  Vagueness and ambiguity in privacy policies threaten the ability of consumers
to make informed choices about how businesses collect, use, and share their
personal information. The California Consumer Privacy Act (CCPA) of 2018 was
intended to provide Californian consumers with more control by mandating that
businesses (1) clearly disclose their data practices and (2) provide choices
for consumers to opt out of specific data practices. In this work, we explore
to what extent CCPA's disclosure requirements, as implemented in actual privacy
policies, can help consumers to answer questions about the data practices of
businesses. First, we analyzed 95 privacy policies from popular websites; our
findings showed that there is considerable variance in how businesses interpret
CCPA's definitions. Then, our user survey of 364 Californian consumers showed
that this variance affects the ability of users to understand the data
practices of businesses. Our results suggest that CCPA's mandates for privacy
disclosures, as currently implemented, have not yet yielded the level of
clarity they were designed to deliver, due to both vagueness and ambiguity in
CCPA itself as well as potential non-compliance by businesses in their privacy
policies.
