Johnny Still Can't Opt-out: Assessing the IAB CCPA Compliance Framework
https://petsymposium.org/popets/2024/popets-2024-0120.php
Method
"virtual machines from Amazon Web Services with IP addresses in California"
Population
"top 10 K domains from the Tranco list"
What it does not show
Measures technical signal propagation, not intent, liability or enforcement. Limited to sites using this particular framework and to vantage points in one jurisdiction; custom opt-out implementations are out of scope.
Muhammad Abu Bakar Aziz, Christo Wilson
Only 8.2% of publishers implemented the opt-out API at all, and only 3.6% stored the signal in the standard cookie. Where it was implemented, sending a global opt-out flipped the signal for only 380 of 825 publishers — 46.1%. Across more than 1.2 million advertising chains, 17.9% propagated the opt-out downstream, and tracking-pixel deployment showed no statistically significant change when the signal was present.
Tier II: Ten-month automated crawl of 10,000 real domains and their live advertising chains. Observational measurement of an ecosystem with no control group.