  The California Privacy Rights Act (CPRA) was a ballot initiative that revised
the California Consumer Privacy Act (CCPA). Although often framed as expanding
and enhancing privacy rights, a close analysis of textual revisions -- both
changes from the earlier law and changes from earlier drafts of the CPRA
guidelines -- suggest that the reality might be more nuanced. In this work, we
identify three textual revisions that have potential to negatively impact the
right to opt-out of sale under CPRA and evaluate the effect of these textual
revisions using (1) a large-scale longitudinal measurement study of 25,000
websites over twelve months and (2) an experimental user study with 775
participants recruited through Prolific. We find that all revisions negatively
impacted the usability, scope, and visibility of the right to opt-out of sale.
Our results provide the first comprehensive evaluation of the impact of CPRA on
Internet privacy. They also emphasize the importance of continued evaluation of
legal requirements as guidelines and case law evolve after a law goes into
effect.
