Law / United States / 
California
CCPA Regulations
Officially CCPA Regulations: handling consumer requests, opt-out preference signals and verification (articles 3 and 5)
Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Consent
As of .
What it requires
- If you operate exclusively online and have a direct relationship with the consumers you collect personal information from, give consumers an email address for requests to delete, correct and know. Every other business must give two or more designated methods, one of them a toll-free telephone number, and a website method such as a webform if you maintain a website (section 7020(a) and (b)).
- Confirm receipt of a request to delete, correct or know within 10 business days, and respond within 45 calendar days of receipt. You may extend once by up to 45 more days if you give the consumer notice and an explanation (section 7021).
- To comply with a request to delete, erase the personal information from your existing systems (archived and backup systems excepted), deidentify it or aggregate it, tell your service providers and contractors to delete it, and notify the third parties you sold or shared it with unless that proves impossible or involves disproportionate effort, in which case give the consumer a detailed explanation (section 7022(b)).
- Do not disclose specific pieces of personal information to a requestor you cannot verify, and tell the requestor that you cannot verify their identity (section 7024(a)).
- Establish, document and comply with a reasonable method for verifying that a person making a request to delete, correct or know is the consumer about whom you hold information (section 7060(a)).
- Do not require a consumer to verify their identity to opt out of sale or sharing or to limit use of sensitive personal information (section 7060(b)).
- If you sell or share personal information, process an opt-out preference signal that is in a commonly used format, and that the sending platform makes clear is meant to opt the consumer out of sale and sharing, as a valid opt-out request (section 7025(b)).
- If you collect personal information online and receive such a signal, treat it as a valid request to opt out for that browser or device and any profile associated with it, including pseudonymous profiles, and do not require the consumer to supply more than is necessary to send the signal (section 7025(c)(1) and (2)).
- Display on your website whether you have processed the consumer's opt-out preference signal as a valid request to opt out of sale or sharing (section 7025(c)(6)).
- If you sell or share personal information, provide two or more designated methods for requests to opt out, which for an online business must include an opt-out preference signal and one other listed method. A cookie banner or cookie controls alone do not count (section 7026(a)).
- If you use or disclose sensitive personal information for purposes beyond those in section 7027(m), provide two or more designated methods for requests to limit (section 7027(b)).
- Take a request to opt in after opting out through a two-step process, a clear request followed by a separate confirmation (section 7028(a)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Article 3 of the CCPA Regulations governs business practices for handling consumer requests, beginning with the methods for submitting requests to delete, correct and know in section 7020. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information is required only to provide an email address for requests to delete, correct and know.
A business must confirm receipt of a request to delete, correct or know within 10 business days after receiving it. A business must respond to a request to delete, correct or know no later than 45 calendar days after receipt. A business that sells or shares personal information must process an opt-out preference signal that meets the section's format and disclosure requirements as a valid request to opt out of sale or sharing.
A business that collects personal information online and receives such a signal must treat it as a valid request to opt out for that browser or device and any consumer profile associated with that browser or device. A business may not require a consumer to provide information beyond what is necessary to send an opt-out preference signal. A notification or tool regarding cookies, such as a cookie banner, is not by itself an acceptable method for submitting requests to opt out of sale or sharing.
A business may not require a consumer to verify identity to make a request to opt out of sale or sharing, a request to limit, or a request to opt out of automated decisionmaking technology. A request to opt in after opting out must use a two-step opt-in process in which the consumer first clearly requests to opt in and then separately confirms the choice. The Agency's regulations became effective on . The Agency's amended regulations carry an effective date of .
Section 7200(b) of the CCPA Regulations requires a business that uses automated decisionmaking technology for a significant decision before to comply with the article on that technology no later than .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings, processes biometric data, makes high-risk automated decisions or tracks devices.