Lessons in VCR Repair: Compliance of Android App Developers with the California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) provides residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply provisions CCPA that require them provide consumers accurate notices respond "verifiable consumer requests" (VCRs) by disclosing personal information they have collected, used, or shared about for business commercial purpose. We compared actual network traffic 109 apps we believe must data state collect in their policies contained responses "right know" requests submitted app's developers. Of 69 who substantively replied our requests, all but one provided specific pieces (as opposed only categorical information). However, significant percentage collected was not disclosed, including identifiers (55 apps, 80%), geolocation (21 30%), sensory (18 26%) among other categories. discuss improvements could help related regulations.