The California Consumer Privacy Act specifies a role for an authorized agent, which it defines as “a natural person or business entity registered with the Secretary of State to conduct business in California that a consumer has authorized to act on their behalf.” Said otherwise, authorized agents are intermediaries with the authority to send data rights requests on behalf of a consumer. Permission Slip was designed to leverage California’s authorized agent provision, which is how the app is able to send data requests on your behalf. Since then, a handful of other states have passed authorized agent provisions as part of their privacy laws. Many companies choose to honor agent requests whether or not the consumer lives in a state with privacy laws that allow for them.
Permission Slip helps you exercise your right to privacy by acting as your “authorized agent” and making data requests for you. State laws require that consumers sign an agreement in order to designate an individual or organization to act as their agent. Due to this requirement, we ask all Permission Slip users to sign an agreement before sending requests to companies on your behalf.
Permission Slip was originally designed around the California Consumer Protection Act (CCPA), which defined new data rights for residents of California. Since then, new states have passed privacy laws and we have adapted Permission Slip to be as effective as possible in these states. Permission Slip has also proven to be effective in states that don’t currently have privacy laws on the books, since many companies choose to show their commitment to consumer privacy by honoring data rights independent of the state the consumer comes from.
Anyone in the U.S. and territories can use Permission Slip. The success rate on your requests is likely to be higher if you live in a state that has a privacy law, particularly if your state’s privacy law contains an authorized agent provision. Permission Slip works best in the context of U.S. privacy laws. If you live outside the USA, you will likely have issues trying to sign up and send requests with Permission Slip. There may be better tools available in your country of residence.
If you’re having trouble using Permission Slip or have questions about the app, you can contact our support team via email at permissionslip@cr.consumer.org.
If you’re a company looking to get in touch with the Permission Slip team about request processing, you can email industryrelations@permissionslipcr.com.
We’d like to hear what you think of the app! Please email any and all thoughts to permissionslip@cr.consumer.org and a member of our Support team will get back to you. You can also submit feedback in the app via Menu → Feedback. To suggest specific companies you’d like to see in Permission Slip, you can use the Suggested Companies feature in the app or the two other methods outlined here to let us know.
If you cannot remember your password, click “forgot password” on the login screen and type in the email address that you use for your Permission Slip account. You’ll then receive a link to reset your password via email.
Because Permission Slip sends requests for you, we need to make sure your contact information is up to date and accurate. If you need to edit your profile details, please email our support team to assist you via permissionslip@cr.consumer.org.
Navigate to the Requests screen in the Permission Slip app, and tap on the request you’d like to cancel. You’ll land on the request status page, where you’ll find a “Cancel request” button in the upper right corner. You can email support permissionslip@cr.consumer.org for assistance, too.
If you miss the response window to complete a deletion request, please contact Permission Slip support (permissionslip@cr.consumer.org) and our team will attempt to resubmit your request.
Auto requests are a feature within Permission Slip that help you manage your data with data brokers, companies that profit from selling your data without your consent. Though these companies are not household names, they hold and broker large amounts of consumer data and can be a threat to your privacy. When you enroll in auto requests with Permission Slip, we proactively reach out to data brokers on your behalf and tell them to stop selling your data. We keep the status of your auto-requests up-to-date in the app so that you know when these requests are successful.
Permission Slip is currently available as a mobile application on both iOS and Android. While we may create a web app or desktop app for Permission Slip in the future, neither is available today.
There’s no one size fits all for managing your data, If you’re not sure you have an account with a company and you’re wondering how to proceed, consider the kind of company this is. The company may be a data broker, an entity that collects information about consumers and then sells that data for profit. Data brokers are marked with a red “data broker” label in the app, and they often collect information about us without our awareness or consent. Because data brokers operate in the shadows, it’s often worth sending privacy requests to data brokers, even if you’re not sure that they have your information. Alternatively, if the company is a consumer brand and you don’t recall ever doing business with them, there’s no need to send a privacy request because the company is unlikely to have your data.
Many state laws ask that companies respond to consumer data rights requests without undue delay, and no later than 45 days after receiving the request (though they are often allowed to extend the response period for various reasons). Many Permission Slip requests tend to be resolved within this initial 45-day window. However, companies don’t always make these deadlines or respond to requests at all for consumers who live outside of certain states. If the legal window to respond to your request has passed, the request may be marked as Expired in the app.
Some companies do not meet the legal definition of selling consumers’ personal information. For these companies, sending a “Do Not Sell My Information” request will have no impact, so we don’t offer the option to send do not sell requests to these companies in Permission Slip.
If it’s been a few days since Permission Slip submitted your request to the company and you haven’t heard from a company, we first recommend checking your spam folders and voicemail. Many companies require you to verify your identity before they can proceed with your request, and in these cases they usually email or call to confirm that you are who you say you are. After your identity is confirmed, companies generally have between 15 and 45 business days to fulfill your request, depending on what state you’re located in and what type of request you initiated.
If over two months have passed since Permission Slip submitted your request to the company and you haven’t heard anything from a company, it’s possible that the company had technical issues or ignored your request. Unfortunately, we at Permission Slip cannot control what other companies and organizations do. However, we do note internally which companies respect consumer privacy and which do not. We also advocate behind the scenes for companies to be more responsive to consumer data rights requests.
Yes, Permission Slip allows you to add multiple emails so that companies can more easily facilitate your requests. To add another email address in Permission Slip, tap the menu icon in the top left corner (three horizontal lines). From the menu select “Account.” From your account page, scroll down and select "Additional emails" and then tap “Add another email”. Once you’ve added the emails you have, click Save. You’ll see a notification “Additional emails added ✅.” Now when you submit new data requests, all emails added to your account will be submitted to the company, which should improve the success rates of your requests.
Two concrete things you can do to maximize the success of requests you send via Permission Slip are 1) make sure your account uses your full legal name, and 2) tell Permission Slip any and all emails you use with companies. In order to action your request, the company needs to be able to locate your data in their systems. Having a correct name and email address on file when we approach a company makes it easier for that company to find your data, and then delete or stop selling it.
If you feel that a company is not cooperating with your request, you can email concerning responses or screenshots to Permission Slip’s support team permissionslip@cr.consumer.org. We will do what we can to assist you. Depending on what state you’re coming from, the company may not be legally obligated to respond to your request or respond at all. Sometimes companies don’t have the information they need to locate your data in their systems – we recommend sharing your full legal name and all of the emails you use with Permission Slip to abate this. Companies’ communications also get sent to spam folders sometimes, so we advise checking spam regularly for information related to your requests. The Permission Slip team pays attention to how companies are behaving when we send requests on your behalf, and we do what we can to make the requests we send for you more successful.
As of today, Permission Slip only accommodates requests to manage consumer data; requests to manage company data are not supported. Some companies consider current and past employees or contractors as “consumers” for requests; others do not. If we have relevant information about whether companies classify employee data as consumer data based on our research, we will try to include it in the app.
To send requests on your behalf, Permission Slip requires a verified email, a verified phone number that can receive SMS, your mailing address, and your full legal name. Additionally, we invite you to provide any additional email addresses you use in your interactions with companies, as knowing these emails can help make your requests more successful. This personal information is included with every request we send to a company on your behalf so that the company can locate your data in their systems, and either delete it or stop selling it. For more information on how Permission Slip treats your data, read our privacy policy.
Requests may not be resolved as quickly as you might like for a variety of reasons. Privacy laws vary from state to state and they don’t exist everywhere. What’s more, not all companies are bound by them. Companies have 45 days to comply with a request in most states, and they can also activate an extension on turning around your requests. These extensions often double the allowable response time to 90 days.
If you haven’t heard back from the company, we first recommend checking your spam folders and voicemail. Many companies require you to verify your identity before they can proceed with your request, and in these cases they usually email or call to confirm that you are who you say you are.
Unfortunately, we do see some companies that do not reply to data requests despite their legal obligations. Sometimes they sideline these requests for a long time and are only responsive to multiple follow-ups from Permission Slip or after public accountability measures such as actions by state attorney generals’ offices. One of the benefits of using Permission Slip is that we are able to look at aggregate data to see which companies are not complying with data requests on a large scale. We report that data out to our advocacy teams and others who can demand change.
You’ll know Permission Slip has started working for you when you get your first request fulfilled! The key here is patience: companies have 45 days to comply with a request, and in many cases, they can ask for an extension that would double the allowable response time to 90 days.
Permission Slip tracks these requests for you to ensure that companies are responding in a timely manner. If the companies don’t, then we’re here to push for your data rights with the companies and regulators.
