Law / United States / 
California
CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-Out
In force since , effective .
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.
- Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.
- Do not deny goods or services, charge a different price, or provide a different quality of service to a California consumer because they exercised a CCPA right.
These lines are LexLint's reading of the law's text. Also read by: California Privacy Protection Agency, Enforcement Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d) to $2,663 and $7,988 effective (the higher figure is the one for an intentional violation). This is the Act's general civil penalty, reaching any CCPA violation including the access, deletion, correction, and opt-out duties this row describes; it is not a duty-specific penalty. The Attorney General holds a parallel civil-penalty power at the same amounts under section 1798.199.90(a).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from to , read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on ; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (); a marketing firm fined for selling audiences without data broker registration (); a round of data broker enforcement actions announced together (, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (); Ford Motor Company, ordered to change practices and pay a fine (); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (); a second data broker enforcement action the same week (); and an action against a Virginia data broker (). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. The register text does not give a dollar figure for every action; the figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the remainder. The newsroom is paginated: the to entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
Settledness
- As of
- Guidance link
- https://cppa.ca.gov/pdf/enfadvisory202401.pdf
- Guidance body
- California Privacy Protection Agency, Enforcement Division
- Open questions
- When does a business's duty under Civil Code section 1798.105(c)(1) to notify third parties to delete a consumer's personal information become something that "proves impossible or involves disproportionate effort"?
What it makes you log
Logging duty
The rights sections (1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.125 and 1798.130) set response duties and time limits and name no log or record the business must keep. Section 1798.105(c)(2) says a business may maintain a confidential record of deletion requests to stop resale, which is a permission and not a duty, and section 1798.130(a)(2)(B) says nothing in it requires a business to keep personal information for any length of time. The 24-month record of requests is in 11 CCR 7101, a regulation this row does not cite. No territorial reach is stated in the sections read, so no hook is written.
- Kind
- None
- As of
What this law does
Gives California consumers the right to know and access what personal information a business holds and its source, the right to delete it, the right to correct it, a right to a portable copy, and the right to opt out of the sale or sharing of their personal information to third parties, all exercisable against the business rather than directly against its service providers or contractors. A business may not discriminate against a consumer for exercising these rights.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .