not understanding this correctly, is there a reason behind this 12 month period? Even if they wanted to let data brokers add the data back, 12 months seems too short a time. What am I missing?
Although it often causes harm and is often considered evil, there is a lot of economic value that results from the free flow of data. U.S. lawmakers recognize this and its partly why they’re so reluctant to pass strict privacy laws like they have in Europe. The other reason is that lobbyists for deep pocketed tech companies water down privacy laws significantly before they can pass. Even with the 12 month expiration, the CCPA is the strictest privacy law in the U.S., and most U.S. citizens have basically no data privacy rights whatsoever.
How long a data broker honors an opt out is highly variable by the data broker. But yes, in general, you have to continue monitoring these companies and re-submitting opt out requests over time, that's what Optery does with its ongoing scanning and removal technology. We have a little more info on this topic here:
Data brokers can often have a very liberal interpretation of what it means for the consumer to "authorize" the sale of their personal information. I would guess 99% of data sales were never actually “authorized” by the consumer to begin with, and are usually done through some backdoor implicit authorization that the consumer has no knowledge of whatsoever.
> Does this mean users have to keep opting out every 12 months? If yes, that sounds...dumb, isn't it? Maybe I am not understanding this correctly, is there a reason behind this 12 month period? Even if they wanted to let data brokers add the data back, 12 months seems too short a time. What am I missing?
Although it often causes harm and is often considered evil, there is a lot of economic value that results from the free flow of data. U.S. lawmakers recognize this and its partly why they’re so reluctant to pass strict privacy laws like they have in Europe. The other reason is that lobbyists for deep pocketed tech companies water down privacy laws significantly before they can pass. Even with the 12 month expiration, the CCPA is the strictest privacy law in the U.S., and most U.S. citizens have basically no data privacy rights whatsoever.
How long a data broker honors an opt out is highly variable by the data broker. But yes, in general, you have to continue monitoring these companies and re-submitting opt out requests over time, that's what Optery does with its ongoing scanning and removal technology. We have a little more info on this topic here:
https://help.optery.com/en/article/when-my-data-is-removed-f...