Your Privacy Rights Under the CCPA, and How to Use Them

California has the most comprehensive consumer privacy statute in the country, and most Californians have never used it. The rights it creates are real, businesses have deadlines to respond, and exercising them usually takes nothing more than a request through a web form.

The law is the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 and following, as expanded by the California Privacy Rights Act, a ballot measure voters approved in 2020. The combined law is usually just called the CCPA. It's enforced by the California Privacy Protection Agency and the Attorney General.

Which businesses it covers

The CCPA applies to for-profit businesses that do business in California, collect consumers' personal information, and meet at least one of three thresholds: annual gross revenue above a figure set at $25 million and adjusted for inflation; buying, selling, or sharing the personal information of 100,000 or more consumers or households a year; or earning at least half of annual revenue from selling or sharing personal information. See Cal. Civ. Code § 1798.140(d). Large retailers, platforms, data brokers, and many mid-sized online businesses qualify.

The rights

Knowing what they have

Under §§ 1798.100, 1798.110, and 1798.115, you can require a business to disclose the categories and specific pieces of personal information it has collected about you, where it got them, why it collected them, and which third parties it sold or shared them with.

Deleting it

Section 1798.105 lets you require a business to delete personal information it collected from you. The business also has to notify its service providers and contractors, and in many cases third parties it sold or shared the data with, to delete it too. There are exceptions, for example where the data is needed to complete a transaction you asked for or to comply with a legal obligation, but deletion is the default.

Correcting it

The CPRA added § 1798.106, which gives you the right to have inaccurate personal information corrected.

Stopping its sale or sharing

Under § 1798.120, you can tell a business not to sell your personal information or share it for cross-context behavioral advertising. Businesses that do either must offer an easy way to opt out, typically a "Do Not Sell or Share My Personal Information" link. They also have to honor opt-out preference signals sent by your browser, such as Global Privacy Control, which opts you out of every participating site at once. See § 1798.135.

Limiting sensitive information

The CPRA created a category of "sensitive personal information," which includes Social Security and other government ID numbers, account login credentials, precise geolocation, racial or ethnic origin, religious beliefs, the contents of private communications, genetic and biometric data, health information, and information about sex life or sexual orientation. Section 1798.121 lets you direct a business to limit its use of that information to what's necessary to provide the goods or services you requested.

Not being penalized for asking

Under § 1798.125, a business can't deny you service, charge you a different price, or give you worse service because you exercised these rights. Loyalty programs and similar incentives are allowed only if they're reasonably related to the value of your data and you opt in.

Making a request

Businesses must give you at least two ways to submit requests, often a web form and a toll-free number. They can verify your identity before acting on requests to know, delete, or correct, but they can't make you create an account to submit one.

Under § 1798.130, a business must respond to requests to know, delete, or correct within 45 days, and it can extend that once by another 45 days if it tells you. A business isn't required to respond to more than two requests to know from you in a twelve-month period. Opt-out requests have to be honored promptly.

Enforcement

It's worth being precise about what you can do in court. The CCPA's private right of action, § 1798.150, applies only to certain data breaches. If a business ignores your deletion request, keeps selling your data after you opt out, or penalizes you for exercising your rights, enforcement generally falls to the California Privacy Protection Agency and the Attorney General, who can impose fines of up to $2,500 per violation and $7,500 per intentional violation or violation involving a minor, subject to inflation adjustments.

You aren't without options, though. You can file a complaint with the agency, which has brought enforcement actions over exactly these failures. Depending on the facts, the same conduct may also support claims under other California laws.