The Six Privacy Rights Every Californian Has (And How to Use Them)

California has the most comprehensive consumer privacy law in the United States. Most people who live here have never used it. The rights it creates are real, the deadlines it imposes on businesses are enforceable, and exercising those rights is usually a matter of sending a request.

The Law

The California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 and following, was substantially expanded by the California Privacy Rights Act, a ballot measure approved in 2020 and effective in 2023. Together they are usually referred to as the CCPA. The California Privacy Protection Agency, an independent state agency, issues regulations and enforces the law alongside the Attorney General.

Which Businesses Must Comply

The CCPA applies to for-profit businesses that do business in California, collect consumers' personal information, and meet at least one of three thresholds: annual gross revenue above a figure set at $25 million and adjusted for inflation; annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving half or more of their annual revenue from selling or sharing personal information. See Cal. Civ. Code § 1798.140(d). Large retailers, tech platforms, data brokers, and many mid-size online businesses fall within it.

Your Rights

1. The right to know

Under Cal. Civ. Code §§ 1798.100, 1798.110, and 1798.115, you can require a business to tell you what categories and specific pieces of personal information it has collected about you, where it got them, why it collected them, and which third parties it shared or sold them to. Businesses must also disclose this information in their privacy policies at or before the point of collection.

2. The right to delete

Under § 1798.105, you can require a business to delete personal information it collected from you. The business must also direct its service providers and, in many cases, third parties it sold or shared the data with to delete it. There are exceptions — for example, information needed to complete a transaction you requested, to comply with a legal obligation, or for certain security purposes — but the default is deletion.

3. The right to correct

Added by the CPRA, § 1798.106 gives you the right to require a business to correct inaccurate personal information it maintains about you, taking into account the nature of the information and the purpose for which it is processed.

4. The right to opt out of sale or sharing

Under § 1798.120, you can direct a business not to sell your personal information or share it for cross-context behavioral advertising. Businesses that sell or share data must provide a clear "Do Not Sell or Share My Personal Information" link on their homepage. They must also honor opt-out preference signals sent by your browser, such as the Global Privacy Control, which lets you opt out of every participating site at once rather than one at a time. See § 1798.135.

5. The right to limit use of sensitive personal information

The CPRA created a category of "sensitive personal information" — Social Security and other government ID numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, contents of private communications, genetic data, biometric data, health information, and information about sex life or sexual orientation. Under § 1798.121, you can direct a business to limit its use of this information to what is necessary to provide the goods or services you requested.

6. The right to non-discrimination

Under § 1798.125, a business may not discriminate against you for exercising any of these rights. It may not deny you goods or services, charge you a different price, or provide a different level of quality because you made a request. The law permits certain financial incentive programs, such as loyalty programs, but only if they are reasonably related to the value of your data and you affirmatively opt in.

How to Exercise Your Rights

Businesses must provide at least two methods for submitting requests, typically a web form and a toll-free number, and the request process must be reasonably accessible. The business may need to verify your identity before acting on a request to know, delete, or correct, but it may not require you to create an account to do so.

Under § 1798.130, the business must respond to a request to know, delete, or correct within 45 days of receipt, extendable once by an additional 45 days with notice to you. Opt-out requests must be honored promptly, and the CPPA's regulations set specific timeframes. You may make a request to know free of charge twice in any twelve-month period.

Enforcement and Remedies

It is important to be clear about what the CCPA does and does not let you do in court. The Act's private right of action, at § 1798.150, applies only to data breaches involving certain categories of personal information. For violations of the rights described above — a business that ignores your deletion request, fails to honor an opt-out, or discriminates against you — enforcement lies with the California Privacy Protection Agency and the Attorney General, who can impose administrative fines and civil penalties of up to $2,500 per violation and $7,500 per intentional violation or violation involving a minor.

That does not mean you are without recourse. You can file a complaint with the CPPA, which has brought enforcement actions against businesses for exactly these failures. And conduct that violates the CCPA may also support claims under other California laws, such as the Unfair Competition Law, depending on the circumstances.

The Bottom Line

The CCPA gives you real control over your personal information, but only if you use it. Look for the "Do Not Sell or Share" link on sites you use, turn on Global Privacy Control in your browser, and don't hesitate to submit a request to know or delete. Businesses that fail to respond within the statutory deadlines are breaking the law, and the state agency responsible for enforcing it accepts complaints.