The California Privacy Rights Act (CPRA) was a ballot initiative that revised the California Consumer Privacy Act (CCPA). Although often framed as expanding and enhancing privacy rights, a close analysis of textual revisions -- both changes from the earlier law and changes from earlier drafts of the CPRA guidelines -- suggest that the reality might be more nuanced. In this work, we identify three textual revisions that have potential to negatively impact the right to opt-out of sale under CPRA and evaluate the effect of these textual revisions using (1) a large-scale longitudinal measurement study of 25,000 websites over twelve months and (2) an experimental user study with 775 participants recruited through Prolific. We find that all revisions negatively impacted the usability, scope, and visibility of the right to opt-out of sale. Our results provide the first comprehensive evaluation of the impact of CPRA on Internet privacy. They also emphasize the importance of continued evaluation of legal requirements as guidelines and case law evolve after a law goes into effect.

翻译：《加州隐私权法案》（CPRA）是一项通过选民公投修改《加州消费者隐私法案》（CCPA）的倡议。尽管该法案通常被视为扩展和加强隐私权利，但通过对文本修订的细致分析——包括相较于先前法律的修改以及CPRA指南早期草案的变化——表明，实际情况可能更为复杂。本研究识别了CPRA中三项可能对消费者选择不出售个人信息的权利产生负面影响的文本修订，并借助以下两种方式评估了这些修订的效果：（1）一项对25,000个网站持续十二个月的大规模纵向测量研究，以及（2）通过Prolific平台招募775名参与者开展的实验性用户研究。我们发现，所有修订均对选择不出售个人信息的权利的可操作性、适用范围和可见性产生了负面影响。我们的研究结果首次全面评估了CPRA对互联网隐私的影响，同时也强调了随着法律生效后指南与判例法的演变，持续评估法律要求的重要性。