Every app, store loyalty card and website collects information about the people who use it, and most of that collection happens out of sight. California was the first state to give its residents a broad set of rights over that data. The California Consumer Privacy Act, which took effect in 2020, and the California Privacy Rights Act, approved by voters in 2020 and in effect from 2023, are often discussed together and abbreviated as the CCPA and CPRA. The result is a framework that lets residents ask businesses what they know, correct mistakes, delete information and limit how it is shared. This article explains the rights in general terms. It is not legal advice.
What do the laws cover?
The CCPA, as amended by the CPRA, regulates how certain for-profit businesses handle the personal information of California residents. Personal information is defined broadly. It includes obvious items such as names, addresses, email addresses and Social Security numbers, and also less obvious ones: online identifiers, browsing and search history, purchase histories, geolocation, biometric data, inferences drawn about a person’s preferences and more. The law applies to information that businesses collect online and offline.
Which businesses must comply?
The law does not apply to every business. It covers for-profit businesses that do business in California and meet at least one threshold. The thresholds are annual gross revenue above $25 million, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information. The revenue figure is adjusted for inflation over time. Because a business needs to meet only one threshold, a small online company that handles data on many people can be covered, and a modest local business that falls below all three is generally not.
Some information and entities are exempt or governed by other laws, such as certain health data, data covered by federal financial privacy rules and nonprofits. That is why a small shop or a family business may not have to follow the same rules as a large tech company, as discussed in how to register a business in California.
What rights do residents have?
The core rights are:
- The right to know. A resident can ask a covered business what personal information it has collected, where it came from, why it is collected, and to whom it is disclosed or sold.
- The right to delete. A resident can ask the business to delete personal information it has collected, with exceptions, such as when the business needs the data to complete a transaction, comply with the law or detect fraud.
- The right to correct. Added by the CPRA, this lets a resident ask a business to fix inaccurate information.
- The right to opt out of sale or sharing. Residents can tell a business not to sell their personal information or share it for cross-context behavioral advertising, which means using data from one site to target ads on others. Businesses that do so must provide a clear link, often worded “Do Not Sell or Share My Personal Information,” and must honor opt-out preference signals sent by a browser setting such as the Global Privacy Control.
- The right to limit the use of sensitive personal information. The CPRA created a category of sensitive data, including precise location, financial account details, health information, racial or ethnic origin and government identifiers, and lets residents restrict its use to what is necessary to provide the service.
- The right not to be retaliated against. A business may not deny service or charge different prices simply because a resident exercised a privacy right, though it may offer financial incentives programs under certain rules.
How do you make a request?
A resident submits a request through the method the business provides, usually a web form, an email address or a toll-free number. Businesses must provide at least two ways to submit, with exceptions for those that operate only online. The business must verify the identity of the person making a request to know, delete or correct, which protects against someone fraudulently asking for another person’s data, and it may ask for information to confirm identity.
Businesses generally must respond within 45 days, and they can extend by another 45 days if they give notice. A response to a request to know should describe the categories and, for some requests, the specific pieces of information collected. Residents can use authorized agents to make requests on their behalf. Opt-out requests do not require identity verification, and businesses must act on them promptly.
What about data brokers?
Data brokers, which collect and sell personal information about people with whom they have no direct relationship, are covered by a separate California law known as the Delete Act. It directed the state’s privacy agency to build a centralized system that lets a resident submit a single request to have data brokers delete their personal information. The state’s privacy agency has described the tool, called the Delete Request and Opt-out Platform, and the schedule for brokers to begin processing requests. Because the program is new and details are updated, residents should read the agency’s site for current instructions.
Who enforces the laws?
Enforcement is shared by the California Attorney General and the California Privacy Protection Agency, an agency created by the CPRA to implement and enforce the law. Violations can bring administrative fines and civil penalties per violation. Residents have a limited private right of action, but only for certain data breaches caused by a business’s failure to maintain reasonable security. There is no general right to sue for violations of the rights above. Residents who believe a business has ignored a request can file a complaint with the agency or the Attorney General.
What are the limits?
The laws are not a complete answer to privacy concerns. Many businesses are not covered, many exceptions exist, and the rights depend on a resident knowing to use them. Opt-out rights apply to sale and sharing, not to all uses of data within a company. Government agencies are generally outside the law, as are data covered by other statutes. Residents may also find that exercising a right, such as deletion, means losing an account or a service that relied on the data.
What practical steps can people take?
Residents can start with a few habits. Look for privacy links in the footer of websites and apps. Turn on the Global Privacy Control in a browser or use one that supports it. Review app permissions on phones, especially location access. Request deletion from services no longer in use. And watch for notices of data breaches, which are required under separate state law and may prompt additional steps, such as freezing credit. Scammers also exploit personal data, a topic covered in how to spot phishing texts.
Why it matters beyond the individual
Privacy rules shape how companies build products, from app design to advertising systems, and California’s framework has influenced other states. Companies in the region’s technology and life sciences sectors, discussed in the life sciences guide, handle large amounts of sensitive data and increasingly design for compliance. For residents, the practical value of the law lies in the ability to ask a simple question, “what do you know about me?”, and to expect an answer.
Sources: California Privacy Protection Agency; California Attorney General; California Civil Code; California Legislature
