4 ms·

That text was already there in the original version from June 2020. It appears that the newly added text is underlined in the document you linked. Here is the

by comex 6y ago

That text was already there in the original version from June 2020. It appears that the newly added text is underlined in the document you linked. Here is the relevant bit: -- (h) A business’s methods for submitting requests to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out. A business shall not use a method that is designed with the purpose or has the substantial effect of subverting or impairing a consumer’s choice to opt-out. Illustrative examples follow: (1) The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. The number of steps for submitting a request to opt- out is measured from when the consumer clicks on the “Do Not Sell My Personal Information” link to completion of the request. The number of steps for submitting a request to opt-in to the sale of personal information is measured from the first indication by the consumer to the business of their interest to opt-in to completion of the request. (2) A business shall not use confusing language, such as double-negatives (e.g., “Don’t Not Sell My Personal Information”), when providing consumers the choice to opt-out. (3) Except as permitted by these regulations, a business shall not require consumers to click through or listen to reasons why they should not submit a request to opt-out before confirming their request. (4) The business’s process for submitting a request to opt-out shall not require the consumer to provide personal information that is not necessary to implement the request. (5) Upon clicking the “Do Not Sell My Personal Information” link, the business shall not require the consumer to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism for submitting a request to opt-out.

buro9 6y ago
Would have loved if an addition was: (6) The steps to discover and opt-out shall be no more difficult than the original steps to discover and opt-in. It's the asymmetry of effort in granting consent and attempting to revoke it, or of signing up to a service and attempting to cancel it (hello Economist!) that is a pain.
xg15 6y ago
> (1) The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. This seems really oddly worded, like wanting to preserve a loophole. This sounds like it would be perfectly compliant to e.g. make you click through half a dozen "show advanced settings" links to opt-out - as long as you put the "re-opt-in" button (that no one outside a marketeer's fantasy would ever want to use) in the same place. A site could still make opt-out unnecessarily difficult compared to the path they want their users to take: Just dismiss the popup and never opt-out at all. edit: Then again, the parent paragraph (h) seems stricter. Is (h)(1) then just an "illustrative example" and not legally binding?

by comex 6y ago

buro9 6y ago

Would have loved if an addition was: (6) The steps to discover and opt-out shall be no more difficult than the original steps to discover and opt-in. It's the asymmetry of effort in granting consent and attempting to revoke it, or of signing up to a service and attempting to cancel it (hello Economist!) that is a pain.

xg15 6y ago

> (1) The business’s process for submitting a request to opt-out shall not require more steps than that business’s process for a consumer to opt-in to the sale of personal information after having previously opted out. This seems really oddly worded, like wanting to preserve a loophole. This sounds like it would be perfectly compliant to e.g. make you click through half a dozen "show advanced settings" links to opt-out - as long as you put the "re-opt-in" button (that no one outside a marketeer's fantasy would ever want to use) in the same place. A site could still make opt-out unnecessarily difficult compared to the path they want their users to take: Just dismiss the popup and never opt-out at all. edit: Then again, the parent paragraph (h) seems stricter. Is (h)(1) then just an "illustrative example" and not legally binding?