> So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? They conclud

> So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? They conclude that it's a Princeton research study and throw it in the trash. This is part of the harm this study has done; because the researchers were not upfront about who they were and what they were doing, they have introduced uncertainty about the CCPA process. > Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered? That could be a good idea. It would depend, of course, on that agency being well-staffed and well-trained (both of which are separate from being well-funded, which can help). There's a giant pile of messy problems that can crop up due to negative influences from, say, corporations that want to sell more data. That said, it would be nice to have an org that can do the minimum legal work necessary to figure out if the claimant has a leg to stand on. That would not only minimize the harm of this sort of ill-advised study, but also make it harder to use threats of legal force to coerce smaller site owners.