How to Complete and Submit the CCPA Form: Agents, Response, and Denials

A CCPA request form is the tool California residents use to tell a business to show, delete, or correct the personal information it holds about them. There is no single statewide form. Each covered business builds its own, posts it on its website, and must also take requests over a toll-free phone number. Submitting is free, and the business has 45 days from receiving a verified request to respond with the data, the deletion, or the correction you asked for.¹

What You Can Ask For

Before you open the form, know which right you want to exercise. Most forms present these as checkboxes, and you can select more than one in the same submission.

Right to know. Ask the business to tell you what categories and specific pieces of personal information it has collected about you, where it got the information, why it collected it, and which third parties it shared it with.²
Right to delete. Direct the business to erase the personal information it collected from you. The business must also tell its service providers and contractors to do the same.²
Right to correct. If a business holds inaccurate information about you, ask it to fix the record. The business must use commercially reasonable efforts to do so.³
Right to opt out of sale or sharing. Tell the business to stop selling your personal information or sharing it for cross-context behavioral advertising.
Right to limit use of sensitive personal information. Restrict how the business uses sensitive data such as your Social Security number, precise geolocation, racial or ethnic origin, genetic or biometric data, health information, and financial account credentials.⁴

Picking the right box matters. The business will answer exactly what you asked, so a deletion request will not get you a copy of your data, and an opt-out will not erase anything already on file.

Where to Find the Form

Start at the business’s website footer. Companies that sell or share personal information must post a clear and conspicuous link titled “Do Not Sell or Share My Personal Information.” A separate link titled “Limit the Use of My Sensitive Personal Information” is also required, though a business may combine both into a single clearly labeled link.⁵ These usually sit next to “Privacy Policy” and “Terms of Service.”

For requests to know, delete, or correct, look for a link labeled something like “Privacy Requests,” “Your Privacy Choices,” or “CCPA Request.” It is usually inside the privacy policy or in a dedicated privacy portal near account settings. Some businesses put everything on one page. Others route you through a short intake form that asks which right you want to exercise. The business cannot force you to create a new account just to submit a request.¹

For opt-outs specifically, you may not need the form at all. Covered businesses must honor a Global Privacy Control signal from your browser as a valid request to stop selling or sharing your personal information.⁶ Firefox and Brave have GPC built in; extensions are available for Chrome and other browsers.

What the Form Will Ask For

The form needs enough information for the business to match you to its records. Expect to provide your full legal name and the email address tied to your account or purchases. Many forms also ask for a phone number, mailing address, or a recent order number so the business can locate the right profile.

You will also need to pick what you are asking for. Right-to-know forms often ask whether you want just the categories of information or the actual specific pieces of data. Correction forms ask you to describe what is wrong and what it should say.

The CCPA defines a consumer as a natural person who is a California resident.⁷ Some forms ask you to confirm California residency. A California mailing address is the most common way businesses verify this, though the statute does not prescribe a specific method.

After you submit, most businesses add a verification step: a confirmation email with a link, a code to your phone, or a prompt to log in. The business is entitled to take reasonable steps to confirm your identity before handing over or deleting data. Requests the business cannot verify get denied, so use the contact information already on your account rather than a brand-new address.

Sending Someone Else to Submit for You

You can use an authorized agent. The business can require your agent to show signed written permission from you, and it can separately ask you to verify your own identity or confirm you authorized the agent.⁸

If you have given the agent a power of attorney under California Probate Code Sections 4121 through 4130, the business cannot require the additional signed-permission step. The power of attorney alone is enough. The business is not allowed to demand power of attorney as a prerequisite for using an agent; signed written permission is always a valid alternative.⁸

Other Ways to Submit

Businesses must offer at least two submission methods. One of them has to be a toll-free telephone number. If the business has a website, it must also accept requests through that website.¹ Some companies also take requests by email or by letter to a legal department address.

Online submissions are usually straightforward: complete the fields, pick the type of request, submit, and save the confirmation screen or email. That confirmation typically includes a reference number. Keep it. It is your proof of the date the 45-day clock started and your identifier for follow-up.

Phone requests work the same way. Call the toll-free number, say which right you want to exercise, provide the identifying information requested, and ask for a confirmation number or email before you hang up.

What Happens After You Submit

The business has 45 days from receiving your verified request to deliver a substantive response. That means handing over the data, confirming deletion, or completing the correction. An acknowledgment that your request exists does not count.¹

If the request is unusually complex or the business is drowning in requests, it can extend the deadline once by an additional 45 days, up to 90 days total. It must notify you of the extension within the original 45-day window and explain why.¹

When the business responds to a right-to-know request, it must deliver the information in a format you can actually use, one that lets you transmit the data to another company without hindrance. For specific pieces of personal information, the business should provide a structured, machine-readable format when technically feasible.¹ In practice, that often means a downloadable CSV or JSON file rather than a PDF.

When a Business Can Say No

Deletion requests get denied more often than people expect because the statute lists several situations where the business is allowed to keep your data:

Finishing a transaction, service, warranty, or product recall you asked for.
Detecting or protecting against security incidents.
Debugging to identify and fix errors in its systems.
Preserving free-speech rights that deletion would interfere with.
Complying with another law that requires the business to keep the data.
Peer-reviewed scientific or historical research where deletion would seriously impair the work.
Internal uses consistent with why you provided the information in the first place.

⁹

Some categories of data sit outside the CCPA entirely. Personal health information governed by HIPAA, financial data covered by the Gramm-Leach-Bliley Act, and consumer-reporting data under the Fair Credit Reporting Act are carved out. If your data falls under one of those federal regimes, the business will point to the exemption in its denial.

Whenever a business denies your request, it must explain the basis in writing. For correction requests, the explanation has to include the specific factual grounds, and a denial based on impossibility or disproportionate effort has to detail why.

If the Business Ignores You or Denies You Without a Good Reason

If a properly verified request goes past 45 days with no response, or the denial does not hold up, file a complaint with the California Privacy Protection Agency. The CPPA handles enforcement and has authority to investigate and fine businesses for violations.

Complaints can be submitted online through the CPPA’s complaint portal or on paper by mail. Temporary absence from California does not affect your status as a resident for complaint purposes.¹⁰ A sworn complaint, attested to under penalty of perjury, carries more weight and authorizes the CPPA to contact the business on your behalf. Unsworn complaints are accepted but may get less follow-up, especially if you leave out contact information.

Administrative fines run up to $2,663 per violation and up to $7,988 per intentional violation or per violation involving the personal information of someone the business knows is under 16.¹¹ These amounts adjust each year for inflation.

1
California Legislative Information. California Civil Code CIV 1798.130 – Notice, Disclosure, Correction, and Deletion Requirements
2
California Legislative Information. California Civil Code 1798.100 – California Consumer Privacy Act of 2018
3
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Full Statute
4
privacy.ca.gov. What Is Personal Information?
5
California Legislative Information. California Civil Code CIV 1798.135 – Methods of Limiting Sale, Sharing, and Use of Personal Information
6
State of California Department of Justice. Global Privacy Control (GPC)
7
California Legislative Information. California Civil Code CIV 1798.140 – Definitions
8
Legal Information Institute. California Code of Regulations Title 11 Section 7063 – Authorized Agents
9
California Legislative Information. California Civil Code CIV 1798.105 – Consumers Right to Request Deletion
10
California Privacy Protection Agency. California Privacy Protection Agency Complaint Form
11
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties