https://github.com/privacy-tech-lab/ccpa-metrics

CCPA metric data and charts
https://github.com/privacy-tech-lab/ccpa-metrics

ccpa ccpa-metrics ccpa-statistics do-not-sell do-not-track global-privacy-control gpc privacy privacy-preference-signals privacy-tech

Last synced: 7 months ago
JSON representation

CCPA metric data and charts

Host: GitHub
URL: https://github.com/privacy-tech-lab/ccpa-metrics
Owner: privacy-tech-lab
License: mit
Created: 2021-09-13T22:09:05.000Z (about 4 years ago)
Default Branch: main
Last Pushed: 2024-06-21T19:09:10.000Z (over 1 year ago)
Last Synced: 2025-02-17T03:09:25.149Z (8 months ago)
Topics: ccpa, ccpa-metrics, ccpa-statistics, do-not-sell, do-not-track, global-privacy-control, gpc, privacy, privacy-preference-signals, privacy-tech
Homepage: https://www.privacytechlab.org
Size: 70.8 MB
Stars: 3
Watchers: 8
Forks: 1
Open Issues: 0
Metadata Files:
- Readme: README.md
- Funding: FUNDING.yml
- License: LICENSE

Awesome Lists containing this project

README

View Metrics on Google Sheets

# California Consumer Privacy Act (CCPA) Metrics

[1. CCPA Metrics Requirement](#1-ccpa-metrics-requirement)
[2. View Metrics and Charts](#2-view-metrics-and-charts)
[3. Contribution](#3-contribution)
[4. Thank You!](#4-thank-you)

## 1. CCPA Metrics Requirement

California Code of Regulations [§999.317]() requires the following:

```text
(g) A business that knows or reasonably should know that it, alone or in combination, buys, receives for the business's commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year shall:

(1) Compile the following metrics for the previous calendar year:

a. The number of requests to know that the business received, complied with in whole or in part, and denied;
b. The number of requests to delete that the business received, complied with in whole or in part, and denied;
c. The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
d. The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.

(2) Disclose, by July 1 of every calendar year, the information compiled in subsection (g)(1) within their privacy policy or posted on their website and accessible from a link included in their privacy policy.

a. In its disclosure pursuant to subsection (g)(2), a business may choose to disclose the number of requests that it denied in whole or in part because the request was not verifiable, was not made by a consumer, called for information exempt from disclosure, or was denied on other grounds.

(h) A business may choose to compile and disclose the information required by subsection (g)(1) for requests received from all individuals, rather than requests received from consumers. The business shall state whether it has done so in its disclosure and shall, upon request, compile and provide to the Attorney General the information required by subsection (g)(1) for requests received from consumers.
```

## 2. View Metrics and Charts

This repo contains [data](https://github.com/privacy-tech-lab/ccpa-metrics/tree/main/data/2020) on business' disclosures per §999.317(g). The data is entered and visualized in a [Google Sheet](https://docs.google.com/spreadsheets/d/1VzyTpjWgAoR36oYVhSoX9Qzynj1uV61tvV6Tt5B5P7I/edit#gid=0).

## 3. Contribution

Contribute by opening an issue or a pull request. Contact: sebastian[at]privacytechlab.org

- June 7 2024: @ecorren provided [2021 data](https://github.com/privacy-tech-lab/ccpa-metrics/tree/main/data/2021). Her paper is available on SSRN: [An Empirical Study on the Real Use of Data Control Rights and Policy Implications](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4793249), 109 IOWA L. REV.
- March 8, 2023: @coreystone provided an [update](https://github.com/privacy-tech-lab/ccpa-metrics/issues/2).

## 4. Thank You!

We would like to thank our supporters!

Major financial support provided by the National Science Foundation.