Understanding Your CCPA Privacy Rights

The California Consumer Privacy Act (CCPA), along with its amendment the California Privacy Rights Act (CPRA), gives California residents some of the strongest privacy protections in the United States. Even if you do not live in California, understanding these rights matters — many companies extend CCPA-level protections to all users, and other states are adopting similar laws.

Who Is Protected by the CCPA?

The CCPA applies to you if you are a California resident. It does not matter where you are physically located at the time you exercise your rights — if California is your permanent home, the law protects you.

The law applies to businesses that meet any one of these criteria:

Annual gross revenue exceeding $25 million
Buying, selling, or sharing personal information of 100,000 or more consumers or households annually
Deriving 50% or more of annual revenue from selling or sharing personal information

This means the CCPA covers most major technology companies, data brokers, retailers, and people search services.

Your Core Rights Under the CCPA

The Right to Know

You have the right to know:

What categories of personal information a business collects about you
The specific pieces of personal information collected
The sources from which the information was collected
The business purpose for collecting the information
The categories of third parties with whom the information is shared or sold

You can submit a right to know request up to twice per year, and the business must respond within 45 days.

The Right to Delete

You can request that a business delete your personal information. Upon receiving a verified request, the business must:

Delete your personal information from its records
Direct its service providers to delete your information as well
Notify any third parties that purchased your data to delete it

There are exceptions. Businesses can retain your data if it is needed to:

Complete a transaction you initiated
Detect security incidents or fraud
Comply with a legal obligation
Exercise free speech rights
Conduct research in the public interest

The Right to Opt Out of Sale or Sharing

If a business sells or shares your personal information, you have the right to opt out. Businesses that sell personal data must provide a clear "Do Not Sell or Share My Personal Information" link on their website.

Once you opt out, the business cannot sell your information unless you later choose to opt back in. For consumers under 16, businesses must obtain affirmative opt-in consent before selling their data.

The Right to Correct

Added by the CPRA, you can request that a business correct inaccurate personal information it holds about you. The business must use commercially reasonable efforts to correct the data upon receiving a verified request.

The Right to Limit Use of Sensitive Information

The CPRA introduced a category of sensitive personal information that includes:

Social Security numbers and government IDs
Financial account information
Precise geolocation data
Racial or ethnic origin
Religious beliefs
Genetic and biometric data
Health information
Sexual orientation
Contents of mail, email, and text messages

You can direct a business to limit its use of this sensitive information to what is necessary to provide the services you requested.

The Right to Non-Discrimination

Businesses cannot punish you for exercising your CCPA rights. They cannot:

Deny you goods or services
Charge you different prices
Provide a different level of quality
Threaten you with any of the above

How to Exercise Your CCPA Rights

Submitting Requests

Businesses must provide at least two methods for submitting requests, which typically include:

An online form or web portal
A toll-free phone number
An email address dedicated to privacy requests

Verification

Before fulfilling your request, the business must verify your identity to prevent unauthorized access to your data. This may involve:

Matching information you provide against what the business has on file
Sending a verification email or code
Requesting identification documents for sensitive requests

Response Timeline

Businesses must acknowledge your request within 10 business days and provide a substantive response within 45 calendar days. They can extend this by an additional 45 days if necessary, with notice to you.

CCPA and People Search Sites

People search sites that collect and sell personal information about California residents are subject to the CCPA. This means you can:

Request to know exactly what data a people search site has about you
Request deletion of your personal information from their databases
Opt out of the sale of your information to third parties
Correct inaccurate information in your profile

Many people search sites have updated their policies to comply with the CCPA and offer opt-out mechanisms on their websites.

Enforcement and Penalties

The CCPA is enforced by the California Attorney General and the newly established California Privacy Protection Agency (CPPA):

Businesses that fail to comply can face fines of up to $2,500 per unintentional violation and $7,500 per intentional violation
Consumers have a private right of action for data breaches resulting from a business's failure to implement reasonable security, with statutory damages of $100 to $750 per consumer per incident

Beyond California: The Growing Privacy Landscape

Other states have enacted similar comprehensive privacy laws:

Virginia — Consumer Data Protection Act
Colorado — Colorado Privacy Act
Connecticut — Data Privacy Act
Utah — Consumer Privacy Act
Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee — all have enacted privacy laws with varying effective dates

A federal privacy law has been proposed but not yet enacted. In the meantime, the CCPA remains the gold standard for consumer privacy rights in the United States.