The California Consumer Privacy Act, strengthened by the California Privacy Rights Act that voters approved in 2020, gives every California resident the right to find out what personal information a business holds about them, demand that it be deleted or corrected, stop its sale, and limit how sensitive data is used. The rules apply to for-profit companies that do business in California and clear at least one of three size tests, and businesses have 45 days to respond to most requests.
Your Rights as a California Resident
You hold five enforceable rights over your personal information, and a covered business cannot charge you for exercising any of them.
- Right to know. You can ask what categories of personal information a business has collected about you, where it came from, why the business collected it, and the specific pieces of data on file.1California Legislative Information. California Code CIV 1798.100 – General Duties of a Business that Collects Personal Information
- Right to delete. You can require a business to erase the personal information it holds on you, and the business must tell its service providers, contractors, and third parties it shared the data with to delete it as well.2California Legislative Information. California Code CIV 1798.105 – Consumers Right to Deletion
- Right to correct. If the business has something wrong about you, you can demand it be fixed, and the business must use commercially reasonable efforts to do so.3California Legislative Information. California Code CIV 1798.106 – Consumers Right to Correction
- Right to opt out of sale or sharing. You can tell a business to stop selling or sharing your personal information with third parties, and it must honor that request immediately.4California Legislative Information. California Code, Civil Code CIV 1798.120 – Right to Opt Out of Sale or Sharing of Personal Information
- Right to limit use of sensitive information. You can restrict a business to using sensitive data only for what is necessary to provide the service you asked for.
A business is not allowed to punish you for using any of these rights. It cannot deny you service, raise your price, lower the quality of what you get, or hint that opting out will cost you.5California Legislative Information. California Code CIV 1798.125 – Consumers Right of No Retaliation Following Opt Out or Exercise of Other Rights Loyalty programs and other data-for-discount offers are allowed, but only if the price difference is reasonably related to the value of your data, the terms are clearly disclosed, and you opt in. You can revoke that consent anytime, and if you decline, the business has to wait at least 12 months before asking again.
The law also forbids businesses from making the request process harder than the signup process was. Deleting your data should be about as simple as handing it over in the first place.
If You Are Under 16
For minors, the default flips. A business must get affirmative opt-in consent before selling or sharing the personal information of anyone under 16. Teens between 13 and 15 give that consent themselves; for children under 13, a parent or guardian must authorize it. Violations involving minors’ data trigger the higher $7,500 penalty rather than the standard $2,500.6California Legislative Information. California Code CIV 1798.155 – Administrative Enforcement
If You Are a California Employee
The temporary exemption for employee and business-to-business contact data expired on January 1, 2023. If you are a California employee, job applicant, or professional contact of a covered business, you now hold the same privacy rights as any customer, including the right to know what your employer collects, the right to request deletion, and the right to opt out of data sales.
Extra Protections for Sensitive Information
The law treats some data as sensitive and gives you an additional right to limit how it is used. When you invoke that right, a business can only use the data for core operational purposes such as completing a transaction you asked for or detecting security threats. The sensitive categories include:7California Privacy Protection Agency. What is Personal Information
- Social Security numbers, passport numbers, driver’s license numbers, and state ID cards
- Account login credentials combined with access codes or passwords
- Precise geolocation data
- Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership
- Contents of your emails, texts, and other private messages not directed to the business
- Biometric and genetic data, facial recognition templates, and neural data
- Health information and information about your sex life or sexual orientation
Ordinary shopping habits a retailer tracks are personal information. A fitness app logging your health conditions, or a navigation service recording your location minute by minute, is sensitive data, and you can order it off-limits beyond what the service strictly needs.
How to Make a Request
Start on the company’s website. Every covered business must publish a privacy policy explaining how to submit requests and must offer at least two ways to do it, usually a web form, a toll-free number, or an email address. Businesses that process sensitive data or sell data must also post links on their homepage labeled “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information,” or a single combined link.8California Legislative Information. California Code CIV 1798.135 – Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information
You’ll need to give the business enough information to confirm your identity, typically your full name and the email or physical address tied to your account. Logging in may be enough on its own. For requests to see specific pieces of personal data, verification is stricter: expect to match multiple data points the company already has, and the business may ask for a signed declaration under penalty of perjury. Deletion requests use similar but sometimes slightly lighter checks depending on how sensitive the data is.
You can designate someone else, an authorized agent, to make a request for you. The business can ask the agent for signed permission from you and can ask you to confirm you authorized the agent, but it cannot demand a power of attorney as the only acceptable proof.9Legal Information Institute. California Code of Regulations Title 11 Section 7063 – Authorized Agents
What to Expect After You Submit
A business has 45 calendar days to respond, counted from the day your request arrives, regardless of how long verification takes. For unusually complex requests, it can take another 45 days, up to 90 days total, but it must notify you of the extension and the reason within the first 45-day window.10Legal Information Institute. California Code of Regulations Title 11 Section 7021 – Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know
When the Law Doesn’t Cover Your Data
Several categories sit outside the law to avoid overlap with federal rules. Protected health information handled under HIPAA is exempt, as is personal financial data regulated by the Gramm-Leach-Bliley Act and credit information covered by the Fair Credit Reporting Act. Clinical trial information collected under federal human-subjects protections is also exempt. Publicly available information, meaning data lawfully accessible through government records or that you made broadly public yourself, falls outside the law’s definition of personal information entirely.11California Legislative Information. California Code CIV 1798.145 – Exemptions
These are exemptions for specific data, not for whole companies. A bank’s GLBA-regulated financial data is exempt, but the same bank’s rewards app may collect information that falls outside GLBA and remains subject to the California law. And the GLBA and FCRA carve-outs do not block the private right of action for data breaches: if poor security exposes the data, the company can still be sued.
Which Businesses Have to Comply
The law covers for-profit businesses that collect personal information from California residents and meet at least one of three thresholds:12California Legislative Information. California Code CIV 1798.140 – Definitions
- Annual gross revenue over $26.625 million in the prior calendar year. That figure, adjusted for inflation from the original $25 million, took effect January 1, 2025.13California Privacy Protection Agency. Frequently Asked Questions
- Buying, selling, or sharing the personal information of 100,000 or more consumers or households each year.
- Earning 50 percent or more of annual revenue from selling or sharing personal information.
A company does not have to be based in California. If it does business in the state and meets any one test, it is covered. Affiliates sharing common branding with a qualifying business and receiving personal information from it are also pulled in when one controls or is controlled by the other.
If a Business Ignores You or Suffers a Breach
Two enforcement channels run in parallel. The California Privacy Protection Agency, created by the 2020 ballot measure, handles administrative enforcement through audits, investigations, and formal proceedings.6California Legislative Information. California Code CIV 1798.155 – Administrative Enforcement The California Attorney General has independent authority to bring its own actions, including a $2.75 million settlement with Disney over allegations the company failed to honor consumer requests.14State of California – Department of Justice – Office of the Attorney General. Privacy Enforcement Actions
Administrative fines run up to $2,500 per violation for unintentional infractions and $7,500 for intentional violations or any violation involving a minor’s data. The counts are per violation, so a single compliance failure affecting many consumers can generate very large liability. Under the original CCPA, businesses got an automatic 30-day cure period before any penalty. The 2020 amendments removed that guarantee: the agency may offer a cure window, but it is not required to.
Suing Over a Data Breach
You can sue a business directly in one specific situation: a data breach exposes your nonencrypted and nonredacted personal information because the business failed to maintain reasonable security. Statutory damages run from $100 to $750 per consumer per incident, or your actual damages, whichever is greater.15California Legislative Information. California Code, Civil Code CIV 1798.150 – Personal Information Security Breaches
Before filing for statutory damages, you must give the business 30 days’ written notice identifying which provisions it violated. If it actually cures the violation within that window and gives you a written statement saying so and promising no further violations, you cannot proceed on statutory damages. Simply tightening security after the fact does not count as curing the breach. If the business later breaks its written promise, you can sue for statutory damages on the original breach plus any new violations.16State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) No pre-suit notice is required if you only seek actual financial losses.