¾ÅÉ«ÊÓƵ

Browsing the web, we have all seen annoying pop-ups and banners asking if we want to allow tracking on a website. Wesleyan researchers found that even though websites ask for your preferences, they may not abide by them.

Only 45 percent of websites complied with people’s requests to opt out from tracking when tested in April of 2024, said Sebastian Zimmeck, associate professor of computer science. Zimmeck’s detailing his team’s findings is set to publish in USENIX Security, one of the premier venues for security and privacy research.

“There is some compliance, but there’s also a long way to go,” Zimmeck said. “In particular, approaching big web publishers can make a big difference here, because it could have an outsized impact in terms of the number of sites in compliance and also the number of people who go to these sites.”

California enacted the California Consumer Privacy Act (CCPA) in 2018, giving California residents the right to opt out of the sale or sharing of their personal information through (GPC). GPC is a privacy preference signal, which was developed ¾ÅÉ«ÊÓƵ, allowing people to opt out across all websites, so they do not have to repeatedly determine their preferences on each website they visit. GPC is implemented in privacy-friendly browsers like Firefox, DuckDuckGo Browser, and Brave. It is also available for other browsers through browser extensions like , which was developed by Zimmeck and his students.

The problem with data sharing, Zimmeck said, is that it can have a significant impact on people’s lives. The data sharing ecosystem is largely made up of ad networks and data brokers who buy data about people such as where they live, who they are related to, and what they might be interested in. The brokers then sell it to anyone who is willing to pay for such data. Sometimes it lands in the hands of landlords or background check firms, for example. It can lead to people being disadvantaged or missing out on key opportunities, especially, if data is wrong or incomplete.

“This can have really practical consequences,” Zimmeck said. “And so, with the right to opt out, you restrict the data going into the system right from the beginning.”

Zimmeck and his students from Wesleyan have been tracking a set of 11,708 sites since December of 2023 to see whether the sites are honoring the opt-out rights of California residents.

His team examined the four main privacy strings—mechanisms to propagate people’s opt-out rights, expressed via GPC, to website publishers—and found that many sites that have implemented at least one of the four privacy strings are still selling or sharing people’s data. Zimmeck’s team found that only 44 percent of the tracked sites did not share people’s data once they opted out in December of 2023. This number fell to 43 percent in February of 2023 before rebounding to 45 percent in April of 2024.

These statistics speak to the state of internet privacy at large. Since there is no federal internet privacy law, states must determine their own privacy laws and less than 30 percent of states have done so. , , and have worked together, with Zimmeck’s help, to develop their privacy laws and regulations. His team has helped create for consumers and businesses in the three states, together with each state’s attorney general. He said that state laws are becoming the de facto federal privacy law.

“It’s just easier to handle, both from the enforcement perspective, but also for the websites,” Zimmeck said. “Because if you're a website owner and you need to comply with 50 different regulations, that's very difficult to keep track of.”

His recommendation is that enforcement bodies focus on larger website publishers so that compliance can progress at a larger scale. “As big publishers tend to roll out the same privacy strings to all of their sites, improved compliance will result in broad impact,” the paper said.

Now that Zimmeck and his team have published their research on compliance in California, they have begun researching the same in Connecticut, Colorado, and other states, he said.