Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)

Van Hong Tran; Aarushi Mehrotra; Ranya Sharma; Marshini Chetty; Nick Feamster; Jens Frankenreiter; Lior Strahilevitz

doi:10.1145/3706598.3714138

Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)

Van Hong Tran
, Aarushi Mehrotra
, Ranya Sharma
, Marshini Chetty
, Nick Feamster
, Jens Frankenreiter
, Lior Strahilevitz

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

To protect consumer privacy, the California Consumer Privacy Act (CCPA) requires businesses to provide consumers with a straightforward way to opt out of the sale and sharing of their personal information. However, the control that businesses enjoy over the opt-out process allows them to impose hurdles on consumers aiming to opt out, including by employing dark patterns. Motivated by the enactment of the California Privacy Rights Act (CPRA), which strengthens the CCPA and explicitly forbids certain dark patterns in the opt-out process, we investigate how dark patterns are used in opt-out processes and assess their compliance with CCPA regulations. Our research on 330 CCPA-subject websites reveals that these websites employ a variety of dark patterns. Some of these patterns are explicitly prohibited under the CCPA; others seem to take advantage of legal loopholes.

Original language	English
Title of host publication	CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems
Publisher	Association for Computing Machinery
ISBN (Electronic)	9798400713941
DOIs	https://doi.org/10.1145/3706598.3714138
State	Published - Apr 26 2025
Event	2025 CHI Conference on Human Factors in Computing Systems, CHI 2025 - Yokohama, Japan Duration: Apr 26 2025 → May 1 2025

Publication series

Name	Conference on Human Factors in Computing Systems - Proceedings

Conference

Conference	2025 CHI Conference on Human Factors in Computing Systems, CHI 2025
Country/Territory	Japan
City	Yokohama
Period	04/26/25 → 05/1/25

Access to Document

10.1145/3706598.3714138

Cite this

Tran, V. H., Mehrotra, A., Sharma, R., Chetty, M., Feamster, N., Frankenreiter, J., & Strahilevitz, L. (2025). Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA). In CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems Article 223 (Conference on Human Factors in Computing Systems - Proceedings). Association for Computing Machinery. https://doi.org/10.1145/3706598.3714138

@inproceedings{01dc4f39e68b4dc386b253881ff7c8de,

title = "Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)",

abstract = "To protect consumer privacy, the California Consumer Privacy Act (CCPA) requires businesses to provide consumers with a straightforward way to opt out of the sale and sharing of their personal information. However, the control that businesses enjoy over the opt-out process allows them to impose hurdles on consumers aiming to opt out, including by employing dark patterns. Motivated by the enactment of the California Privacy Rights Act (CPRA), which strengthens the CCPA and explicitly forbids certain dark patterns in the opt-out process, we investigate how dark patterns are used in opt-out processes and assess their compliance with CCPA regulations. Our research on 330 CCPA-subject websites reveals that these websites employ a variety of dark patterns. Some of these patterns are explicitly prohibited under the CCPA; others seem to take advantage of legal loopholes.",

author = "Tran, \{Van Hong\} and Aarushi Mehrotra and Ranya Sharma and Marshini Chetty and Nick Feamster and Jens Frankenreiter and Lior Strahilevitz",

note = "Publisher Copyright: {\textcopyright} 2025 Copyright held by the owner/author(s).; 2025 CHI Conference on Human Factors in Computing Systems, CHI 2025 ; Conference date: 26-04-2025 Through 01-05-2025",

year = "2025",

month = apr,

day = "26",

doi = "10.1145/3706598.3714138",

language = "English",

series = "Conference on Human Factors in Computing Systems - Proceedings",

publisher = "Association for Computing Machinery",

booktitle = "CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems",

}

Tran, VH, Mehrotra, A, Sharma, R, Chetty, M, Feamster, N, Frankenreiter, J & Strahilevitz, L 2025, Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA). in CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems., 223, Conference on Human Factors in Computing Systems - Proceedings, Association for Computing Machinery, 2025 CHI Conference on Human Factors in Computing Systems, CHI 2025, Yokohama, Japan, 04/26/25. https://doi.org/10.1145/3706598.3714138

Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA). / Tran, Van Hong; Mehrotra, Aarushi; Sharma, Ranya et al.
CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery, 2025. 223 (Conference on Human Factors in Computing Systems - Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)

AU - Tran, Van Hong

AU - Mehrotra, Aarushi

AU - Sharma, Ranya

AU - Chetty, Marshini

AU - Feamster, Nick

AU - Frankenreiter, Jens

AU - Strahilevitz, Lior

PY - 2025/4/26

Y1 - 2025/4/26

N2 - To protect consumer privacy, the California Consumer Privacy Act (CCPA) requires businesses to provide consumers with a straightforward way to opt out of the sale and sharing of their personal information. However, the control that businesses enjoy over the opt-out process allows them to impose hurdles on consumers aiming to opt out, including by employing dark patterns. Motivated by the enactment of the California Privacy Rights Act (CPRA), which strengthens the CCPA and explicitly forbids certain dark patterns in the opt-out process, we investigate how dark patterns are used in opt-out processes and assess their compliance with CCPA regulations. Our research on 330 CCPA-subject websites reveals that these websites employ a variety of dark patterns. Some of these patterns are explicitly prohibited under the CCPA; others seem to take advantage of legal loopholes.

AB - To protect consumer privacy, the California Consumer Privacy Act (CCPA) requires businesses to provide consumers with a straightforward way to opt out of the sale and sharing of their personal information. However, the control that businesses enjoy over the opt-out process allows them to impose hurdles on consumers aiming to opt out, including by employing dark patterns. Motivated by the enactment of the California Privacy Rights Act (CPRA), which strengthens the CCPA and explicitly forbids certain dark patterns in the opt-out process, we investigate how dark patterns are used in opt-out processes and assess their compliance with CCPA regulations. Our research on 330 CCPA-subject websites reveals that these websites employ a variety of dark patterns. Some of these patterns are explicitly prohibited under the CCPA; others seem to take advantage of legal loopholes.

UR - https://www.scopus.com/pages/publications/105005761062

U2 - 10.1145/3706598.3714138

DO - 10.1145/3706598.3714138

M3 - Conference contribution

AN - SCOPUS:105005761062

T3 - Conference on Human Factors in Computing Systems - Proceedings

BT - CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems

PB - Association for Computing Machinery

T2 - 2025 CHI Conference on Human Factors in Computing Systems, CHI 2025

Y2 - 26 April 2025 through 1 May 2025

ER -

Tran VH, Mehrotra A, Sharma R, Chetty M, Feamster N, Frankenreiter J et al. Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA). In CHI 2025 - Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems. Association for Computing Machinery. 2025. 223. (Conference on Human Factors in Computing Systems - Proceedings). doi: 10.1145/3706598.3714138

Dark Patterns in the Opt-Out Process and Compliance with the California Consumer Privacy Act (CCPA)

Abstract

Publication series

Conference

Access to Document

Other files and links

Fingerprint

Cite this