# Consumers exercising rights receive equal service and pricing

- **Pattern:** `ab-000623` (`ccpa-readiness.consumer-rights.non-discrimination`)
- **Severity:** low
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000623
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000623)

## Why it matters

CCPA § 1798.125 prohibits penalizing consumers for exercising their privacy rights — denying them features, charging higher prices, or degrading service quality because they opted out of data sharing. Feature flags keyed on a `ccpa_opt_out` field are the most common code-level violation: they were probably added to "personalize" something, but any degradation in service for opted-out users is discriminatory under the statute. Financial incentive programs — loyalty points or discounts in exchange for data — are permitted under § 1798.125(b) but require explicit disclosure of the data's estimated monetary value and a separate affirmative opt-in, which virtually no AI-built implementation includes.

## Severity rationale

Low because discrimination violations require proof of differential treatment tied to rights exercise, which demands a formal investigation — but code-level feature flags keyed on opt-out status are easily spotted and constitute a per-consumer violation.

## Remediation

Audit every feature flag, pricing condition, and tier check for references to opt-out or privacy preference fields. Remove any coupling between service level and CCPA opt-out status.

```ts
// WRONG — gates premium features on data-sharing consent
function canAccessPremiumFeatures(user: User): boolean {
  return user.plan === 'premium' && !user.ccpaOptOut // violates § 1798.125
}

// CORRECT — subscription status only
function canAccessPremiumFeatures(user: User): boolean {
  return user.plan === 'premium'
}
```

If you operate a loyalty or referral program that offers benefits in exchange for data sharing, add a Financial Incentive Programs section to your privacy policy disclosing the estimated monetary value of consumer data and implement an explicit opt-in checkbox — not enrollment on signup. See `src/app/privacy/page.tsx`.

## Detection

- **ID:** `non-discrimination`
- **Severity:** `low`
- **What to look for:** Inspect the application's business logic for any code that treats consumers differently based on whether they have exercised a CCPA right. Common violations: pricing tiers or feature access gated on "opted in to data sharing," lower-quality service for opted-out users, account restrictions applied after a deletion request is submitted. Also check whether financial incentive programs (loyalty programs, discounts in exchange for data) are disclosed with the value of the consumer's data — these are permitted under CCPA but require specific disclosures and opt-in consent. Check the privacy policy and any terms for language that penalizes consumers for exercising privacy rights. Count all instances found and enumerate each.
- **Pass criteria:** No code or policy penalizes consumers for exercising CCPA rights. If a financial incentive program exists (e.g., discount in exchange for allowing data sharing), it is disclosed with the reasonable monetary value of the consumer's data and requires explicit opt-in consent. At least 1 implementation must be confirmed.
- **Fail criteria:** Features or pricing change based on opt-out status in ways that discriminate against the consumer for exercising their rights. Financial incentive programs exist without the required disclosure of data value and opt-in.
- **Skip (N/A) when:** Application has no pricing tiers, no financial incentive programs, and no feature gating based on data sharing preferences.
- **Detail on fail:** Example: `"Premium features locked behind 'allow data sharing' toggle — this constitutes discriminatory treatment for exercising opt-out rights."` or `"Loyalty rewards program offers discounts but does not disclose the monetary value of consumer data or require separate opt-in."`.
- **Remediation:** Review all feature flags, pricing conditions, and reward program disclosures:

  ```ts
  // PROBLEMATIC — do not gate features on data sharing opt-out
  // function canAccessPremiumFeatures(user: User): boolean {
  //   return user.plan === 'premium' && !user.ccpaOptOut  // WRONG
  // }

  // CORRECT — CCPA opt-out status must not affect service level
  function canAccessPremiumFeatures(user: User): boolean {
    return user.plan === 'premium' // Only gate on subscription, not privacy choices
  }

  // Financial incentive program disclosure (if applicable):
  // Privacy policy must include:
  // "We offer [discount/reward] to consumers who allow us to use their personal information
  // for [purpose]. The estimated value of your personal information to our business is
  // approximately $[X] per year, calculated by [methodology]. You may opt into this program
  // at [URL]. This program does not affect the quality of service you receive if you choose
  // not to participate."
  ```

---

## External references

- ccpa §1798.125
- ccpa §1798.125(b)
- gdpr Art. 7(4)

Taxons: privacy-consent, regulatory-conformance

HTML version: https://auditbuffet.com/patterns/ab-000623