CCPA Disclosure Metrics: Entertainment & Media Edition

Last year, consumers exercised their rights to privacy more than 500,000 times with media & entertainment companies like Sony, Warner Media, Walt Disney, and Fox. Learn more about the state of CCPA compliance in the third installment of our CCPA metrics disclosure series. See parts one (big tech) and two (big box retail).

On July 1, 2021, certain businesses were mandated by the California Consumer Privacy Act (CCPA) to report specific privacy-related metrics around the number of data subject requests received, as well as how long it took to address them.

Not all businesses are required to publish CCPA metrics. Only companies with access to the personal information of at least 10 million California residents (which is about a quarter of the state’s population) must publish CCPA metrics. In previous editions of this blog series, we looked at the CCPA metrics of “Big Tech” companies such as Facebook, Amazon, and Apple, and the metrics behind Big Box Retailers, including commercial giants like Walmart, Home Depot, and Target. 

In this latest edition, we’ll see how businesses in the entertainment and media industry are handling data subject requests, specifically Fox News, Warner Bros., Disney, Sony Pictures, Viacom, and NBC Universal. 

Before we take a closer look at the metrics, let’s do some quick housekeeping and go over precisely what the law requires businesses to disclose. To comply with the CCPA, companies must report the number of customers who exercised their right to:

• Have their personal data deleted (deletion request)
• Know what information the businesses have about them (access request or DSAR)
• Opt out of the sale of their data to third parties (“Do Not Sell” request)

Additionally, businesses must also report how fast they responded to each of these requests, as the law mandates requests must be fulfilled within 45 days. If you’re interested in learning more about California’s decision to require disclosure metrics, feel free to check out our recent blog post on CCPA Reporting Metrics. 

Now, let’s take a look at what we found. 

The Highlights 

1. Entertainment companies generally received far fewer data requests than Big Tech companies. 

It is indeed hard to imagine any industry topping the 25 million data requests received by the giants in Big Tech, given their enormous user bases that interact with their apps everyday;  This group of entertainment companies, despite being relatively well known brands, only reported 500,000 data subject requests. Additionally, each category (access, deletion, opt-out) also saw fewer data subject requests on average than Big Box retailers. Still, at an average cost of $1,406 per data subject request received, the 500,000 amount represents a significant financial impact on the industry. 

2. Disney and NBC Universal received the most access requests by a wide margin—and neither supplied opt-out metrics.

Throughout our CCPA disclosure metric series, we’ve consistently seen opt-out (Do Not Sell) requests are the most commonly requested. However, in some cases (like in Big Tech), companies take advantage of loopholes to escape reporting opt-out requests. Here’s how it played out for top entertainment companies. 

Technically speaking, Warner Bros. reported the most opt-out requests in the group at 355,882. And yet Warner Bros received the fewest requests both to access and delete personal information from their customers. 

By comparison, Disney and NBC Universal received considerably more access and deletion requests than Warner Bros. but did not report opt-out requests for various reasons. The conundrum now is whether we can reasonably assume that Disney and NBC Universal also received considerably more opt-out requests than Warner Bros. or Fox News, despite the lack of data to confirm so. 

While both Disney and NBC Universal claimed not to provide opt-out metrics based on their use of third-party software, the rationalization in doing so differed. On NBC Universal’s website, they point to their use of third-party tools to say that they “cannot” track opt-out requests, whereas Disney’s website states that they “do not maintain [opt-out] metrics” via their third-party software providers. 

Whatever the reason may be, this paradigm can create friction with consumers who may have little knowledge about how data is collected or stop it from being sold.

3. Services offered and frequency of use could impact the number of data subject requests. 

It’s also worth noting that Disney and NBC Universal received thousands more requests to access or delete personal information than the other entertainment companies reviewed. This could be because both companies recently launched streaming services in the forms of Disney+ and Peacock. The larger share of data subject requests might suggest that consumers are more likely to access their rights to privacy with companies they interact with most frequently—whether it’s streaming services or social media platforms.

4. Fox News receives more than 3X more requests to delete than to access personal information but completed only 6% of deletion requests. 

While Fox News provided access to personal information to almost half of the consumers who requested it (42 out of 100), they could only delete the personal data of 19 consumers out of the 314 who made deletion requests. And although they state that this was “due to failure to verify identity or failure to separately confirm that they wanted their personal information deleted, as permitted by the CCPA,” the metric is in striking contrast with the rest of the entertainment companies we analyzed. It may be true that deletion can be complex and challenging for businesses, but Warner Bros., Disney, NBC Universal all complied with over 75% of deletion requests. Comparatively, the condensed metrics provided by Fox News are, at the very least, problematic.

Other Entertainment CCPA Disclosure Findings

• Walt Disney had the fastest response time to both access and deletion requests, at an average of 6 days for the former and seven days for the latter. In contrast, NBC Universal took the longest to respond in either category (access and deletion), at a median of 37.96 days for access requests and 31.19 days for deletion. On average, the majority of the entertainment companies complied with the 45 day window for completion. 
• Sony Pictures reportedly received the fewest number of access and deletion requests, with only 25 requests to access personal data and 62 requests for deletion. The next closest counterpart was Fandango, at 168 deletion requests made.
• While all entertainment companies received more deletion requests than access requests, NBC Universal received almost 7,000 more requests to delete than to access personal information. This is the most significant discrepancy between request types in the group. However, it’s also worth noting that NBC Universal fared better with complying with deletion requests than the others, successfully deleting over 90% of the consumer deletion requests. 

What the Entertainment Industry Shows Us About CCPA Compliance 

The entertainment industry’s contribution to the 2020 disclosure metrics is an interesting addition to the broader data being collected. We’re certainly eager to see how the sector hones its processes for dealing with these requests going forward. Looking at the metrics provided by these companies, the overall lack of uniformity is probably the most significant takeaway. There is an inability to compare apples to apples when some companies opt out of sharing stats for opt-out/Do Not Sell requests. 

Stay current on all the latest trends in CCPA disclosure metrics by subscribing to our newsletter.