Under California’s right to know, you can ask any covered business to tell you what personal information it has collected about you, where that information came from, the business or commercial purpose for collecting it, the categories of third parties it was shared with, and the specific pieces of data the business holds on you. The right lives inside the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and businesses must respond within 45 days at no charge.
What You Can Ask a Business to Disclose
A right-to-know request can reach five things about your personal information:
- The categories of personal information the business has collected about you
- The categories of sources it collected that information from
- The business or commercial purpose for collecting or selling it
- The categories of third parties the business shared it with
- The specific pieces of personal information the business holds on you
This applies whether the business collected the data directly, bought it, or received it from a service provider or affiliate.1California Legislative Information. California Civil Code 1798.110
When you ask for the specific pieces of information, the business has to deliver that data in a structured, commonly used, machine-readable format so you can actually review it or move it somewhere else.
Separate from any request you file, businesses are required to tell you at or before the point of collection what categories of information they plan to collect, what they plan to do with it, and how long they intend to keep it. That disclosure should already be sitting in the business’s privacy notice before you hand over any data.2California Legislative Information. California Civil Code 1798.100
One limit to keep in mind: a right-to-know request covers the 12-month period before you submit it. You cannot pull records going back indefinitely.
What Counts as Personal Information
The CCPA defines personal information broadly. It covers anything that identifies, relates to, or could reasonably be linked to a specific consumer or household. Names, email addresses, Social Security numbers, and phone numbers are the obvious examples. The definition also reaches IP addresses, browsing history, purchase records, geolocation data, and profiles built from your online behavior.3California Privacy Protection Agency. What Is Personal Information
Information collected quietly through cookies, web beacons, and other tracking technologies counts too, even when you never typed anything into a form. A business that logs your browser type, the site you came from, or your IP address in the background is collecting personal information under the law. Data that looks anonymous standing alone can also qualify when it could be combined with other information to identify a particular person.
Sensitive Personal Information
Some categories get extra protection and are grouped as “sensitive personal information”:
- Government identifiers like Social Security, passport, and driver’s license numbers
- Financial account, debit card, or credit card numbers paired with an access code or password
- Precise geolocation
- Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership
- Contents of your mail, email, and text messages unless you sent them to the business
- Biometric and genetic information, including neural data
- Information about your health, sex life, or sexual orientation
You can direct a business to limit its use of sensitive personal information to only what is necessary to provide the goods or services you asked for.4California Legislative Information. California Code, Civil Code CIV 1798.121 A business that wants to use that data for anything beyond those purposes has to notify you and give you a way to restrict it.5State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Which Businesses Have to Answer You
The right to know applies to for-profit entities doing business in California that meet at least one of three thresholds:6California Legislative Information. California Civil Code 1798.140
- Annual gross revenues above $26,625,000 (adjusted periodically from the original $25 million baseline)7California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
- Buying, selling, or sharing the personal information of 100,000 or more consumers or households per year
- Deriving 50 percent or more of annual revenue from selling or sharing personal information
Subsidiaries can also be pulled in when a qualifying business controls them and they share common branding, so a company cannot route data through an affiliate to escape the rules.
Nonprofit organizations and government agencies fall outside the definition of “business” and are not covered. Information already regulated under HIPAA, the California Confidentiality of Medical Information Act, the Gramm-Leach-Bliley Act, or the California Financial Information Privacy Act is also exempt, though the business handling it may still be covered for its other data.8California Legislative Information. California Civil Code 1798.145
One point that catches people off guard: the temporary carve-out for employee data and business-to-business contact information expired on January 1, 2023, and was not renewed. If you are a California employee or a business contact, you can send a right-to-know request about information collected in those contexts, and the employer or vendor has to respond on the same terms as a customer request.
How to Submit a Request
Covered businesses have to offer at least two ways to submit a consumer request. That usually includes a toll-free phone number, and for businesses with a website, an online request form. Check the business’s privacy policy or the footer of its site for the links.
Before releasing information, the business has to verify your identity. In practice, that means matching details you supply against what the business already has on file. For a request to see the specific pieces of personal information, verification tends to be stricter than for a request to see categories, because the data being released is more sensitive.
The response clock runs 45 days from receipt of your request. If the business needs more time, it can extend by another 45 days, but it must notify you of the extension inside the original window.9California Legislative Information. California Code, Civil Code CIV 1798.130 You cannot be charged a fee for filing or processing the request.
And a business cannot retaliate against you for using the right. Charging you more, giving you lower-quality service, or refusing service because you asked what data a business holds on you is prohibited. The one exception is a financial incentive program, which requires your opt-in consent and has to be reasonably related to the value of the data.
If a Business Denies or Ignores Your Request
A business that denies your request has to tell you why. Denials are allowed only on grounds the statute recognizes, which for the related right to delete include things like completing a transaction you started, detecting security incidents, complying with a legal obligation, or exercising free speech rights. A business cannot simply decline without a reason tied to the law.
If you believe a business is ignoring or mishandling your request, you can file a complaint with the California Attorney General’s office or with the California Privacy Protection Agency. Those two bodies share enforcement authority: the Attorney General can bring civil actions, and the CPPA conducts audits, issues directives, and handles rulemaking.10California Legislative Information. California Civil Code 1798.185
The right to know itself does not carry a private right of action. You cannot sue a business directly for failing to respond to your request. The CCPA’s individual lawsuit provision is limited to data breaches involving unencrypted personal information caused by a business’s failure to maintain reasonable security measures, with statutory damages between $100 and $750 per consumer per incident.11California Legislative Information. California Code, Civil Code CIV 1798.150
How the Right to Know Fits with Your Other Rights
Knowing what a business holds is often the first step before deciding whether to act on the data. The CCPA gives you several other rights you can use once you see what you have:
- Request deletion of personal information the business collected from you. Once verified, the business must delete the data from its records and direct its service providers, contractors, and anyone it sold or shared the data with to do the same.12California Legislative Information. California Civil Code 1798.105
- Request correction of inaccurate information. The business has to use commercially reasonable efforts to fix it.13California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.106
- Opt out of the sale or sharing of your personal information at any time. Covered businesses that sell or share data have to post a clear “Do Not Sell or Share My Personal Information” link. Businesses also have to honor Global Privacy Control signals sent automatically by your browser.14California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.120
- Limit the use of sensitive personal information to what is necessary to provide what you asked for.
Children’s data gets stronger treatment on the sale and sharing side. A business that knows a consumer is under 16 cannot sell or share that person’s information without an affirmative opt-in from the consumer, if 13 to 15, or from a parent or guardian, if under 13.
Each of these rights uses the same request-and-verify mechanism as the right to know, runs on the same 45-day clock, and comes with the same no-fee and no-retaliation rules.