In a clear demonstration of how difficult it can be for consumers to exercise their privacy rights, Consumer Reports found that even trained agents could not get many requests done successfully. Utilizing California’s “authorized agent” provision, 124 Consumer Reports agents reached out to 21 companies, including Airbnb, Amazon, Comcast, Home Depot and Starbucks to use Data Subject Access Requests (DSAR) and other company privacy preference mechanisms to make account changes.

What they found were: 1) some companies claimed the opt-out didn’t apply to them, 2) some added steps to the opt-out process or only partially complied, 3) and while 57% ultimately confirmed they stopped selling all or some data in response, 24% claimed not to sell data and 14% never confirmed that opt-outs had been processed.