The Challenge
Consumer Reports' Digital Lab encountered a common issue for those handling data subject access requests (DSARs): the lack of a standardized process for consumers to communicate their rights to companies. Under CCPA and CPRA, California residents can request deletion, access, or correction of their personal data, and organizations must respond within 45 days. However, requests vary widely in format, arriving through web forms, emails, or authorized agents, with no standard for proving authorization or transmitting details.
This inconsistency creates operational headaches for enterprises. You're forced to build custom systems, manually verify identities, and track requests in spreadsheets. For consumers, it's a repetitive and frustrating process, filling out the same information across multiple sites.
Consumer Reports identified this as both a policy and technical failure. While they had been involved in legislative advocacy, they recognized the need for practical infrastructure to address the problem.
Constraints and Environment
Consumer Reports tackled this challenge with two main constraints.
First, they couldn't rely on proprietary software for widespread adoption. Existing DSAR management platforms use different APIs and data formats, requiring organizations to integrate with multiple systems. Consumers would also need to trust commercial intermediaries with sensitive requests.
Second, any solution had to comply with existing regulations. While CCPA and CPRA allow consumers to use authorized agents, they don't specify how authorization should be verified. Consumer Reports aimed to create a technical standard that regulators would recognize as compliant.
They also needed credibility. As an advocacy group, they had influence in policy but limited experience in technical infrastructure. Gaining support from privacy tech vendors was crucial.
The Approach Taken
Consumer Reports launched two initiatives: the Data Rights Protocol and a service called Permission Slip.
The Data Rights Protocol is an open standard for formatting and transmitting DSARs between consumers (or their agents) and organizations. It outlines request structures, authorization proof, and compliant responses. It's open-sourced, allowing any vendor or organization to implement it without fees.
Permission Slip is Consumer Reports' implementation of the protocol. It acts as an authorized agent, submitting deletion, access, or opt-out requests on behalf of consumers. It uses the Data Rights Protocol to standardize these requests.
By developing both the standard and a reference implementation, Consumer Reports demonstrated the protocol's practicality. They invited privacy tech vendors to adopt it without routing requests through Consumer Reports.
This collaborative effort involved working with privacy tech vendors to solve a shared technical problem, rather than imposing a unilateral specification.
Results and Metrics
The Data Rights Protocol is now available for any organization or vendor to implement. Consumer Reports also launched Permission Slip as a functioning authorized agent service.
The protocol covers request types aligned with CCPA and CPRA rights, such as deletion, access, sale opt-out, and correction. It includes authentication mechanisms to verify requests from authorized agents and standardizes response formats, simplifying consumer comparisons of data handling by different companies.
For organizations, adopting the protocol means you can process requests from any authorized agent using a single API. There's no need for custom integrations for each service acting on behalf of consumers.
For consumers, Permission Slip simplifies the process. They authorize Consumer Reports once, select companies to send requests to, and Permission Slip handles the rest.
Lessons Learned
Consumer Reports hasn't published a formal retrospective, but their approach reveals some tradeoffs.
By releasing both an open standard and a consumer service, they risked confusion. Is the Data Rights Protocol neutral infrastructure, or a competitive edge for Permission Slip? Privacy tech vendors might hesitate to adopt a standard that also supports a competing service.
The protocol's adoption relies on voluntary implementation by organizations. Unlike payment card or email standards, there's no regulatory mandate to accept requests via the Data Rights Protocol. Adoption depends on organizations recognizing the operational benefits of standardization.
Consumer Reports could have focused solely on the open standard, leaving the authorized agent role to commercial vendors. This would have positioned them as neutral infrastructure providers, but it might have delayed a working reference implementation.
Takeaways for Your Team
If you're managing DSAR operations, consider the Data Rights Protocol as a framework, even if you don't adopt it immediately.
First, expect authorized agents to increasingly use structured APIs over email or web forms. Your intake process should handle programmatic requests. When building or buying a DSAR management platform, check if it supports the Data Rights Protocol or similar standards.
Second, the protocol outlines what a well-formed request should include. Even if you don't implement the full standard, use it as a checklist. Ensure your intake form captures request types clearly, verify authorized agent relationships, and generate structured responses.
Third, Consumer Reports' dual approach (open standard plus consumer service) indicates a shift where advocacy groups build infrastructure to operationalize laws. This infrastructure might become a de facto standard without a formal mandate.
If you're receiving requests from Permission Slip or other agents, see them as indicators of market trends. As more consumers use intermediaries, the pressure to support standardized request formats will grow. Building this capability now, while volumes are low, is easier than retrofitting it later under regulatory pressure.
