“A new report from Consumer Watchdog shows how thousands of companies share your data with Facebook, including financial companies and health care providers, and how a loophole in California’s premier privacy law makes opting out difficult and time consuming. The report details how the big three web browsers do not offer a global opt out signal to make companies halt the sale and sharing of personal information easy, but pending legislation in California will make the global opt out signal mandatory.  “In order to exercise your rights and tell a business to stop sharing or selling your data, you need to have the time and sanity to visit thousands of websites,” said Justin Kloczko, tech and privacy advocate for Consumer Watchdog. “This is an access issue, and we need better tools. The legislature must pass Assembly Bill 3048 (Lowenthal) and the governor should sign it.”

• Read the report, “No Opt Out,” here.
• Watch a consumer alert on the issue here.

The same tech companies that collect lots of data also own the most popular web browsers—Google Chrome, Apple Safari, and Microsoft Edge—but they don’t let us tell all businesses our privacy choices because it’s not in their financial interest to do so, said the nonprofit advocacy group. Although businesses must accept a global opt out under the California Consumer Privacy Act (CCPA), most browsers don’t offer such a signal unless a plug-in is installed. Even then, not all browsers accept it. Using Facebook as an example, Kloczko tried to take control of his data, but discovered how time-consuming and confusing opting out can be. He learned Facebook knows about over 2,500 companies that he’s visited online, including his credit card company and health insurer, since opening his account nearly 20 years ago. The list also contains major data brokers like Experian and Live Ramp that he didn’t interact with directly. “Data brokers keep a low profile but traffic in our most personal details. They know what we eat, watch, read, and purchase,” said Kloczko. And despite deactivating his Facebook account for a year, meaning his account was not visible to other accounts, the sharing between Facebook and companies Kloczko visited continued, said the nonprofit. According to the data, Facebook and advertisers still knew about 671 businesses Kloczko interacted with online, including his health insurer, credit card company, and bank. “If I want to put a stop to this data sharing, I must navigate a confusing, seemingly endless labyrinth of privacy options obscured in legalese,” said Kloczko. “It’s a tedious undertaking that fatigues people from exercising their options.” Separately, it’s not even clear that Facebook is complying with the CCPA because even though Facebook says it does not share or sell your data, advertisers still pay for access to it.”