Last Updated November 14, 2022 (“Effective Date”)
Consumer Reports (hereafter “CR”, “we” or “us") is an independent, nonprofit member organization that works side by side with consumers for truth, transparency, and fairness in the marketplace. We created Permission Slip because we believe consumers should be in control of their own personal information. This Privacy Policy explains how we collect, use, share, and store data related to your use of the Permission Slip App (“the App”) and related web site (the “Site”) (collectively, “Permission Slip”). This Privacy Policy is part of the Consumer Reports User Agreement, which contains additional information about your relationship with us.
Permission Slip collects information in order to provide the Permission Slip services to you, to improve your experience, and to communicate with you about privacy research, policy and related activities we think might be of interest. We collect information about users in three ways: directly from the user, through the user’s interactions with Permission Slip, and from third parties.
When you use Permission Slip, we’ll ask you for the following personal information in order to create an account, fulfill your requests, and otherwise engage with you:
Additionally, we may collect information from you about your opinions, actions and experiences regarding consumer policy issues and other topics or when providing you with customer support.
We and our service providers collect certain information automatically about your online activities and your devices through technical means, including through the use of cookies, web beacons, and other technologies.
When you send a data deletion, a do-not-sell or other privacy request to a company through the App, we may ask for additional information required from us by the company receiving the request. Please note that companies may contact you directly for additional information in connection with your request.
*By submitting your mobile phone number you agree that you are providing Consumer Reports with express written authorization to send a one-time text message to the number provided using automated technology for identity verification purposes.
In addition to information we ask you for directly, we collect information when you use the App to issue do-not-sell or data deletion requests to companies. Whenever you make a request, we record:
We also collect information about how you interact with Permission Slip, which is called “analytics information.” Analytics information we collect includes:
We use Woopra to collect analytics information about your interaction with the Permission Slip App and our Site. Woopra uses cookies (small text files stored on your device), beacons (small files embedded in the App) and other online technologies to collect information about your usage. We also use Firebase to collect App analytics in order to send push notifications.
We sometimes receive information about you from third parties. If you arrive at our App or Site through an ad on a search engine, social media network, or another website, the referring service may send us information about how you found us. If you log in to the App using an account on another service, such as Apple or Google, we may receive basic account information from that service.
Permission Slip relies on third-party services and applications to function, to improve your experience, and for other purposes consistent with our mission. Some of these third parties may collect information about you. For example, since we collect your mobile phone number for identity verification purposes, your wireless carrier may also collect data about your wireless device usage. In order to help you make the most informed decision, we’re identifying some of these third parties below and will endeavor to update this list as Permission Slip evolves:
Please note that Permission Slip does not control what information these third parties collect. We invite you to read about their privacy policies and practices for better understanding of the information these third parties collect.
The purpose of Permission Slip is to help you learn about companies’ data practices, exercise your data rights and options, and champion individual privacy rights. While we expect that the App’s features will grow over time, the way we use your data will always be consistent with this core mission. Right now, there are four ways Permission Slip uses data: providing the Permission Slip service, maintaining and improving the Permission Slip App and Site, marketing the Permission Slip service, and for consumer research and advocacy.
When you sign up for Permission Slip, we use your email address, a password you designate, and your state of residence to create your account; alternatively, you can log in using your Apple account. When you make a data deletion or do-not-sell request through the App, we need to let the company know who is making the request so that they can identify you. For purposes of processing your requests, we collect your first and last name, mobile phone number, mailing address, any additional email address(es) you wish to share to help the company identify you, and any additional information that may be required in order to process your request.
We use cookies and other technologies as part of providing our services. These technologies help make our digital services better and enhance the user experience by offering you a more relevant and customized experience. We also use these technologies to monitor and stabilize our website, measure the use and effectiveness of our content, remember you when you log in, and promote our products and services.
We may use information about your usage to understand how users interact with Permission Slip, if and how companies respond to requests, where users may be having trouble, and whether technical issues may be affecting the App or Site or preventing users from accessing our services. Specific ways we use information include:
We may use information we collect to inform our marketing strategies and reach other users who may benefit from Permission Slip. There are a few ways we use your information for marketing or advertising purposes:
We may use aggregated and de-identified individual-level data collected from users for research purposes consistent with Consumer Reports’ mission of fighting for fairness in the marketplace. Our research will use the information collected as described in this Privacy Policy and our Consumer Reports Survey Policy to help consumers exercise their rights, assess companies’ compliance with their obligations under applicable law, and move the marketplace to protect and empower consumers. Our research will also support CR’s engagement and advocacy efforts to influence legislators, regulatory bodies and other marketplace actors.
From time to time, we may conduct in-depth research studies with Permission Slip users to understand their experiences and views on privacy and related issues. Participants in these in-depth research studies will be asked to provide their opt-in consent to the collection and use of their information for any such research studies.
We share information collected from or about you with others, including service providers, target companies in order to process your privacy requests, industry experts, and other third parties, for the purposes described below.
You can use Permission Slip to send requests to other companies to delete or restrict the sale of your personal information. To do this, we send some identifying information to the other company, typically your name, email address, phone number, and mailing address. The company may approach you directly for additional information for identity verification and purposes related to your request.
Your personal information may be shared with third parties that provide hosting, communication, technical support, analytics, security services, and other services in connection with operating the App and Website.
Occasionally, we may disclose your information to a third party for legal reasons or in connection with safety and security concerns, such as:
We may share your information in connection with a substantial corporate transaction, which may include the sale of one or more of our businesses, a merger, the creation of a separate business to provide certain of our products and services, or in the unlikely event of bankruptcy.
If we engage in any of these types of transactions, your information will be subject to our privacy policy in effect prior to the time of the transfer of that information.
We will notify you if we transfer ownership or control of your personally identifiable information to an unaffiliated third party in connection with a substantial corporate transaction.
We may share de-identified individual-level or aggregated information with manufacturers, regulators, researchers and other third parties for research purposes to help improve the marketplace. Information shared in this way will not identify you individually without your prior written consent.
Certain third parties such as ad networks that serve CR ads, analytics companies and social networking platforms may collect information through cookies, web beacons, mobile ad identifiers, and other technologies that track your online activities across CR and other online services, including information about your interactions with our ads, our content and the websites you visit.
The information they collect about you may be aggregated with data these companies collect about you across different websites, online services (including social media services), and your associated devices. These third parties use your information for their business purposes and in accordance with their own privacy policies.
We keep your information long enough to provide you with services and meet our own legal obligations. This generally means that your personal information and request history are retained while your account is active and for five years afterwards, so we can verify requests made through the App.
Other information may be subject to different retention periods. For example, analytics information about your usage of the App and the Site is generally retained for approximately 24 months.
We are committed to protecting your information. We have put in place physical, technical and administrative procedures designed to help safeguard and prevent unauthorized access and misuse of your information. When we transmit information over the Internet, we work to protect the information through the use of data encryption methods.
Security works best when everyone participates. To help keep your information safe, we require a strong password to create an account and recommend you do not share your password with anyone. Please notify us of any unauthorized use of your password or account or any other breach of security.
While we endeavor to protect the security and integrity of information we collect and transmit via Permission Slip, due to the inherent nature of the Internet as an open global communications vehicle, we cannot guarantee that any information, during transmission through the Internet or while stored on our systems or otherwise in our care, will be absolutely safe from intrusion by others, such as hackers.
Visit the Consumer Reports Protection of Information page to learn more about how the information you provide is secured.
If you choose to close your Permission Slip account:
Because Permission Slip makes data requests to other companies on your behalf, we need to retain information about your use of the App even if you close your account. Inactive information will be deleted after five years unless specific circumstances (such as an ongoing dispute with another company) require us to retain it longer.
When you sign up for a Permission Slip account, you agree to receive email communications from us. Some of these emails are required. By using Permission Slip, you agree to receive email communications about important topics such as:
For all other communications, including marketing and product updates, you can opt out of communication via an unsubscribe link found in the footer of all emails.
Please allow up to 10 business days for changes to your email preferences to take effect. During that time, you may continue to receive email communications from us that were already in process.
Please note that opting out of receiving email or other communications will not affect your receipt of service-related communications such as those relating to your account, order confirmations, renewal/expiration notices, and payment card notifications (if applicable).
The California Consumer Privacy Act (“CPPA”), as amended by the California Privacy Rights Act (“CPRA”), gives California residents certain rights to learn about and control how for-profit businesses that meet certain criteria use their data. Specifically, the CCPA requires that companies covered by the law make certain disclosures regarding the personal information they collect, sell and disclose with respect to California residents. For purposes of this section, we refer to companies that are covered by the CCPA as “California Covered Companies”. As a not-for-profit organization, CR is not covered by the CCPA, but we make the following disclosures consistent with our role as marketplace leader regardless of your state of residence.
We collect some or all the following categories of information and disclose them for a business purpose:
We do not knowingly collect any sensitive personal information, as defined in the CCPA, through Permission Slip.
We collect, use, and disclose this information as described in this Privacy Policy, including to audit Permission Slip, detect security incidents and prevent fraud, debug and repair errors, maintain your account, provide customer service, process and fulfill orders, verify customer information, conduct research, and undertake activities to analyze, market and improve our products and services. These uses constitute business purposes under the CCPA.
The CCPA also gives California residents certain rights in relation to the use and disclosure of their personal information by California Covered Companies. These rights include the following:
You may use a different authorized agent to make a request on your behalf. If you choose to do so, we may request confirmation from you or the agent to validate the agent relationship.
California residents have the right to request information on how their personal information is disclosed for direct marketing purposes. However, CR does not disclose any Permission Slip information for direct marketing, so we do not provide a system for opting out of such requests in connection with this service.
Permission Slip is intended for general audiences and is not directed to children. If you are the parent or guardian of a child under age 13 and believe your child has provided us with his or her personal information in connection with Permission Slip, please contact us at permissionslip@cr.consumer.org. You must be 18 or older to participate in certain activities, such as contests and sweepstakes.
We may update this Privacy Policy from time to time. The latest version is always available in the App and the Site, with the date of the new “effective date” at the top. If we make significant changes to this Policy, we may also notify you about changes by additional means, such as by sending an email to the email address we have on file for you, providing an alert in the App and the Site or by other means consistent with applicable law. Continuing to use the App and the Site after the new effective date constitutes your agreement to the revised terms, provided that we will obtain your affirmative consent where legally required and otherwise subject to applicable law.
If you have questions about this Privacy Policy, you can reach us via email permissionslip@cr.consumer.org or by calling +1(914) 378-2159.
If you feel that we have not followed our Privacy Policy, please let us know by emailing us at permissionslip@cr.consumer.org and we will do our best to address your concerns. You may also contact:
Your state or local consumer protection office
The Better Business Bureau (BBB), or
The Federal Trade Commission (FTC) by phone at (202) 326-2222 or online at http://www.ftc.gov.
Any disputes regarding this Privacy Policy are subject to our User Agreement.
