| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:data_subject_rights [2026/09/16 11:17] – Name the two results sections by which half of the topic they cover (signal-side vs request-side). Authored by Claude karel.kubicek.claude | privacy:data_subject_rights [2026/09/16 11:20] (current) – State the GPC boundary with Privacy:Consent on this side too, and prefer the browser preference over header injection. Authored by Claude karel.kubicek.claude |
|---|
| * **Non-response is your most common observation, and it is data.** **195 of the 454** registered California data brokers that {[kempen2026_consumer]} wrote to — 43% — never replied at all. Declare a deadline and a follow-up rule //before// you start, and report non-response as a result rather than dropping it. | * **Non-response is your most common observation, and it is data.** **195 of the 454** registered California data brokers that {[kempen2026_consumer]} wrote to — 43% — never replied at all. Declare a deadline and a follow-up rule //before// you start, and report non-response as a result rather than dropping it. |
| * **The response is a document you then have to code**, so half of this is an annotation study. **84.3%** of the 51 papers coded something by hand, against a corpus base rate of 56.6% — see [[Statistics:Annotation]]. | * **The response is a document you then have to code**, so half of this is an annotation study. **84.3%** of the 51 papers coded something by hand, against a corpus base rate of 56.6% — see [[Statistics:Annotation]]. |
| * **You are the data subject.** The ethics review is not the usual crawl review: you are disclosing your own identity documents to hundreds of strangers, and exercising the right can itself create a privacy risk. Two of these papers found that out the hard way. | * **You are the data subject.** The ethics review is not the usual crawl review: you are disclosing your own identity documents to hundreds of strangers, and exercising the right can itself create a privacy risk. {[martino2022_revisiting]} and {[kempen2026_consumer]} both found that out the hard way; see below. |
| * **On the signal side, know what is alive.** GPC is a **W3C Working Draft of 11 June 2026** and is mandatory in Colorado and California. The IAB **US Privacy String was deprecated on 31 January 2024**; Do Not Track is dead as a legal signal. A 2022-vintage measurement of the USP string is a measurement of a retired standard. | * **On the signal side, know what is alive.** GPC is a **W3C Working Draft of 11 June 2026** and is mandatory in Colorado and California. The IAB **US Privacy String was deprecated on 31 January 2024**; Do Not Track's standard is retired, though its legal status is not quite zero. A 2022-vintage measurement of the USP string is a measurement of a retired standard. |
| </WRAP> | </WRAP> |
| |
| | 2022 | PoPETs | 40 | organisations re-evaluated in 2021, by registered letter, under five assumed subject identities {[martino2022_revisiting]} | | | 2022 | PoPETs | 40 | organisations re-evaluated in 2021, by registered letter, under five assumed subject identities {[martino2022_revisiting]} | |
| | 2022 | IEEE S&P | 678 | apps with their own sign-up, of 1,435 analysed: account created by hand, then deleted {[santhanam2022_scraping]} | | | 2022 | IEEE S&P | 678 | apps with their own sign-up, of 1,435 analysed: account created by hand, then deleted {[santhanam2022_scraping]} | |
| | 2023 | PoPETs | 160 | Android apps sent a CCPA verifiable consumer request {[samarin2023_lessons]} | | | 2023 | PoPETs | 109 | of 160 selected Android apps — the ones whose policies carried CCPA disclosures — sent a verifiable consumer request {[samarin2023_lessons]} | |
| | 2024 | PoPETs | 20 | people-search websites, access and removal attempted by four researchers {[take2024_expect]} | | | 2024 | PoPETs | 20 | people-search websites, access and removal attempted by four researchers {[take2024_expect]} | |
| | 2024 | USENIX Sec | — | 33 participants requested **their own** exports; 801 files. The controllers are not enumerated {[borem2024_data]} | | | 2024 | USENIX Sec | — | 33 participants requested **their own** exports; 801 files. The controllers are not enumerated {[borem2024_data]} | |
| Two ways the population papers get more than 30, both worth copying: | Two ways the population papers get more than 30, both worth copying: |
| |
| * **Use a statutory registry as the frame.** {[kempen2026_consumer]} wrote to //every// data broker on California's official registry — 454 of the 543 registered, after exclusions — which is a census rather than a sample and removes the selection argument entirely. Registries exist in California, Vermont, Texas and Oregon; {[he2025_accuracy]} uses four of them. | * **Use a statutory registry as the frame.** {[kempen2026_consumer]} wrote to //every// data broker on California's official registry — 454 of the 543 registered, after exclusions — which is a census rather than a sample and removes the selection argument entirely. Registries exist in California, Vermont, Texas and Oregon, and {[he2025_accuracy]} uses all four. |
| * **Measure the mechanism instead of the answer.** {[yan2025_sign]}, {[santhanam2022_scraping]} and {[shezan2023_chkplug]} scale by checking whether the deletion path //exists and works// across hundreds or thousands of apps and plugins, and reserve the hand-sent request for a subsample. That is a different question — availability rather than compliance — and you should say which one you answered. | * **Measure the mechanism instead of the answer.** {[yan2025_sign]}, {[santhanam2022_scraping]} and {[shezan2023_chkplug]} scale by checking whether the deletion path //exists and works// across hundreds or thousands of apps and plugins, and reserve the hand-sent request for a subsample. That is a different question — availability rather than compliance — and you should say which one you answered. |
| |
| ==== Non-response is the most common outcome ==== | ==== Non-response is the most common outcome ==== |
| |
| Across the population, the modal answer to a request is silence or a form that goes nowhere. {[kempen2026_consumer]} put it at //"Above 40% failed to respond at all, in an apparent violation of the CCPA"// — and its Table 1 collects the response rates of seven earlier studies, most of them published outside this corpus's seven venues, which range from 57% to 93%. That spread is not a trend; it is seven different populations. | Across the population, the modal answer to a request is silence or a form that goes nowhere. {[kempen2026_consumer]} put it at //"Above 40% failed to respond at all, in an apparent violation of the CCPA"// — and its Table 1 is the best thing in the request literature for orientation: **13 rows of prior studies**, each with the number of entities asked, the law, the year and the response rate. The rates run from **55% to 100%**, across populations of 20 to 454. That spread is not a trend; it is thirteen different populations, most of them published outside this corpus's seven venues — though **three are in this page's population**: {[take2024_expect]}, {[martino2022_revisiting]} and {[samarin2023_lessons]}. |
| |
| Three things a reviewer will look for, and which the corpus papers do unevenly: | Three things a reviewer will look for, and which the corpus papers do unevenly: |
| What comes back is a ZIP file, a PDF, a spreadsheet, an email, or a link that expires. Somebody has to read it and assign it a label, and the quality of the paper is mostly the quality of that codebook. | What comes back is a ZIP file, a PDF, a spreadsheet, an email, or a link that expires. Somebody has to read it and assign it a label, and the quality of the paper is mostly the quality of that codebook. |
| |
| **84.3%** of the 51 papers (43) carry a hand-annotation step, against a corpus base rate of **56.6%**. They are also better than the corpus at saying how well the annotators agreed: **37.2%** of the annotating papers here state an agreement metric, against **15.4%** across the corpus's 3,318 annotating papers. Better is not good; three in five still do not. | **84.3%** of the 51 papers (43) carry a hand-annotation step, against a corpus base rate of **56.6%**. They are also better than the corpus at saying how well the annotators agreed: **37.2%** of the annotating papers here state an agreement metric, against **15.4%** across the corpus's 3,318 annotating papers. Better is not good: 27 of the 43 — nearly two in three — still do not. |
| |
| The concrete difficulty is that the unit of annotation is not obvious. {[borem2024_data]} is the paper to read on this: 33 participants shared **801 files**, the complexity //"varied both across and within platforms"//, and when the authors asked 59 specific questions of the exports, only **15** were fully answered. {[karnam2026_setting]} goes further and treats the export as something whose //correctness// can be measured, by browsing three platforms with sock-puppet accounts, requesting the export, and comparing it against a ground-truth log — reporting completeness and Jaccard similarity per platform, and concluding that //"the failure to disclose processing purposes, retention periods, and other third-party data recipients serves as a further indicator of non-compliance"// across all three. That design — instrument the behaviour, then ask for it back — is the strongest methodological idea in the 2026 slice, and it is the only way to separate "the platform did not collect it" from "the platform did not disclose it". | The concrete difficulty is that the unit of annotation is not obvious. {[borem2024_data]} is the paper to read on this: 33 participants shared **801 files**, the complexity //"varied both across and within platforms"//, and when the authors asked 59 specific questions of the exports, only **15** were fully answered. {[karnam2026_setting]} goes further and treats the export as something whose //correctness// can be measured, by browsing three platforms with sock-puppet accounts, requesting the export, and comparing it against a ground-truth log — reporting completeness and Jaccard similarity per platform, and concluding that //"the failure to disclose processing purposes, retention periods, and other third-party data recipients serves as a further indicator of non-compliance"// across all three. That design — instrument the behaviour, then ask for it back — is the strongest methodological idea in the 2026 slice, and it is the only way to separate "the platform did not collect it" from "the platform did not disclose it". |
| ===== Machine-readable opt-out is the scalable half ===== | ===== Machine-readable opt-out is the scalable half ===== |
| |
| A browser can assert an opt-out on every site it visits, which turns a 30-controller study into a 10,000-site crawl. Three generations of signal have tried this; only one of them is currently alive. | A browser can assert an opt-out on every site it visits, which turns a 30-controller study into a 10,000-site crawl. Four signals have tried this. Two are alive: **GPC**, which a person sets, and the IAB's **GPP**, which carries the result between publisher and vendors. The other two are history you still have to recognise in older papers. |
| |
| ^ Signal ^ Status on 2026-09-16 ^ What it is, for a measurement ^ | ^ Signal ^ Status on 2026-09-16 ^ What it is, for a measurement ^ |
| | **IAB US Privacy String** (''usprivacy'', the ''1YYN'' values) | **Deprecated 31 January 2024.** The IAB's own repository states: //"The US Privacy signal has been deprecated as of January 31, 2024. We strongly advise all users of the US Privacy String to transition to the Global Privacy Protocol"//.((https://github.com/InteractiveAdvertisingBureau/USPrivacy — repository README, read 2026-09-16.)) | An adtech-internal string carrying opt-out status between publisher and vendors, readable from a cookie or the ''__uspapi'' JavaScript API. Every corpus paper that measures it {[zimmeck2023_gpc]} {[aziz2024_johnny]} {[hausladen2025_websites]} crawled before or around the sunset. | | | **IAB US Privacy String** (''usprivacy'', the ''1YYN'' values) | **Deprecated 31 January 2024.** The IAB's own repository states: //"The US Privacy signal has been deprecated as of January 31, 2024. We strongly advise all users of the US Privacy String to transition to the Global Privacy Protocol"//.((https://github.com/InteractiveAdvertisingBureau/USPrivacy — repository README, read 2026-09-16.)) | An adtech-internal string carrying opt-out status between publisher and vendors, readable from a cookie or the ''__uspapi'' JavaScript API. Every corpus paper that measures it {[zimmeck2023_gpc]} {[aziz2024_johnny]} {[hausladen2025_websites]} crawled before or around the sunset. | |
| | **Global Privacy Platform → Global Privacy Protocol** (GPP) | Live and the successor. **Renamed** from "Platform" to "Protocol". The specification page's own //Last updated// stamp is 12 August 2026, and the August 2026 MSPA-alignment update was in public comment **until 11 September 2026** — five days before this page was written, with no finalised outcome posted yet.((https://iabtechlab.com/gpp/ , read 2026-09-16.)) | A container carrying per-jurisdiction sections (US national, plus per-state strings). If you are writing a parser in 2026, target GPP sections, not ''usprivacy''. Note the rename when you cite pre-2026 papers, which all say "Platform". | | | **Global Privacy Platform → Global Privacy Protocol** (GPP) | Live and the successor. **Renamed** from "Platform" to "Protocol". The specification page's own //Last updated// stamp is 12 August 2026, and the August 2026 MSPA-alignment update was in public comment **until 11 September 2026** — five days before this page was written, with no finalised outcome posted yet.((https://iabtechlab.com/gpp/ , read 2026-09-16.)) | A container carrying per-jurisdiction sections (US national, plus per-state strings). If you are writing a parser in 2026, target GPP sections, not ''usprivacy''. Note the rename when you cite pre-2026 papers, which all say "Platform". | |
| | **Global Privacy Control** (''Sec-GPC: 1'' and ''navigator.globalPrivacyControl'') | **W3C Working Draft, 11 June 2026**, published by the W3C Privacy Working Group.((https://www.w3.org/TR/gpc/ — //Global Privacy Control (GPC)//, W3C Working Draft 11 June 2026; editors Sebastian Zimmeck, Peter Snyder, Justin Brookman, Aram Zucker-Scharff. Read 2026-09-16.)) Legally mandatory in California and Colorado, and **California now legislates the browser side too** (see below). | The user-agent-to-site signal, and the only one of the four a person controls directly. This is where the measurement literature now is. | | | **Global Privacy Control** (''Sec-GPC: 1'' and ''navigator.globalPrivacyControl'') | **W3C Working Draft, 11 June 2026**, published by the W3C Privacy Working Group.((https://www.w3.org/TR/gpc/ — //Global Privacy Control (GPC)//, W3C Working Draft 11 June 2026; editors Sebastian Zimmeck, Peter Snyder, Justin Brookman, Aram Zucker-Scharff. Read 2026-09-16.)) Legally mandatory in California and Colorado, and **California now legislates the browser side too** (see below). | The user-agent-to-site signal, and the only one of the four a person sets directly. This is where the measurement literature now is. | |
| |
| ==== What GPC is, and what your crawler does about it ==== | ==== What GPC is, and what your crawler does about it ==== |
| **This is about to change by statute, and it will change what a crawl can do.** California AB 566 was approved by the Governor on 8 October 2025 as Chapter 465 and adds §1798.136 to the Civil Code: //"beginning January 1, 2027"//, it prohibits a business //"from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser"//.((California AB 566 (Lowenthal), //California Consumer Privacy Act of 2018: opt-out preference signal//, Chapter 465, approved by the Governor 8 October 2025, adding Civil Code §1798.136. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB566 , read 2026-09-16.)) Chrome has a ''chromestatus'' entry for GPC whose stated motivation is precisely that bill — //"This year California signed a bill under the CCPA/CPRA that obligates the browsers to provide ability to communicate do-not-sell-or-share preference before 2027"// — but it is at stage **Proposed**, was last touched on 2026-01-02, has no milestone attached and was not filed by a Google address.((chromestatus.com feature 5137324344213504, //Global Privacy Control//; read through the chromestatus API on 2026-09-16. Read the ''stages'' array, not the summary ''status'' field: here they agree, and there is no origin-trial or ship milestone in either.)) **Nothing has shipped.** If you are planning a longitudinal crawl that spans 1 January 2027, pin and record the browser build, because the baseline for "does this browser send GPC" is a statutory deadline away from moving. | **This is about to change by statute, and it will change what a crawl can do.** California AB 566 was approved by the Governor on 8 October 2025 as Chapter 465 and adds §1798.136 to the Civil Code: //"beginning January 1, 2027"//, it prohibits a business //"from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser"//.((California AB 566 (Lowenthal), //California Consumer Privacy Act of 2018: opt-out preference signal//, Chapter 465, approved by the Governor 8 October 2025, adding Civil Code §1798.136. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB566 , read 2026-09-16.)) Chrome has a ''chromestatus'' entry for GPC whose stated motivation is precisely that bill — //"This year California signed a bill under the CCPA/CPRA that obligates the browsers to provide ability to communicate do-not-sell-or-share preference before 2027"// — but it is at stage **Proposed**, was last touched on 2026-01-02, has no milestone attached and was not filed by a Google address.((chromestatus.com feature 5137324344213504, //Global Privacy Control//; read through the chromestatus API on 2026-09-16. Read the ''stages'' array, not the summary ''status'' field: here they agree, and there is no origin-trial or ship milestone in either.)) **Nothing has shipped.** If you are planning a longitudinal crawl that spans 1 January 2027, pin and record the browser build, because the baseline for "does this browser send GPC" is a statutory deadline away from moving. |
| |
| Three consequences for [[Programming:Crawler|the crawler]]: | Three consequences for [[Programming:Crawler|the crawler]] — and note that **[[Privacy:Consent]] owns the mechanics** of making a browser send the signal, including the fact that Firefox removed its DNT checkbox in version 135 and points users at GPC instead. Prefer setting the browser's own preference over injecting the header; inject only when your browser has no preference to set. |
| |
| * **Chrome and Chromium cannot send GPC natively.** If your instrument is Puppeteer or Playwright over Chromium — which is most of [[Programming:Crawler|the field]] — you must inject ''Sec-GPC: 1'' yourself on every request, and separately define ''navigator.globalPrivacyControl'' in the page context, because a site may check either. Checking only the header under-detects sites that read the DOM property, and vice versa. | |
| | |
| | * **Chrome, and the plain Chromium your automation library bundles, cannot send GPC natively** — Brave is Chromium and does, which is the point: it is a browser-vendor choice, not a Chromium limitation. If your instrument is Puppeteer or Playwright over stock Chromium — which is most of [[Programming:Crawler|the field]] — you must inject ''Sec-GPC: 1'' yourself on every request, and separately define ''navigator.globalPrivacyControl'' in the page context, because a site may check either. Checking only the header under-detects sites that read the DOM property, and vice versa. |
| * **GPC is a treatment, so it needs a control arm.** Every good measurement here is paired: the same crawl with and without the signal. {[rasaii2025_crumbs]} is the cleanest small example: enabling GPC cuts a site's **intractable cookies** — the paper's term for tracking cookies sent to third-party domains //before// that site has obtained consent, carried over from a banner accepted elsewhere — by about 30% on average, with a further 32% on a later visit that also rejects the banner. The number only means anything because the no-GPC arm exists. | * **GPC is a treatment, so it needs a control arm.** Every good measurement here is paired: the same crawl with and without the signal. {[rasaii2025_crumbs]} is the cleanest small example: enabling GPC cuts a site's **intractable cookies** — the paper's term for tracking cookies sent to third-party domains //before// that site has obtained consent, carried over from a banner accepted elsewhere — by about 30% on average, with a further 32% on a later visit that also rejects the banner. The number only means anything because the no-GPC arm exists. |
| * **Compliance is invisible in the network trace alone.** A site that honours GPC mostly does so by //not// doing something, and the observable proxies are the privacy strings. {[hausladen2025_websites]} reads four of them — the US Privacy String, the GPP string, the OneTrust ''OptanonConsent'' cookie and ''/.well-known/gpc.json'' — which is the current state of the art for detection and is also an admission that there is no direct signal. | * **Compliance is invisible in the network trace alone.** A site that honours GPC mostly does so by //not// doing something, and the observable proxies are the privacy strings. {[hausladen2025_websites]} reads four of them — the US Privacy String, the GPP string, the OneTrust ''OptanonConsent'' cookie and ''/.well-known/gpc.json'' — which is the current state of the art for detection and is also an admission that there is no direct signal. |
| * **On mobile there is barely a mechanism at all.** {[zimmeck2026_exercising]} (PoPETs 2026) is the newest and bluntest: //"only 48 out of 100 apps implement a respective setting"// for the CCPA opt-out right, and sending GPC to an app dataset of 1,811 apps was //"largely ineffective"// — with GPC set and AdID access disabled, **338 apps still had the ad network Vungle's ''ccpa'' status set to ''opted_in'' while only 26 had ''opted_out''**. The paper estimates with 95% confidence that 62–81% of its apps are subject to the right. | * **On mobile there is barely a mechanism at all.** {[zimmeck2026_exercising]} (PoPETs 2026) is the newest and bluntest: //"only 48 out of 100 apps implement a respective setting"// for the CCPA opt-out right, and sending GPC to an app dataset of 1,811 apps was //"largely ineffective"// — with GPC set and AdID access disabled, **338 apps still had the ad network Vungle's ''ccpa'' status set to ''opted_in'' while only 26 had ''opted_out''**. The paper estimates with 95% confidence that 62–81% of its apps are subject to the right. |
| * **An "opt out" can make the outcome worse.** {[mai2025_more]} disabled YouTube's ad personalisation and measured what was served instead: **1.30× more pre-roll ads**, and the share of predatory advertisements rose from **2.5% to 8.7%**. Whatever you are measuring, measure the thing the user cares about, not only whether the toggle moved. | * **An "opt out" can make the outcome worse.** {[mai2025_more]} disabled YouTube's ad personalisation and measured what was served instead: **1.30× more pre-roll ads**, and the share of predatory advertisements rose from **2.5% to 8.7%**. Whatever you are measuring, measure the thing the user cares about, not only whether the toggle moved. |
| * **The self-service dashboard is the other opt-out surface, and it is a data source.** {[bashir2019_quantity]} and {[caravaca2024_overprofiling]} both pull interest profiles out of ad preference managers; {[sharma2022_improving]} has participants donate their Google Voice Assistant data; {[akgul2025_vpnads]} and {[zaman2019_detecting]} use Google Takeout histories. The export is cheaper than a formal request and legally weaker — it is a product feature, not an Art. 15 response — so say which one you used. | * **The self-service dashboard is the other opt-out surface.** {[bashir2019_quantity]} and {[caravaca2024_overprofiling]} both pull interest profiles out of ad preference managers, and {[gkiouzepi2023_collaborative]} monitors them through an extension. It is also a data source — see the next section. |
| | |
| | ===== The export as a dataset ===== |
| | |
| | **Ten of the 51 papers do not measure the right at all — they use it to get data**, and if what you want is a platform's own record of somebody, this is the cheapest route in the literature. {[wei2020_twitter]} takes 447 Prolific participants' own Twitter data and gets 240,651 targeted ads out of it; {[karnam2026_bowling]} recruits 300 people who exercise Art. 15 against OpenAI and donate 138,231 ChatGPT conversations; {[zaman2019_detecting]} and {[akgul2025_vpnads]} use Google Takeout search and watch histories; {[onaolapo2021_socialheisting]} pulls Facebook's //Download Your Information// export from 1,008 honeypot accounts it controls itself; {[vombatkere2024_tiktok]} reuses somebody else's donation corpus of 347 TikTok users, which is the cheapest route of all. |
| | |
| | Four things this route costs you, none of them obvious from a crawl background: |
| | |
| | - **A product export is not an Art. 15 response, and the difference is legal, not technical.** A dashboard download is a feature the platform may change or withdraw; a right-of-access request is an obligation with a deadline. Say which one you used — several of the ten used the product surface and describe it as the right. |
| | - **The people are participants, and the data is the most sensitive a study can hold.** Every donation paper here recruits, consents and pays; budget for an IRB process shaped like a user study, not like a crawl. |
| | - **Format drift is your longitudinal confound.** The export's schema is the platform's to change, and {[karnam2026_setting]} measures exactly that — intra-user inconsistency between two snapshots of the same account, losing 6% of entries for Instagram and 12% for YouTube. |
| | - **Donation corpora are reusable, and reusing one is a legitimate design.** {[vombatkere2024_tiktok]} did, and it is the only paper in the population that got a 347-person trace set without recruiting anybody. |
| |
| ===== What the request-side papers measured ===== | ===== What the request-side papers measured ===== |
| ===== The regulator runs a bigger study than you can ===== | ===== The regulator runs a bigger study than you can ===== |
| |
| If your question is "how well do controllers implement the right of access", the largest measurement in existence is not a paper. The European Data Protection Board's 2024 Coordinated Enforcement Framework action on the right of access, adopted 16 January 2025, ran across **30 supervisory authorities** and reports that //"A total of 1,185 controllers responded to the questionnaire"//.((EDPB, //2024 Coordinated Enforcement Action: Implementation of the right of access by controllers//, adopted 16 January 2025, https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf — figures read from the PDF on 2026-09-16.)) The 2025 action, on the right to **erasure**, was adopted on 10 February 2026 across **32 supervisory authorities**, with //"a total of 764 controllers"// responding.((EDPB, //2025 Coordinated Enforcement Action: Implementation of the right to erasure by controllers//, adopted 10 February 2026, https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf — read 2026-09-16.)) That is 40 times the median paper in this population, twice over. | If your question is "how well do controllers implement the right of access", the largest measurement in existence is not a paper. The European Data Protection Board's 2024 Coordinated Enforcement Framework action on the right of access, adopted 16 January 2025, ran across **30 supervisory authorities** and reports that //"A total of 1,185 controllers responded to the questionnaire"//.((EDPB, //2024 Coordinated Enforcement Action: Implementation of the right of access by controllers//, adopted 16 January 2025, https://www.edpb.europa.eu/system/files/2025-01/edpb_cef-report-2024_20250116_rightofaccess_en.pdf — figures read from the PDF on 2026-09-16.)) The 2025 action, on the right to **erasure**, was adopted on 10 February 2026 across **32 supervisory authorities**, with //"a total of 764 controllers"// responding.((EDPB, //2025 Coordinated Enforcement Action: Implementation of the right to erasure by controllers//, adopted 10 February 2026, https://www.edpb.europa.eu/system/files/2026-02/edpb_cef-report_2025_right-to-erasure_en.pdf — read 2026-09-16.)) That is 40 and 25 times the median paper in this population. |
| |
| **It is a different instrument, and that is the opening.** The EDPB actions are questionnaires sent to controllers, backed by supervisory powers: the controller describes its own process. A researcher sends a request and observes what comes back. The two measure different things and have opposite biases — self-report versus behaviour — and none of the 51 papers in this page's population puts them side by side. The EDPB's own reports say the gap is real: authorities were //"surprised about the large number of controllers responding having received a very low number of access requests in 2023 – which could suggest that not all access requests are actually recognised as such"//. A study that sends requests to the same population the EDPB questioned would be a genuinely new result and is well within a PhD's reach. | **It is a different instrument, and that is the opening.** The EDPB actions are questionnaires sent to controllers, backed by supervisory powers: the controller describes its own process. A researcher sends a request and observes what comes back. The two measure different things and have opposite biases — self-report versus behaviour — and none of the 51 papers in this page's population puts them side by side. The EDPB's own reports say the gap is real: authorities were //"surprised about the large number of controllers responding having received a very low number of access requests in 2023 – which could suggest that not all access requests are actually recognised as such"//. A study that sends requests to the same population the EDPB questioned would be a genuinely new result and is well within a PhD's reach. |
| |
| The American analogue is arriving on a fixed schedule. California's Delete Request and Opt-out Platform (DROP) lets residents send one deletion request to every registered data broker at once: //"As of January 1, 2026, California residents may use DROP"//, and //"Data brokers are required to begin processing these requests on August 1, 2026"//.((California Privacy Protection Agency (CalPrivacy), //Data Broker Registry//, https://cppa.ca.gov/data_broker_registry/ , read 2026-09-16.)) That creates, for the first time, a **census population with a statutory deadline** — which is exactly the frame {[kempen2026_consumer]} had to assemble by hand a year earlier, now with an enforcement clock attached. The 1 August 2026 date has now passed; no compliance figure has been published by the agency that this page could find, and nothing in the corpus measures it. It is the most obviously available study on this topic right now. | The American analogue is arriving on a fixed schedule. California's Delete Request and Opt-out Platform (DROP) lets residents send one deletion request to every registered data broker at once: //"As of January 1, 2026, California residents may use DROP"//, and //"Data brokers are required to begin processing these requests on August 1, 2026"//.((California Privacy Protection Agency (CalPrivacy), //Data Broker Registry//, https://cppa.ca.gov/data_broker_registry/ , read 2026-09-16.)) That is the frame {[kempen2026_consumer]} assembled by hand a year earlier — a **census of every registered broker** — now with a statutory deadline and an enforcement clock attached to it. The 1 August 2026 date has now passed; no compliance figure has been published by the agency that this page could find, and nothing in the corpus measures it. It is the most obviously available study on this topic right now. |
| |
| **The EDPB series does not continue into data-subject rights in 2026.** The 2026 coordinated action, launched on 19 March 2026 with 25 DPAs, is on **transparency and information obligations** under Arts. 12, 13 and 14 — the duty to tell people what you are doing, not the right to ask.((EDPB, //CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR//, 19 March 2026, https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en , read 2026-09-16.)) So the 2024 and 2025 figures above are, for now, the whole regulator-scale series on the rights themselves. | **The EDPB series does not continue into data-subject rights in 2026.** The 2026 coordinated action, launched on 19 March 2026 with 25 DPAs, is on **transparency and information obligations** under Arts. 12, 13 and 14 — the duty to tell people what you are doing, not the right to ask.((EDPB, //CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR//, 19 March 2026, https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en , read 2026-09-16.)) So the 2024 and 2025 figures above are, for now, the whole regulator-scale series on the rights themselves. |
| ^ Method ^ Period in the corpus ^ Verdict on 2026-09-16 ^ | ^ Method ^ Period in the corpus ^ Verdict on 2026-09-16 ^ |
| | Hand-sent access / deletion / portability requests, responses coded by hand | 2020 → 2026, all 17 R papers | **Current, and still the only way to answer the compliance question.** Note the start year: **no paper in this corpus sent a rights request before 2020**, two years after the GDPR applied. The technique has not changed since; what changed is that registries now supply a census frame. | | | Hand-sent access / deletion / portability requests, responses coded by hand | 2020 → 2026, all 17 R papers | **Current, and still the only way to answer the compliance question.** Note the start year: **no paper in this corpus sent a rights request before 2020**, two years after the GDPR applied. The technique has not changed since; what changed is that registries now supply a census frame. | |
| | Two-stage design: exercise a right, then come back months later and exercise a second one to check | {[rupp2022_leave]} 2022; {[take2024_expect]} 2024 | **Current and under-used.** Two papers in eleven years. | | | Two-stage design: exercise a right, then come back months later and exercise a second one to check | {[rupp2022_leave]} 2022; {[take2024_expect]} 2024 | **Current and under-used.** Two papers out of 51. | |
| | Instrument first, then request: build a ground-truth log with sock puppets, then ask for the export and diff | {[karnam2026_setting]} 2026 | **The current frontier**, and the only design that separates non-collection from non-disclosure. | | | Instrument first, then request: build a ground-truth log with sock puppets, then ask for the export and diff | {[karnam2026_setting]} 2026 | **The current frontier**, and the only design that separates non-collection from non-disclosure. | |
| | Crawling for a **"Do Not Sell"** link | {[nortwick2022_setting]} 2022 → {[charatan2024_steps]} 2024 | **Current but no longer sufficient on its own.** Since the CPRA and Colorado made the signal mandatory, a site can be compliant with no link at all — {[charatan2024_steps]} found 340 sites where GPC was the //only// opt-out mechanism. Counting links alone now undercounts compliance. | | | Crawling for a **"Do Not Sell"** link | {[nortwick2022_setting]} 2022 → {[charatan2024_steps]} 2024 | **Current but no longer sufficient on its own.** Since the CPRA and Colorado made the signal mandatory, a site can be compliant with no link at all — {[charatan2024_steps]} found 340 sites where GPC was the //only// opt-out mechanism. Counting links alone now undercounts compliance. | |
| | Measuring the **US Privacy String** | {[zimmeck2023_gpc]} 2023, {[aziz2024_johnny]} 2024, {[hausladen2025_websites]} 2025 | **Superseded.** The string was deprecated on 31 January 2024. Read these papers for the method, retarget the parser at GPP. | | | Measuring the **US Privacy String** | {[zimmeck2023_gpc]} 2023, {[aziz2024_johnny]} 2024, {[hausladen2025_websites]} 2025 | **Superseded.** The string was deprecated on 31 January 2024. Read these papers for the method, retarget the parser at GPP. | |
| | Measuring **DNT** compliance | corpus-wide, mostly pre-2020 | **Historical.** The standard is retired; the one live legal hook is the 2023 Berlin judgment in the signal table above, and it is about a statement rather than a compliance rate. | | | Measuring **DNT** compliance | **none in this population** | **Historical.** The ''dnt'' probe was context-tier and never drove a candidate, so no DNT-compliance paper was audited into the 51 — that is a statement about this page's population, not about the corpus. The standard is retired; the one live legal hook is the 2023 Berlin judgment in the signal table above, and it is about a statement rather than a compliance rate. | |
| | Sending **GPC** and measuring what changes downstream | {[zimmeck2023_gpc]} 2023 → {[zimmeck2026_exercising]} 2026 | **Current, and the most active line in the corpus.** Seven of the twelve S papers are 2024 or later. | | | Sending **GPC** and measuring what changes downstream | {[zimmeck2023_gpc]} 2023 → {[zimmeck2026_exercising]} 2026 | **Current, and the most active line in the corpus.** Seven of the twelve S papers are 2024 or later. | |
| | **LLM agents** driving request portals | {[sun2026_suitability]} 2026 | **Emerging, one paper.** Treat as a research question, not a tool: the paper's own finding is about where the agent fails. | | | **LLM agents** driving request portals | {[sun2026_suitability]} 2026 | **Emerging, one paper.** Treat as a research question, not a tool: the paper's own finding is about where the agent fails. | |
