Ad-free. Influence-free. Powered by consumers.
Skip to Main ContentThe payment for your account couldn't be processed or you've canceled your account with us.
Re-activateMedia Room
YONKERS, NY – Consumer Reports and a consortium of partners announced today the completion of a new iteration of the Data Rights Protocol. This protocol will enable companies to more easily process consumer data rights requests and comply with privacy laws. This latest version of the protocol, which includes full-bodied security and identity features, is now ready to operate in production systems across the U.S.
CR has led the effort to improve the operations and implementation of privacy laws such as the landmark California Consumer Privacy Act (CCPA) to ensure the data of consumers are being protected. The CCPA and other state privacy laws provide millions of consumers with new privacy rights that allow them to access, control, and delete their data and opt out of its sale. However, fulfilling consumer data rights requests is a challenging problem for companies, especially at scale. As a result, many companies are seeking solutions to better streamline and standardize these highly technical workflows.
The CCPA anticipated these challenges and built in a provision for “authorized agents” that could help consumers exercise their data rights by serving as an intermediary between consumers and companies. Many people have chosen to enroll an intermediary to help manage their data, and many companies have been seeking guidance on how to process requests that come in from intermediary agents. To address this, CR has been proactively working with partners in industry to incubate a new open standard.
“Consumer Reports is dedicated to securing digital rights by leading the way on technical solutions,” said Marta L. Tellado, Consumer Reports president and CEO. “The Data Rights Protocol is the latest example of our work combining innovation and collaboration to improve the marketplace. By creating this standard, we are making it easier for companies to process data requests and for consumers to successfully exercise their digital rights.”
The Data Rights Protocol articulates a pattern for processing data rights requests with authorized agents; it combines technical APIs with governance practices and a set of operating agreements. The protocol is being co-developed by a consortium led by Consumer Reports and ten other organizations across marketplace roles: consumer agents, B2B privacy infrastructure provider companies, and businesses that need to comply with CCPA and other state laws. The consortium’s goal for the protocol is to make processing consumer privacy requests more efficient.
Privacy infrastructure companies can test their Data Rights Protocol implementations to demonstrate conformance using CR’s open source implementers’ reference for authorized agents, or OSIRAA. OneTrust, Transcend, Ethyca, and Incogni by Surfshark have all tested their implementations of the protocol successfully and are on-track to deploy the protocol in their production systems.
In parallel, CR has also started to develop its own authorized agent — Permission Slip, a free mobile app on iOS that aims to make it easy for consumers to take control of the personal data companies have about them. The protocol and the app are the latest efforts by CR to elevate digital rights.
Additionally, the Data Rights Protocol consortium has launched a new website that companies can visit for more information and regular updates.
Founded in 1936, CR has a mission to create a fair and just marketplace for all. Widely known for our rigorous research and testing of products and services, we also survey millions of consumers each year, report extensively on marketplace issues, and advocate for consumer rights and protections around safety as well as digital rights, financial fairness, and sustainability. CR is independent and nonprofit.
© 2025 Consumer Reports. The material above is intended for legitimate news entities only; it may not be used for advertising or promotional purposes. Consumer Reports® is an expert, independent, nonprofit organization whose mission is to work side by side with consumers to create a fairer, safer, and healthier world. We accept no advertising and pay for all the products we test. We are not beholden to any commercial interest. Our income is derived from the sale of Consumer Reports® magazine, ConsumerReports.org® and our other publications and information products, services, fees, and noncommercial contributions and grants. Our Ratings and reports are intended solely for the use of our readers. Neither the Ratings nor the reports may be used in advertising or for any other commercial purpose without our prior written permission. Consumer Reports will take all steps open to it to prevent unauthorized commercial use of its content and trademarks.
