The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply with the provisions of the CCPA that require them to provide consumers with accurate privacy notices and respond to "verifiable consumer requests" (VCRs) by disclosing personal information that they have collected, used, or shared about consumers for a business or commercial purpose. We compared the actual network traffic of 109 apps that we believe must comply with the CCPA to the data that apps state they collect in their privacy policies and the data contained in responses to "right to know" requests that we submitted to the app's developers. Of the 69 app developers who substantively replied to our requests, all but one provided specific pieces of personal data (as opposed to only categorical information). However, a significant percentage of apps collected information that was not disclosed, including identifiers (55 apps, 80%), geolocation data (21 apps, 30%), and sensory data (18 apps, 26%) among other categories. We discuss improvements to the CCPA that could help app developers comply with "right to know" requests and other related regulations.

翻译：《加州消费者隐私法案》（CCPA）赋予加州居民一系列增强的隐私保护与权利。本研究调查了Android应用开发者对CCPA条款的合规程度，该条款要求开发者向消费者提供准确的隐私声明，并通过回应“可验证消费者请求”（VCR），披露其因商业目的收集、使用或共享的消费者个人信息。我们选取了109个我们认为必须遵守CCPA的应用，将其实际网络流量与隐私政策中声明的数据收集情况，以及我们向开发者提交“知情权”请求后所获响应中的数据进行对比。在实质性回复我们请求的69家应用开发者中，除一家外均提供了具体个人数据（而非仅分类信息）。然而，显著比例的应用收集了未披露的信息，包括标识符（55个应用，80%）、地理位置数据（21个应用，30%）、感官数据（18个应用，26%）等类别。我们讨论了可能帮助开发者遵守“知情权”请求及其他相关法规的CCPA改进方案。