CCPA Consumer Rights

CCPA grants California consumers a set of enforceable rights over their personal information, and businesses must implement processes to receive, verify, and fulfill requests within statutory timelines. Rights failures are the primary source of CCPA enforcement to date: the landmark early settlements were fundamentally about opt-out mechanisms that did not work, and CPPA enforcement sweeps have targeted broken request flows, ignored Global Privacy Control signals, and dark patterns that made opting out harder than opting in.

The operational test: if a California consumer clicked your opt-out link, sent a GPC signal, and filed know/delete/correct requests tomorrow, would every one flow through to completion — including at your vendors — inside the deadlines? This lesson walks through each right and the machinery behind it.

The Rights at a Glance

The Rights in Detail

Right to Know

Consumers can request disclosure of: the categories of PI collected, the categories of sources, the business or commercial purposes, the categories of third parties to whom PI was disclosed, sold, or shared, and the specific pieces of PI collected. The default lookback is the 12 months preceding the request, but CPRA lets consumers request information beyond 12 months for data collected on or after January 1, 2022, unless doing so is impossible or disproportionate. Deliver specific pieces securely, and never disclose ultra-sensitive items like SSNs or account passwords in a response, even to the consumer — describe them instead.

Right to Delete

Consumers can request deletion of PI you collected from them. On a verified request you must delete it, notify your service providers and contractors to delete it, and notify third parties to whom you sold or shared it (unless that proves impossible or involves disproportionate effort). The statutory exceptions are practical and worth knowing: you may retain PI needed to complete the transaction or requested services, detect and defend against security incidents and fraud, debug, exercise legal rights, comply with legal obligations, or for certain internal uses reasonably aligned with consumer expectations. Apply exceptions narrowly and per-category — "we keep everything for fraud" does not survive scrutiny. Tell the consumer what you deleted and what you retained under which exception.

Right to Opt Out of Sale/Sharing

Consumers can direct a business to stop selling their PI (disclosure for monetary or other valuable consideration) and stop sharing it (disclosure for cross-context behavioral advertising). Mechanics:

• Post a clear "Do Not Sell or Share My Personal Information" link on your homepage (or the alternative combined "Your Privacy Choices" link with the standard opt-out icon).
• Opt-out requests are not subject to verification — do not make people create accounts or prove identity to opt out.
• Effect the request within 15 business days and notify downstream recipients.
• After an opt-out, wait at least 12 months before asking the consumer to opt back in.
• Honor Global Privacy Control (GPC). The browser-level opt-out preference signal must be treated as a valid opt-out for that browser or device — automatically, without the consumer clicking anything. Failing to process GPC signals has been a centerpiece of enforcement actions and sweeps. If the consumer is known (logged in), apply the signal to their account, not just the device.
• Minors: you cannot sell or share PI of consumers under 16 without opt-in — from the teen themselves at ages 13–15, or from a parent or guardian under 13.

If you do not sell or share PI at all, you can skip the link — but say so explicitly in your privacy policy, and make sure your ad-tech reality matches the claim.

Right to Correct

Added by CPRA: consumers can request correction of inaccurate PI, and you must use commercially reasonable efforts to correct it, considering the nature of the information and purposes of processing. You may require documentation supporting the claimed inaccuracy where reasonable. Corrections must flow to service providers and contractors too.

Right to Limit Use of Sensitive Personal Information

Where a business uses or discloses sensitive PI for purposes beyond a permitted list (performing the requested services, security and integrity, short-term transient use, order fulfillment, quality assurance), consumers can limit its use to those permitted purposes via a "Limit the Use of My Sensitive Personal Information" link. Like opt-outs: no verification requirement, 15 business days to comply. Many businesses that use SPI only to deliver their service never trigger the link requirement — but that conclusion should be a documented analysis, not an assumption.

Right to Non-Discrimination and Non-Retaliation

You cannot deny goods or services, charge different prices, or degrade quality because someone exercised their rights — and CPRA extended this to prohibit retaliation against employees, applicants, and independent contractors. Financial incentive programs (loyalty discounts for data) remain lawful if the incentive is reasonably related to the value of the data, terms are disclosed, and participation is opt-in and revocable.

Request Handling: Timelines and Mechanics

• Intake: provide at least two methods, including a toll-free number for most businesses; an online-only business with direct consumer relationships may use just an email address (plus its web form). Requests arriving through imperfect channels should still be honored or redirected helpfully.
• Acknowledge within 10 business days, explaining your verification process and timeline.
• Fulfill within 45 calendar days, extendable by another 45 with notice and explanation to the consumer. Opt-outs and SPI limits run on the faster 15-business-day track.
• Free of charge, up to twice per 12-month period per consumer for know requests; manifestly unfounded or excessive requests can be refused or charged with documented justification.
• Verification applies to know, delete, and correct requests — not opt-outs. Match rigor to sensitivity: disclosure of specific pieces requires higher confidence (regulations describe a "reasonably high degree of certainty") than category-level disclosures. Use data you already hold to verify; do not collect new sensitive data solely for verification, and never require account creation for non-account holders.
• Authorized agents may submit requests on a consumer's behalf; you may require proof of the agent's authority (signed permission) and, for know/delete/correct, still verify the consumer directly.
• Denials must state the reason and, for know/delete/correct denials, inform the consumer they can appeal or complain; document every denial.
• Record-keeping: retain records of requests and responses for at least 24 months; businesses processing PI of 10 million or more consumers annually have additional metrics-publication duties (request counts, denials, median response times) in their privacy policies.

Common Failure Modes

The patterns behind CCPA enforcement and consumer complaints repeat:

• The cosmetic opt-out. The banner says "opted out" but the ad pixels keep firing and identifiers keep flowing to partners. Regulators test at the network level; so should you. A consent management platform that hides UI without suppressing tags is worse than nothing, because it documents the gap.
• The ignored signal. GPC arrives with every page load and nothing processes it. This was central to the first Attorney General settlement and to CPPA sweeps since. Detection is a few lines of code; the hard part is wiring it to tag suppression and known-user accounts.
• The verification wall on opt-outs. Requiring login, identity proof, or a multi-step confirmation gauntlet to opt out. Opt-outs are unverified by design; friction here reads as a dark pattern.
• The vendor dead end. Deletion fulfilled locally but never propagated to service providers, or opt-outs never forwarded to ad partners. The statute explicitly requires downstream propagation; build it into the workflow, not into someone's memory.
• The forgotten populations. Employees, applicants, and B2B contacts excluded from request workflows because the program was built before 2023. Their requests carry the same deadlines.
• The silent denial. Requests refused without stating reasons or logging the decision. Every denial needs documented reasoning — it is your only defense when the complaint lands.

Consumer Rights Readiness Checklist

• Data inventory maps every system holding California consumers' PI, including employee and B2B data
• Two-plus intake methods live (web form plus toll-free number or email, as applicable)
• "Do Not Sell or Share" and, if applicable, "Limit SPI" links posted (or documented rationale for omitting)
• GPC signals detected and processed automatically, tied to known users where logged in
• Opt-outs propagate to ad partners, and downstream notification is automated
• Verification procedures tiered by request type and sensitivity, documented
• Deletion workflow covers production, analytics, backups approach, and vendor propagation
• Deletion exceptions mapped per data category with retention justifications
• Correction workflow defined, including documentation standards
• Authorized agent and appeal/denial procedures documented
• 10-day acknowledgment and 45-day fulfillment tracked with escalation alerts
• Request log retained 24 months; metrics reporting assessed if at 10M+ consumer scale
• Staff who touch consumer channels trained to recognize and route requests

Frequently Asked Questions

Do we have to honor Global Privacy Control even though users never clicked anything on our site?

Yes. The CCPA regulations require businesses that sell or share PI to treat opt-out preference signals like GPC as valid opt-out requests, processed without a dark-pattern confirmation gauntlet. The very first CCPA enforcement settlement — against a major cosmetics retailer — turned partly on ignoring GPC. Test your implementation with a GPC-enabled browser against your actual tag behavior, not just your consent banner UI.

Can we make users log in to opt out?

No. Opt-out and limit requests cannot be conditioned on verification or account creation. For know/delete/correct requests, existing account holders can be asked to authenticate through the account, but you cannot force non-account holders to create one.

How do CCPA request rights interact with our employees and B2B contacts?

Since January 1, 2023, California employees, applicants, contractors, and business contacts hold the same rights as any consumer. Employee requests — often filed during disputes — reach into HR systems, email, and reviews, with the deletion exceptions (legal obligations, legal claims) doing heavy lifting. Build an HR-specific playbook; treating an employee DSAR like a customer DSAR fails quickly.

What if the same person files a deletion request every week?

You may treat manifestly unfounded or excessive requests differently — charging a reasonable fee or refusing, with documented justification. Repetition alone is the classic example, but use the power sparingly: the burden of demonstrating the request is unfounded or excessive is on you.

Do deletion requests reach our backups?

The accepted approach mirrors GDPR practice: delete from active systems within the deadline, and for archived or backup systems, you may delay the deletion until the backup is next accessed or restored — at which point the deletion must be applied. Document the approach and disclose it in responses.

We use only service providers and never "sell" data — do the opt-out rights still apply?

If every disclosure genuinely goes to contractually compliant service providers or contractors for permitted business purposes, there is no sale or sharing, and no opt-out link is required — but you must state in your privacy policy that you do not sell or share PI. The trap is ad-tech: analytics and advertising pixels usually fail the service-provider test, quietly converting you into a business that shares PI. Audit the tags before making the claim.

In the next lesson, we will cover business obligations under CCPA — the notices, contracts, and safeguards that sit behind these rights.

Automating DSAR intake, verification, and vendor propagation is where privacy tooling earns its keep. AuditXYZ helps you compare compliance automation platforms and find auditors for your privacy program.