California Consumer Privacy Act (CCPA) | State of California - Department of Justice

<!DOCTYPE html> <html lang="en" dir="ltr" prefix="og: http://ogp.me/ns# content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ rdfs: http://www.w3.org/2000/01/rdf-schema# sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema#"> <head> <link rel="profile" href="http://www.w3.org/1999/xhtml/vocab" /> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="google-site-verification" content="xEmL-C4GwHUUV3xa5_meEBdRXothjohFP-peTjXSHtc" /> <link rel="shortcut icon" href="https://oag.ca.gov/sites/default/files/favicon_0.ico" type="image/vnd.microsoft.icon" /> <meta name="google-site-verification" content="rQ6oZQIxn_Jgp7Dq-sgruJW1gy830BKvtFSBNjqSw7A" /> <meta name="msvalidate.01" content="677D5153D29C8072A80042A74C837F58" /> <meta name="description" content="Updated on March 13, 2024 The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law." /> <meta name="generator" content="Drupal 7 (http://drupal.org)" /> <link rel="canonical" href="https://oag.ca.gov/privacy/ccpa" /> <link rel="shortlink" href="https://oag.ca.gov/node/140732" /> <meta property="og:site_name" content="State of California - Department of Justice - Office of the Attorney General" /> <meta property="og:type" content="article" /> <meta property="og:url" content="https://oag.ca.gov/privacy/ccpa" /> <meta property="og:title" content="California Consumer Privacy Act (CCPA)" /> <meta property="og:description" content="Updated on March 13, 2024 The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law." /> <meta property="og:updated_time" content="2024-03-13T13:57:29-07:00" /> <meta property="og:image" content="https://oag.ca.gov/sites/default/files/oag-opengraph.jpg" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:url" content="https://oag.ca.gov/privacy/ccpa" /> <meta name="twitter:title" content="California Consumer Privacy Act (CCPA)" /> <meta name="twitter:description" content="Updated on March 13, 2024 The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations" /> <meta name="twitter:image" content="https://oag.ca.gov/sites/default/files/oag-opengraph.jpg" /> <meta property="article:published_time" content="2018-10-15T16:15:53-07:00" /> <meta property="article:modified_time" content="2024-03-13T13:57:29-07:00" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon.png" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-72x72.png" sizes="72x72" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-76x76.png" sizes="76x76" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-114x114.png" sizes="114x114" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-120x120.png" sizes="120x120" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-144x144.png" sizes="144x144" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-152x152.png" sizes="152x152" /> <link rel="apple-touch-icon" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-180x180.png" sizes="180x180" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-57x57.png" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-72x72.png" sizes="72x72" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-76x76.png" sizes="76x76" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-114x114.png" sizes="114x114" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-120x120.png" sizes="120x120" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-144x144.png" sizes="144x144" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-152x152.png" sizes="152x152" /> <link rel="apple-touch-icon-precomposed" href="https://oag.ca.gov/sites/default/themes/custom2017/oag2017/img/apple-touch-icon-180x180.png" sizes="180x180" /> <title>California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General</title> <style> @import url("https://oag.ca.gov/modules/system/system.base.css?sn7qdx"); </style> <style> @import url("https://oag.ca.gov/sites/default/modules/simplenews/simplenews.css?sn7qdx"); @import url("https://oag.ca.gov/modules/field/theme/field.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/modules/logintoboggan/logintoboggan.css?sn7qdx"); @import url("https://oag.ca.gov/modules/node/node.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/modules/calendar/css/calendar_multiday.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/modules/views/css/views.css?sn7qdx"); </style> <style> @import url("https://oag.ca.gov/sites/default/modules/ctools/css/ctools.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/modules/wysiwyg_linebreaks/wysiwyg_linebreaks.css?sn7qdx"); </style> <link type="text/css" rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" media="all" /> <link type="text/css" rel="stylesheet" href="//cdn.jsdelivr.net/bootstrap/3.3.7/css/bootstrap.css" media="all" /> <style> @import url("https://oag.ca.gov/sites/default/themes/contrib/bootstrap/css/3.3.7/overrides.min.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/themes/custom2017/oag2017/css/style.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/themes/custom2017/oag2017/css/overrides.css?sn7qdx"); @import url("https://oag.ca.gov/sites/default/themes/custom2017/oag2017/css/yamm-mega-menu.css?sn7qdx"); </style>   <script src="//code.jquery.com/jquery-1.9.1.min.js"></script> <script>window.jQuery || document.write("<script src='/sites/default/modules/jquery_update/replace/jquery/1.9/jquery.min.js'>\x3C/script>")</script> <script src="https://oag.ca.gov/misc/jquery-extend-3.4.0.js?v=1.9.1"></script> <script src="https://oag.ca.gov/misc/jquery-html-prefilter-3.5.0-backport.js?v=1.9.1"></script> <script src="https://oag.ca.gov/misc/jquery.once.js?v=1.2"></script> <script src="https://oag.ca.gov/misc/drupal.js?sn7qdx"></script> <script src="//cdn.jsdelivr.net/bootstrap/3.3.7/js/bootstrap.js"></script> <script src="https://oag.ca.gov/sites/default/modules/spamspan/spamspan.js?sn7qdx"></script> <script src="https://oag.ca.gov/sites/default/modules/google_analytics/googleanalytics.js?sn7qdx"></script> <script src="https://www.googletagmanager.com/gtag/js?id=G-6SNZMLLM7F"></script> <script>window.dataLayer = window.dataLayer || [];function gtag(){dataLayer.push(arguments)};gtag("js", new Date());gtag("set", "developer_id.dMDhkMT", true);gtag("config", "G-6SNZMLLM7F", {"groups":"default"});</script> <script>jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","setHasJsCookie":0,"ajaxPageState":{"theme":"oag2017","theme_token":"b3OgdM2FdXSejvfKLdVi-Qj1QewcLZN-pOJlCp2F1c8","js":{"sites\/default\/themes\/contrib\/bootstrap\/js\/bootstrap.js":1,"\/\/code.jquery.com\/jquery-1.9.1.min.js":1,"0":1,"misc\/jquery-extend-3.4.0.js":1,"misc\/jquery-html-prefilter-3.5.0-backport.js":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"\/\/cdn.jsdelivr.net\/bootstrap\/3.3.7\/js\/bootstrap.js":1,"sites\/default\/modules\/spamspan\/spamspan.js":1,"sites\/default\/modules\/google_analytics\/googleanalytics.js":1,"https:\/\/www.googletagmanager.com\/gtag\/js?id=G-6SNZMLLM7F":1,"1":1},"css":{"modules\/system\/system.base.css":1,"sites\/default\/modules\/simplenews\/simplenews.css":1,"modules\/field\/theme\/field.css":1,"sites\/default\/modules\/logintoboggan\/logintoboggan.css":1,"modules\/node\/node.css":1,"sites\/default\/modules\/calendar\/css\/calendar_multiday.css":1,"sites\/default\/modules\/views\/css\/views.css":1,"sites\/default\/modules\/ctools\/css\/ctools.css":1,"sites\/default\/modules\/wysiwyg_linebreaks\/wysiwyg_linebreaks.css":1,"\/\/maxcdn.bootstrapcdn.com\/font-awesome\/4.7.0\/css\/font-awesome.min.css":1,"\/\/cdn.jsdelivr.net\/bootstrap\/3.3.7\/css\/bootstrap.css":1,"sites\/default\/themes\/contrib\/bootstrap\/css\/3.3.7\/overrides.min.css":1,"sites\/default\/themes\/custom2017\/oag2017\/css\/style.css":1,"sites\/default\/themes\/custom2017\/oag2017\/css\/overrides.css":1,"sites\/default\/themes\/custom2017\/oag2017\/css\/yamm-mega-menu.css":1}},"googleanalytics":{"account":["G-6SNZMLLM7F"],"trackOutbound":1,"trackMailto":1,"trackDownload":1,"trackDownloadExtensions":"7z|aac|arc|arj|asf|asx|avi|bin|csv|doc|exe|flv|gif|gz|gzip|hqx|jar|jpe?g|js|mp(2|3|4|e?g)|mov(ie)?|msi|msp|pdf|phps|png|ppt|qtm?|ra(m|r)?|sea|sit|tar|tgz|torrent|txt|wav|wma|wmv|wpd|xls|xml|z|zip|pdf|"},"bootstrap":{"anchorsFix":"0","anchorsSmoothScrolling":"0","formHasError":1,"popoverEnabled":1,"popoverOptions":{"animation":1,"html":0,"placement":"right","selector":"","trigger":"click","triggerAutoclose":1,"title":"","content":"","delay":0,"container":"body"},"tooltipEnabled":1,"tooltipOptions":{"animation":1,"html":0,"placement":"auto left","selector":"","trigger":"hover focus","delay":0,"container":"body"}}});</script> </head> <body class="html not-front not-logged-in one-sidebar sidebar-second page-node page-node- page-node-140732 node-type-page"> <div id="skip-link"> <a href="#main-content" class="element-invisible element-focusable">Skip to main content</a> </div> <header role="banner" id="page-header"> <div class="region region-header"> <div id="block-block-467" class="block block-block"> <div class="content"> <section id="ag-newsletter" class="container-fluid sect-separator" style="margin-bottom:1.5rem; border-bottom:0;"> <div class="container"> <div class="icon"><i class="fa fa-newspaper-o" aria-hidden="true"></i></div> <div class="title">Subscribe to Our Newsletter</div> <form action="https://public.govdelivery.com/accounts/CAOAG/subscribers/qualify" accept-charset="UTF-8" method="post"> <input type="hidden" name="utf8" value="✓" /> <input type="hidden" name="topic_id" id="topic_id" value="CAOAG_4" /> <div class="input-group"> <label class="sr-only" for="ag-weekly-newsletter">Subscribe</label> <input class="form-control form-subscribe" name="email" type="email" id="ag-weekly-newsletter" placeholder="Enter your email..."> <span class="input-group-btn"> <button name="commit" class="btn btn-info" type="submit" data-disable-with="Subscribe">Subscribe</button> </span> </div> </form> </div> </section> </div> </div><div id="block-block-370" class="block block-block"> <div class="content"> <div class="container"> <div class="row top-row"> <div class="col-xs-6 col-md-7"> <div class="universal-heading"> State <em>of</em> California Department <em>of</em> Justice </div> </div> <div class="col-xs-6 col-md-5"> <div class="social-network"> <a href="https://oag.ca.gov/news/feed" target="_blank" title="California Attorney General RSS Feed" aria-label="California Attorney General RSS Feed"><i class="fa fa-rss" aria-hidden="true"></i></a> <a href="https://www.facebook.com/AGRobBonta" target="_blank" title="California Attorney General Facebook" aria-label="California Attorney General Facebook"><i class="fa fa-facebook" aria-hidden="true"></i></a> <a href="https://twitter.com/AGRobBonta" target="_blank" title="California Attorney General Twitter" aria-label="California Attorney General Twitter"><i class="fa fa-twitter" aria-hidden="true"></i></a> <a href="https://www.instagram.com/AGRobBonta" target="_blank" title="California Attorney General Instagram" aria-label="California Attorney General Instagram"><i class="fa fa-instagram" aria-hidden="true"></i></a> <a href="https://www.youtube.com/user/caoag" target="_blank" title="California Attorney General YouTube" aria-label="California Attorney General YouTube"><i class="fa fa-youtube" aria-hidden="true"></i></a>  </div> </div> </div> <div class="row middle-row"> <div class="col-xs-12 col-md-6"> <div class="main-logo-container"> <a href="/"><img class="main-logo" src="/sites/default/themes/custom2017/oag2017/img/doj-seal-header.png" alt="Calfifornia Department of Justice - Office of the Attorney General"></a> </div> <div class="header"> <span>Rob Bonta</span> <br> <div class="header-separator"></div> <span class="title">Attorney General</span> </div> </div> <div class="col-xs-12- col-md-6"> <div class="form-group"> <form action="/search-results/" accept-charset="utf-8"> <div class="input-group desktopNavSearch"> <label class="sr-only" for="query-header">Search</label> <input class="form-control form-search" name="query" type="text" id="query-header"> <span class="input-group-btn"> <button class="btn btn-default form-submit" type="submit">Search</button> </span> </div> </form> <div class="form-group translate-header"> <a class="translate" data-toggle="modal" href="#siteTranslate">Translate Website | <span lang="es">Traducir Sitio Web</span></a> </div> </div> </div> </div> </div>  <div id="siteTranslate" class="modal fade bs-example-modal-lg" tabindex="-1" role="dialog" aria-labelledby="googleTranslate"> <div class="modal-dialog modal-lg" role="document"> <div class="modal-content"> <div class="modal-header"> <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">×</span></button> <h4 class="modal-title" id="googleTranslate">Google™ Translate Disclaimer</h4> </div> <div class="modal-body"> <p>This Google™ translation feature is provided for informational purposes only.</p> <p>The Office of the Attorney General is unable to guarantee the accuracy of this translation and is therefore not liable for any inaccurate information resulting from the translation application tool.</p> <p>Please consult with a translator for accuracy if you are relying on the translation or are using this site for official business.</p> <p>If you have any questions please contact: Bilingual Services Program at <a href="mailto:EERROffice@doj.ca.gov">EERROffice@doj.ca.gov</a></p> <p>A copy of this disclaimer can also be found on our <a href="/disclaimer">Disclaimer</a> page.</p> <h5>Select a Language Below / Seleccione el Idioma Abajo</h5> <div id="google_translate_element"></div> <script type="text/javascript"> function googleTranslateElementInit() { new google.translate.TranslateElement({pageLanguage: 'en', layout: google.translate.TranslateElement.InlineLayout.HORIZONTAL, multilanguagePage: true}, 'google_translate_element'); } </script> <script type="text/javascript" src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script> </div> <div class="modal-footer"> <button type="button" class="btn btn-default" data-dismiss="modal">Close</button> </div> </div> </div> </div> </div> </div> </div> </header>    <div class="region region-navigation"> <div id="block-block-371" class="block block-block"> <div class="content"> <nav class="navbar navbar-default yamm"> <div class="container"> <div class="navbar-header mobileNavSearch"> <form action="/search-results/" accept-charset="utf-8"> <div class="input-group"> <label class="sr-only" for="query-mobile">Search</label> <input class="form-control form-search" name="query" type="text" id="query-mobile"> <span class="input-group-btn"> <button class="btn btn-default form-submit" type="search" style="margin-left:0.5em;">Search</button> </span> </div> </form> <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar-collapse" aria-expanded="false"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> </div> <div id="navbar-collapse" class="collapse navbar-collapse"> <ul class="nav navbar-nav mainNavbar"> <li class="dropdown"><a class="active-trail" href="/home">Home</a></li> <li class="dropdown yamm-fw"><a href="/about" class="dropdown-toggle" data-toggle="dropdown" id="accessible-menu-first-tier-1" aria-controls="accessible-menu-first-tier-2" aria-expanded="true">About</a> <ul class="dropdown-menu" id="accessible-menu-first-tier-2" aria-expanded="true" aria-hidden="false" aria-labelledby="accessible-menu-first-tier-1"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-3"> <ul class="subList"> <li><a href="/about"><img class="img-thumbnail" alt="Attorney General Rob Bonta" src="/sites/default/files/media/ag-bonta-official-2.jpg"></a></li> </ul> </div> <div class="col-md-3"> <h4>Who We Are</h4> <ul class="subList"> <li><a href="/about">About AG Rob Bonta</a></li> <li><a href="/office">About the Office of the Attorney General</a></li> <li><a href="/history">History of the Office</a></li> </ul> </div> <div class="col-md-3"> <h4>What We Do</h4> <ul class="subList"> <li><a href="/careers/aboutus/psle">Public Safety</a></li> <li><a href="/opinions">Opinions and Quo Warranto</a></li> <li><a href="/research">Research Advisory Panel</a></li> <li><a href="/research-center">Research Center</a></li> <li><a href="/children-seniors">Children & Families</a></li> <li><a href="/civil">Civil Rights</a></li> <li><a href="/consumers">Consumer Protection</a></li> <li><a href="/environment">Environment & Public Health</a></li> </ul> </div> <div class="col-md-3"> <h4>What We're Working On</h4> <ul class="subList"> <li><a href="/housing">Housing</a></li> <li><a href="/ogvp">Office of Gun Violence Prevention</a></li> <li><a href="/21st-century-policing">21st Century Policing</a></li> <li><a href="/economic">Consumer Protection and Economic Opportunity</a></li> <li><a href="/health-care">Health Care</a></li> <li><a href="/environment/justice">Environmental Justice</a></li> <li><a href="/equality">Equality</a></li> <li><a href="/immigrant">Immigration</a></li> <li><a href="/bcj">Children’s Rights</a></li> <li><a href="https://openjustice.doj.ca.gov/" target="_blank">OpenJustice</a></li> </ul> </div> </div> </div> </li> </ul> </li> <li class="dropdown"><a href="/media" class="dropdown-toggle" data-toggle="dropdown" id="accessible-menu-first-tier-3" aria-controls="accessible-menu-first-tier-4" aria-expanded="true">Media</a> <ul class="dropdown-menu" id="accessible-menu-first-tier-4" aria-expanded="true" aria-hidden="false" aria-labelledby="accessible-menu-first-tier-3"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-12"> <h4>Media Center</h4> <ul class="subList"> <li><a href="/media/news">Press Releases</a></li> <li><a href="/media/library">Media Library</a></li> </ul> </div> <div class="col-md-12"> <h4>Social Media</h4> <ul class="subList"> <li><a href="https://www.facebook.com/AGRobBonta" target="_blank" title="California Attorney General Facebook">Facebook</a></li> <li><a href="https://twitter.com/AGRobBonta" target="_blank" title="California Attorney General Twitter">Twitter</a></li> <li><a href="https://www.instagram.com/AGRobBonta" target="_blank" title="California Attorney General Instagram">Instagram</a></li> <li><a href="https://www.youtube.com/user/caoag" target="_blank" title="California Attorney General YouTube">YouTube</a></li> </ul> </div> </div> </div> </li> </ul> </li> <li class="dropdown yamm-fw"><a href="/careers" class="dropdown-toggle" data-toggle="dropdown">Careers</a> <ul class="dropdown-menu"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-3"> <h4>Career Opportunities</h4> <ul class="subList"> <li><a href="/careers/how-to-apply">How to Apply</a></li> <li><a href="/careers/exams">Assessments</a></li> <li><a href="/careers/job-vacancies">Job Vacancies</a></li> <li><a href="/careers/students">Internships & Student Positions</a></li> <li><a href="/special-agent-recruitment">Become a Special Agent</a></li> <li><a href="/dag-recruitment">Become a Deputy Attorney General</a></li> </ul> </div> <div class="col-md-3"> <h4>Organization of the Office</h4> <ul class="subList"> <li><a href="/careers/aboutus">About the Office</a></li> <li><a href="/careers/aboutus/legal">Legal Services Divisions</a></li> <li><a href="/law/dle">Division of Law Enforcement</a></li> <li><a href="/careers/descriptions/cjis">California Justice Information Services (CJIS)</a></li> <li><a href="/careers/aboutus/administration">Administration</a></li> </ul> </div> <div class="col-md-6"> <h4>AG Honors Program & Geoffrey Wright Solicitor General Fellowship</h4> <ul class="subList"> <li><a href="/careers/honors">Attorney General's Honors Program</a></li> <li><a href="/careers/osg-fellowship">Geoffrey Wright Solicitor General Fellowship</a></li> </ul> </div> </div> </div> </li> </ul> </li> <li class="dropdown"><a href="/regulations">Regulations</a> </li> <li class="dropdown yamm-fw"><a href="/services-info" class="dropdown-toggle" data-toggle="dropdown">Resources</a> <ul class="dropdown-menu"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-3"> <h4>For Businesses</h4> <ul class="subList"> <li><a href="/privacy/databreach/reporting">Submit Data Security Breach</a></li> <li><a href="/privacy/business-privacy">Privacy Resources</a></li> <li><a href="/hiddenfees">SB 478 - Hidden Fees</a></li> </ul> </div> <div class="col-md-3"> <h4>Service on the Attorney General</h4> <ul class="subList"> <li><a href="/services-info#locations">Office Locations / Status Updates</a></li> <li><a href="/services-info#require">Laws Requiring Service on the AG</a></li> </ul> </div> <div class="col-md-3"> <h4>Open Government</h4> <ul class="subList"> <li><a href="/government">Overview</a></li> <li><a href="/initiatives">Ballot Initiatives</a></li> <li><a href="/conflict-interest">Conflicts of Interest</a></li> <li><a href="/cjsc/aboutcjsc">Criminal Justice Statistics</a></li> <li><a href="/consumers/general/pra">Public Records</a></li> <li><a href="/publications">Publications</a></li> </ul> </div> <div class="col-md-3"> <h4>Grants</h4> <ul class="subList"> <li><a href="/grant-opportunities">Grant Opportunities</a></li> </ul> </div> </div> </div> </li> </ul> </li> <li class="dropdown yamm-fw"><a href="/programs" class="dropdown-toggle" data-toggle="dropdown">Programs</a> <ul class="dropdown-menu"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-3"> <h4>Programs</h4> <ul class="subList"> <li><a href="/programs">See All Programs</a></li> </ul> </div> <div class="col-md-3"> <h4>Most Popular</h4> <ul class="subList" > <li><a href="/charities">Charities</a></li> <li><a href="https://www.meganslaw.ca.gov" target="_blank">Megan's Law</a></li> <li><a href="/cures">CURES</a></li> <li><a href="/services-info">Service on the Attorney General</a></li> <li><a href="/dmfea">Division of Medi-Cal Fraud & Elder Abuse</a></li> </ul> </div> <div class="col-md-6"> <h4>  <span class="sr-only">Most Popular</span></h4> <ul class="subList"> <li><a href="/register">Permits & Registrations</a></li> <li><a href="/prop65">Prop 65 – Safe Drinking Water</a></li> <li><a href="/missing">Missing Persons</a></li> <li><a href="/privacy/databreach/reporting">Data Security Breach</a></li> <li><a href="/human-trafficking">Human Trafficking</a></li> </ul> </div> </div> </div> </li> </ul> </li> <li class="dropdown"><a href="/appointments">Appointments</a></li> <li class="dropdown"><a href="/contact" class="dropdown-toggle" data-toggle="dropdown">Contact</a> <ul class="dropdown-menu"> <li> <div class="yamm-content"> <div class="row"> <div class="col-md-12"> <ul class="subList"> <li><a href="/contact">Contact Us</a></li> <li><a href="/contact-espanol#googtrans(en|es)" class="sub notranslate">Contact Us - En español</a></li> <li><a href="/consumers/contact/espanol">Contáctenos/Formularios</a></li> <li><a href="/services-info">Service on the Attorney General</a></li> </ul> </div> </div> </div> </li> </ul> </li> </ul> </div> </div> </nav> <script> jQuery('ul.mainNavbar li.dropdown > a').on("keydown click", function(event) { var keycode = (event.keyCode ? event.keyCode : event.which); switch (keycode) { case 27: // 27 - escape key jQuery('ul.mainNavbar .dropdown-menu').hide(); jQuery(this).parent().removeClass('open'); jQuery(this).parent().find('.dropdown-menu').hide(); return false; case 1: // 1 - click case 13: // 13 - enter key var drop = jQuery(this).parent().find('.dropdown-menu'); if(jQuery(this).parent().hasClass("open") || drop.length == 0) { var href = jQuery(this).attr('href'); window.location.href = href; return; } jQuery('ul.mainNavbar .dropdown-menu').hide(); jQuery('ul.mainNavbar .dropdown.open').removeClass('open'); drop.show(); jQuery(this).parent().addClass('open'); return false; case 40: // 40 - down arrow key jQuery('ul.mainNavbar .dropdown-menu').hide(); jQuery('ul.mainNavbar .dropdown.open').removeClass('open'); jQuery(this).parent().find('.dropdown-menu').show(); jQuery(this).parent().addClass('open'); break; } }); jQuery('ul.mainNavbar li.dropdown').hover(function() { jQuery(this).find('.dropdown-menu').show(); jQuery(this).addClass('open'); }, function() { jQuery(this).find('.dropdown-menu').hide(); jQuery(this).removeClass('open'); }); </script> </div> </div> </div>   <div class="container-fluid"> <div class="row"> </div> </div> <div class="main-container container"> <div class="row"> <section class="col-sm-9"> <a id="main-content"></a> <h1 class="page-header">California Consumer Privacy Act (CCPA)</h1> <ol class="breadcrumb"><li><a href="/">Home</a></li> <li><a href="/privacy" class="active-trail">Privacy</a></li> <li class="active">California Consumer Privacy Act (CCPA)</li> </ol> <div class="region region-content"> <div id="block-system-main" class="block block-system"> <div class="content"> <div id="node-140732" class="node node-page clearfix" about="/privacy/ccpa" typeof="foaf:Document"> <span property="dc:title" content="California Consumer Privacy Act (CCPA)" class="rdf-meta element-hidden"></span><span property="sioc:num_replies" content="0" datatype="xsd:integer" class="rdf-meta element-hidden"></span> <div class="content clearfix"> <div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even" property="content:encoded"><p><em>Updated on March 13, 2024</em></p> <style TYPE="text/css"> .btn-primary:active, .btn-primary.active, .open > .dropdown-toggle.btn-primary { color: #ffffff; background-color: #333 !important; border-color: #333 !important; } #ccpafaq .collapse ul, #ccpafaqb .collapse ul, #ccpafaqc .collapse ul, #ccpafaqd .collapse ul, #ccpafaqe .collapse ul, #ccpafaqf .collapse ul, #ccpafaqg .collapse ul { list-style-type: circle; font-size: 1em; color: inherit; } </style> <p>The <a href="http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5" target="_blank">California Consumer Privacy Act of 2018</a> (CCPA) gives consumers more control over the personal information that businesses collect about them and the <a href="https://govt.westlaw.com/calregs/Browse/Home/California/CaliforniaCodeofRegulations?guid=I5E53FC80FEDE11ECA3A49C17D1AA5D7C&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default)" target="_blank" rel="noopener noreferrer">CCPA regulations</a> provide guidance on how to implement the law. This landmark law secures new privacy rights for California consumers, including: <ul> <li>The <a href="#sectionc">right to know</a> about the personal information a business collects about them and how it is used and shared;</li> <li>The <a href="#sectiond">right to delete</a> personal information collected from them (with some exceptions);</li> <li>The <a href="#sectionb">right to opt-out</a> of the sale or sharing of their personal information; and</li> <li>The <a href="#sectiong">right to non-discrimination</a> for exercising their CCPA rights. </li> </ul> </p> <p>In November of 2020, California voters approved <a href="https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5" target="_blank">Proposition 24, the CPRA</a>, which amended the CCPA and added new additional privacy protections that began on January 1, 2023. As of January 1, 2023, consumers have new rights in addition to those above, such as: <ul> <li>The <a href="#sectione">right to correct</a> inaccurate personal information that a business has about them; and <li>The <a href="#sectionf">right to limit</a> the use and disclosure of sensitive personal information collected about them. </ul> </p> <p><a href="#sectiona">Businesses</a> that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain <a href="#sectiond">notices explaining their privacy practices</a>. The CCPA applies to many businesses, including <a href="#sectiong">data brokers</a>.</p> <p>CPRA amends the CCPA; it does not create a separate, new law. As a result, our office typically refers to the law as “CCPA” or “CCPA, as amended.”</p> <div class="panel panel-default"> <div class="panel-heading"> <h2 class="panel-title1">Links to Topics</h2></div> <div class="panel-body"> <div class="row"> <div class="col-md-6"> <ul class="nav-list"> <li><a href="#sectiona">A. GENERAL INFORMATION ABOUT THE CCPA</a></li> <li><a href="#sectionb">B. RIGHT TO OPT-OUT OF SALE OR SHARING</a></li> <li><a href="#sectionc">C. REQUESTS TO KNOW</a></li> <li><a href="#sectiond">D. REQUESTS TO DELETE</a></li> <li><a href="#sectione">E. REQUESTS TO CORRECT</a></li> </ul> </div> <div class="col-md-6"> <ul class="nav-list"> <li><a href="#sectionf">F. REQUESTS TO LIMIT USE OF PERSONAL INFORMATION</a></li> <li><a href="#sectiong">G. RIGHT TO NON-DISCRIMINATION</a></li> <li><a href="#sectionh">H. REQUIRED NOTICES</a></li> <li><a href="#sectioni">I. DATA BROKERS AND THE CCPA</a></li> <li><a href="#sectionother">Other Consumer Resources on CCPA</a></li> </ul> </div> </div> </div> </div> <h2>Frequently Asked Questions (FAQs)</h2> <p>These FAQs provide general consumer information about the CCPA and how you can exercise your rights under the CCPA. They are not legal advice, regulatory guidance, or an opinion of the Attorney General. We will update this information periodically.</p> <h3 id="sectiona">A. GENERAL INFORMATION ABOUT THE CCPA</h3> <div class="panel-group" id="ccpafaq" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse1" aria-expanded="true" aria-controls="collapse1"> 1. What rights do I have under the CCPA? </a> </h4> </div> <div id="collapse1" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1"> <div class="panel-body"> <p>If you are a California resident, you may ask businesses to disclose what personal information they have about you and what they do with that information, to delete your personal information, to direct businesses not to sell or share your personal information, to correct inaccurate information that they have about you, and to limit businesses’ use and disclosure of your sensitive personal information: <ul> <li><strong>Right to know</strong>: You can request that a business disclose to you: (1) the categories and/or specific pieces of personal information they have collected about you, (2) the categories of sources for that personal information, (3) the purposes for which the business uses that information, (4) the categories of third parties with whom the business discloses the information, and (5) the categories of information that the business sells or discloses to third parties. You can make a request to know up to twice a year, free of charge.</li> <li><strong>Right to delete</strong>: You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).</li> <li><strong>Right to opt-out of sale or sharing</strong>: You may request that businesses stop selling or sharing your personal information (“opt-out”), including via a user-enabled global privacy control. Businesses cannot sell or share your personal information after they receive your opt-out request unless you later authorize them to do so again.</li> <li><strong>Right to correct</strong>: You may ask businesses to correct inaccurate information that they have about you.</li> <li><strong>Right to limit use and disclosure of sensitive personal information</strong>: You can direct businesses to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested.</li> </ul> </p> <p>You also have the right to be notified, before or at the point businesses collect your personal information, of the types of personal information they are collecting and what they may do with that information. Generally, businesses cannot discriminate against you for exercising your rights under the CCPA. Businesses cannot make you waive these rights, and any contract provision that says you waive these rights is unenforceable.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse2" aria-expanded="true" aria-controls="collapse2"> 2. What if I am not a California resident? </a> </h4> </div> <div id="collapse2" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2"> <div class="panel-body"> <p>Only California residents have rights under the CCPA. A California resident is a natural person (as opposed to a corporation or other business entity) who resides in California, even if the person is temporarily outside of the state.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse3" aria-expanded="true" aria-controls="collapse3"> 3. What is considered personal information and sensitive personal information under the CCPA? </a> </h4> </div> <div id="collapse3" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3"> <div class="panel-body"> <p><strong>Personal information</strong> is information that identifies, relates to, or could reasonably be linked with you or your household. For example, it could include your name, social security number, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences from other personal information that could create a profile about your preferences and characteristics.</p> <p><strong>Sensitive personal information</strong> is a specific subset of personal information that includes certain government identifiers (such as social security numbers); an account log-in, financial account, debit card, or credit card number with any required security code, password, or credentials allowing access to an account; precise geolocation; contents of mail, email, and text messages; genetic data; biometric information processed to identify a consumer; information concerning a consumer’s health, sex life, or sexual orientation; or information about racial or ethnic origin, religious or philosophical beliefs, or union membership. Consumers have the right to also limit a business’s use and disclosure of their sensitive personal information.</p> <p><strong>Personal information does not include publicly available information (including public real estate/property records) and certain <a href="/privacy/ccpa#heading4">types of information</a>.</strong></p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse4" aria-expanded="true" aria-controls="collapse4"> 4. What is not considered personal information under the CCPA? </a> </h4> </div> <div id="collapse4" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4"> <div class="panel-body"> <p>Personal information does not include publicly available information that is from federal, state, or local government records, such as professional licenses and public real estate/property records. The definition of publicly available information also includes information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or certain information disclosed by a consumer and made available if the consumer has not restricted the information to a specific audience.</p> <p>The CCPA also exempts certain types of information such as certain medical information and consumer credit reporting information.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading5"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse5" aria-expanded="true" aria-controls="collapse5"> 5. What businesses does the CCPA apply to? </a> </h4> </div> <div id="collapse5" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading5"> <div class="panel-body"> <p>The CCPA applies to for-profit businesses that do business in California and meet any of the following: <ul> <li>Have a gross annual revenue of over $25 million;</li> <li>Buy, sell, or share the personal information of 100,000 or more California residents or households; or</li> <li>Derive 50% or more of their annual revenue from selling California residents’ personal information.</li> </ul> </p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading6"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse6" aria-expanded="true" aria-controls="collapse6"> 6. Does the CCPA apply to nonprofits or government agencies? </a> </h4> </div> <div id="collapse6" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading6"> <div class="panel-body"> <p>The CCPA generally does not apply to nonprofit organizations or government agencies.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading7"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse7" aria-expanded="true" aria-controls="collapse7"> 7. What can I do if I think a business violated the CCPA? </a> </h4> </div> <div id="collapse7" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading7"> <div class="panel-body"> <p>You cannot sue businesses for most CCPA violations. You can only sue a business under the CCPA if there is a data breach, and even then, only under limited circumstances. You can sue a business if your nonencrypted and nonredacted personal information was stolen in a data breach as a result of the business’s failure to maintain reasonable security procedures and practices to protect it. If this happens, you can sue for the amount of monetary damages you actually suffered from the breach or “statutory damages” of up to $750 per incident. Before suing, you must give the business written notice of which CCPA sections it violated and allow 30 days to respond in writing that it has cured the violations and that no further violations will occur. If the business is able to actually cure the violation and gives you its written statement that it has done so, you cannot sue the business, unless it continues to violate the CCPA contrary to its statement.</p> <p>For all other violations of the CCPA, only the Attorney General or the California Privacy Protection Agency may take legal action against non-compliant entities. The Attorney General does not represent individual California consumers. Using consumer complaints and other information, the Attorney General may identify patterns of misconduct that may lead to investigations and actions on behalf of the collective legal interests of the people of California. If you believe a business has violated the CCPA, you may <a href="/contact/consumer-complaint-against-business-or-company">file a consumer complaint</a> with the Office of the Attorney General. If you choose to file a complaint with our office, explain exactly how the business violated the CCPA, and describe when and how the violation occurred. Please note that the Attorney General cannot represent you or give you legal advice on how to resolve your individual complaint. Starting on July 1, 2023, you also will be able to file complaints with the <a href="https://cppa.ca.gov/" target="_blank" rel="noopener noreferrer">California Privacy Protection Agency</a> for violations of the CCPA, as amended, occurring on or after that date.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading8"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse8" aria-expanded="true" aria-controls="collapse8"> 8. What kind of data breach can I sue a business for under the CCPA? </a> </h4> </div> <div id="collapse8" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading8"> <div class="panel-body"> <p>You can only sue businesses under the CCPA if certain conditions are met. The type of personal information that must have been stolen is your first name (or first initial) and last name in combination with any of the following: <ul> <li>Your social security number</li> <li>Your driver’s license number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to identify a person's identity</li> <li>Your financial account number, credit card number, or debit card number if combined with any required security code, access code, or password that would allow someone access to your account</li> <li>Your medical or health insurance information</li> <li>Your fingerprint, retina or iris image, or other unique biometric data used to identify a person's identity (but not including photographs unless used or stored for facial recognition purposes)</li> </ul> </p> <p>This personal information must have been stolen in nonencrypted and nonredacted form. In addition, the personal information must have been stolen in a data breach as a result of the business’s failure to maintain reasonable security procedures and practices to protect it. If this happens, you can sue for the amount of monetary damages you actually suffered from the breach or “statutory damages” of up to $750 per incident. Before suing, you must give the business written notice of which CCPA sections it violated and allow 30 days to respond in writing that it has cured the violations and that no further violations will occur. If the business is able to actually cure the violation and gives you its written statement that it has done so, you cannot sue the business, unless it continues to violate the CCPA contrary to its statement.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading9"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse9" aria-expanded="true" aria-controls="collapse9"> 9. Do businesses need to comply with the statutory CPRA amendments to the CCPA that went into effect on January 1, 2023? </a> </h4> </div> <div id="collapse9" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading9"> <div class="panel-body"> <p>Yes. As of January 1, 2023, the CPRA’s amendments to the CCPA are in effect, and businesses are required to comply with all express statutory requirements. Businesses are also required to comply with those CCPA regulations currently in effect.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading10"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse10" aria-expanded="true" aria-controls="collapse10"> 10. Are there any CCPA regulations currently in effect? </a> </h4> </div> <div id="collapse10" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading10"> <div class="panel-body"> <p>Yes. The California Department of Justice promulgated an initial round of regulations implementing the CCPA on August 14, 2020 and further amended on March 15, 2021. Those regulations were recently updated by the California Privacy Protection Agency. These regulations appear in <a href="https://govt.westlaw.com/calregs/Browse/Home/California/CaliforniaCodeofRegulations?guid=I5E53FC80FEDE11ECA3A49C17D1AA5D7C&originationContext=documenttoc&transitionType=Default&contextData=(sc.Default)" target="_blank" rel="noopener noreferrer">Title 11, Division 6, Section 7001 et seq. of the California Code of Regulations</a> and were effective on March 29, 2023.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading11"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse11" aria-expanded="true" aria-controls="collapse11"> 11. Are the statutory exemptions for employee data and business-to-business transactions still in effect? </a> </h4> </div> <div id="collapse11" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading11"> <div class="panel-body"> <p>No. The exemptions for employment-related personal information and personal information reflecting business-to-business transactions described in Civil Code Sec. 1798.145(m)-(n) expired on December 31, 2022.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading12"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaq" href="#collapse12" aria-expanded="true" aria-controls="collapse12"> 12. Can I use an authorized agent to submit a request? </a> </h4> </div> <div id="collapse12" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading12"> <div class="panel-body"> <p>Yes. You may authorize another person to submit a CCPA request on your behalf. You may also authorize a business entity registered with the California Secretary of State to submit a request on your behalf.</p> <p>Please note that if you use an authorized agent, businesses may require more information from either the authorized agent or from you to verify that you are the person directing the agent. For example, for requests to know or delete your personal information, the business may require the authorized agent to provide proof that you gave that agent signed permission to submit the request. Businesses may also require you to verify your identity directly with the business or directly confirm with the business that you gave the authorized agent permission to submit the request.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectionb">B. RIGHT TO OPT-OUT OF SALE OR SHARING</h3> <div class="panel-group" id="ccpafaqb" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse1b" aria-expanded="true" aria-controls="collapse1b"> 1. What is the right to opt-out? </a> </h4> </div> <div id="collapse1b" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1b"> <div class="panel-body"> <p>You may request that businesses stop selling or sharing your personal information (“opt-out”). Note that sharing refers specifically to sharing for cross-context behavioral advertising, which is the targeting of advertising to a <a href="https://thecpra.org/#1798.140(i)" target="_blank" rel="noopener noreferrer">consumer</a> based on the <a href="https://thecpra.org/#1798.140(i)" target="_blank" rel="noopener noreferrer">consumer</a>’s <a href="https://thecpra.org/#1798.140(v)" target="_blank" rel="noopener noreferrer">personal information</a> obtained from the <a href="https://thecpra.org/#1798.140(i)" target="_blank" rel="noopener noreferrer">consumer</a>’s online activity across numerous websites. With some exceptions, businesses cannot sell or share your personal information after they receive your opt-out request unless you later provide authorization allowing them to do so again. Businesses must wait at least 12 months before asking you to opt back in to the sale or sharing of your personal information.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse2b" aria-expanded="true" aria-controls="collapse2b"> 2. Can businesses sell a child’s personal information? </a> </h4> </div> <div id="collapse2b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2b"> <div class="panel-body"> <p>Businesses can only sell the personal information of a child that they know to be under the age of 16 if they get affirmative authorization (“opt-in”) for the sale of the child’s personal information. For children under the age of 13, that opt-in must come from the child’s parent or guardian. For children who are at least 13 years old but under the age of 16, the opt-in can come from the child.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse3b" aria-expanded="true" aria-controls="collapse3b"> 3. How do I submit my opt-out request? </a> </h4> </div> <div id="collapse3b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3b"> <div class="panel-body"> <p>Businesses that sell personal information are subject to the CCPA's requirement to provide a clear and conspicuous “Do Not Sell or Share My Personal Information” link on their website that allows you to submit an opt-out request. Businesses cannot require you to create an account in order to submit your request. Businesses also should not require you to verify your identity, though they can ask you basic questions to identify which personal information is associated with you.</p> <p>You can also submit an opt-out request via a user-enabled global privacy control, like the GPC, discussed in FAQ 8 & 9 below. If you can’t find a business’s “Do Not Sell or Share My Personal Information” link, review its privacy policy to see if it sells or shares personal information. If the business does, it must also include that link in its privacy policy.</p> <p>If a business’s "Do Not Sell My Personal Information" link or other designated method of submitting opt-out requests is not working or difficult to find, you may report the business to our office (<a href="/contact/consumer-complaint-against-business-or-company" target="_blank">https://oag.ca.gov/contact/consumer-complaint-against-business-or-company</a>). </p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse4b" aria-expanded="true" aria-controls="collapse4b"> 4. How long does the business have to respond to my opt-out request? </a> </h4> </div> <div id="collapse4b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4b"> <div class="panel-body"> <p>Businesses must respond as soon as feasibly possible to your request, up to a maximum of 15 business days from the date they received your request to opt-out.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading5b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse5b" aria-expanded="true" aria-controls="collapse5b"> 5. Why is the business asking me for more information? </a> </h4> </div> <div id="collapse5b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading5b"> <div class="panel-body"> <p>While businesses are not required to verify that the person submitting an opt-out request is really the consumer for whom the business has personal information, they may need to ask you for additional information to make sure they stop selling the right person’s personal information. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading6b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse6b" aria-expanded="true" aria-controls="collapse6b"> 6. Why did the business deny my opt-out request? </a> </h4> </div> <div id="collapse6b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading6b"> <div class="panel-body"> <p>There are some exceptions to the opt-out right. Common reasons why businesses may refuse to stop selling your personal information include: <ul> <li>Sale or sharing is necessary for the business to comply with legal obligations, exercise legal claims or rights, or defend legal claims</li> <li>The information is publicly available information, certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA.</li> </ul> </p> <p>See <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.145." target="_blank">Civil Code section 1798.145</a> for more exceptions.</p> <p>If you do not know why a business denied your opt-out request, follow up with the business to ask it for its reasons.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading7b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse7b" aria-expanded="true" aria-controls="collapse7b"> 7. Why did I get a response that the business is a service provider that does not have to act on my request? </a> </h4> </div> <div id="collapse7b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading7b"> <div class="panel-body"> <p>Many businesses use other businesses to provide services for them. For example, a retailer may contract with a payment card processor to process customer credit card transactions or a shipping company to deliver orders. These entities may qualify as “service providers” under the CCPA.</p> <p>The CCPA treats service providers differently than the businesses they serve. It is the business that is responsible for responding to consumer requests. If you submit a request to opt-out to a service provider of a business instead of the business itself, the service provider may deny the request. You must submit your request to the business itself.</p> <p>If a service provider has said that it does not or cannot act on your request because it is a service provider, you may follow up to ask who the business is. However, sometimes the service provider will not be able to provide that information. You may be able to determine who the business is based on the services that the service provider provides, although sometimes this may be difficult or impossible.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading8b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse8b" aria-expanded="true" aria-controls="collapse8b"> 8. What is the GPC? </a> </h4> </div> <div id="collapse8b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading8b"> <div class="panel-body"> <p>Businesses that sell or share personal information must offer two or more methods for consumers to submit requests to opt-out of the sale of their personal information. For businesses that collect personal information from consumers online, one acceptable method for consumers to opt-out of sales or sharing is via a user-enabled global privacy control, like the <a href="https://globalprivacycontrol.org/" target="_blank">GPC</a>. Developed in response to the CCPA and to enhance consumer privacy rights, the GPC is a ‘stop selling or sharing my data switch’ that is available on some internet browsers, like Mozilla Firefox, Duck Duck Go, and Brave, or as a browser extension. It is a proposed technical standard that reflects what the CCPA regulations contemplated – some consumers want a comprehensive option that broadly signals their opt-out request, as opposed to making requests on multiple websites on different browsers or devices. Opting out of the sale or sharing of personal information should be easy for consumers, and the GPC is one option for consumers who want to submit requests to opt-out of the sale or sharing of personal information via a user-enabled global privacy control. Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading9b"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqb" href="#collapse9b" aria-expanded="true" aria-controls="collapse9b"> 9. How do I submit my opt-out request using the GPC? </a> </h4> </div> <div id="collapse9b" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading9b"> <div class="panel-body"> <p>To learn more about the GPC, you can visit its website <a href="https://globalprivacycontrol.org/" target="_blank">here</a>. Developers have begun to innovate around the GPC and created different mechanisms for consumers, such as EFF’s <a href="https://privacybadger.org/" target="_blank">Privacy Badger</a> extension or the Brave Privacy Browser.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectionc">C. REQUESTS TO KNOW</h3> <div class="panel-group" id="ccpafaqc" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse1c" aria-expanded="true" aria-controls="collapse1c"> 1. What is the right to know? </a> </h4> </div> <div id="collapse1c" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1c"> <div class="panel-body"> <p>You may request that businesses disclose to you what personal information they have collected, used, shared, or sold about you, and why they collected, used, shared, or sold that information. Specifically, you may request that businesses disclose: <ul> <li>The categories of personal information collected</li> <li>Specific pieces of personal information collected</li> <li>The categories of sources from which the business collected personal information</li> <li>The purposes for which the business uses the personal information</li> <li>The categories of third parties with whom the business shares the personal information</li> <li>The categories of information that the business sells or discloses to third parties</li> </ul> </p> <p>Businesses must provide you this information for the 12-month period preceding your request. They must provide this information to you free of charge.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse2c" aria-expanded="true" aria-controls="collapse2c"> 2. How do I submit my request to know? </a> </h4> </div> <div id="collapse2c" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2c"> <div class="panel-body"> <p>Businesses must designate at least two methods for you to submit your request—for example, an email address, website form, or hard copy form. One of those methods has to be a toll-free phone number and, if the business has a website, one of those methods has to be through its website. However, if a business operates exclusively online, it only needs to provide an email address for submitting requests to know.</p> <p>Businesses cannot make you create an account just to submit a request to know, but if you already have an account with the business, it may require you to submit your request through that account.</p> <p>Make sure you submit your request to know through one of the business’s designated methods, which may be different from its normal customer service contact information. If you can’t find a business’s designated methods, review its privacy policy, which must include instructions on how you can submit your request.</p> <p>If a business’s designated method of submitting requests to know is not working, notify the business in writing and consider submitting your request through another designated method if possible.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse3c" aria-expanded="true" aria-controls="collapse3c"> 3. How long does the business have to respond to my request to know? </a> </h4> </div> <div id="collapse3c" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3c"> <div class="panel-body"> <p>Businesses must respond to your request within 45 calendar days. They can extend that deadline by another 45 days (90 days total) if they notify you.</p> <p>If you submitted a request to know and have not received any response within the timeline, check the business’s privacy policy to make sure you submitted your request through the designated way. Follow up with the business to see if the business is subject to the CCPA and to follow up on your request.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse4c" aria-expanded="true" aria-controls="collapse4c"> 4. Why is the business asking me for more information? </a> </h4> </div> <div id="collapse4c" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4c"> <div class="panel-body"> <p>Businesses must verify that the person making a request to know is the consumer about whom the business has personal information. Businesses may need to ask you for additional information for verification purposes. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading5c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse5c" aria-expanded="true" aria-controls="collapse5c"> 5. Why did the business deny my request to know? </a> </h4> </div> <div id="collapse5c" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading5c"> <div class="panel-body"> <p>There are some exceptions to the right to know. Common reasons why businesses may refuse to disclose your personal information include: <ul> <li>The business cannot verify your request</li> <li>The request is manifestly unfounded or excessive, or the business has already provided personal information to you more than twice in a 12-month period</li> <li>Businesses cannot disclose certain sensitive information, such as your social security number, financial account number, or account passwords, but they must tell you if they’re collecting that type of information</li> <li>Disclosure would restrict the business’s ability to comply with legal obligations, exercise legal claims or rights, or defend legal claims</li> <li>If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA</li> </ul> </p> <p>See <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.145." target="_blank">Civil Code section 1798.145</a> for more exceptions.</p> <p>If you do not know why a business denied your request to know, follow up with the business to ask it for its reasons.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading6c"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqc" href="#collapse6c" aria-expanded="true" aria-controls="collapse6c"> 6. Why did I get a response that the business is a service provider that does not have to act on my request? </a> </h4> </div> <div id="collapse6c" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading6c"> <div class="panel-body"> <p>Many businesses use other businesses to provide services for them. For example, a retailer may contract with a payment card processor to process customer credit card transactions or a shipping company to deliver orders. These entities may qualify as “service providers” under the CCPA.</p> <p>The CCPA treats service providers differently than the businesses they serve. It is the business that is responsible for responding to consumer requests. If you submit a request to know to a service provider of a business instead of the business itself, the service provider may deny the request. You must submit your request to the business itself.</p> <p>If a service provider has said that it does not or cannot act on your request because it is a service provider, you may follow up to ask who the business is. However, sometimes the service provider will not be able to provide that information. You may be able to determine who the business is based on the services that the service provider provides, although sometimes this may be difficult or impossible.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectiond">D. REQUESTS TO DELETE</h3> <div class="panel-group" id="ccpafaqd" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse1d" aria-expanded="true" aria-controls="collapse1d"> 1. What is my right to delete personal information? </a> </h4> </div> <div id="collapse1d" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1d"> <div class="panel-body"> <p>You may request that businesses delete personal information they collected from you and to tell their service providers to do the same. However, there are <a href="#heading5d">many exceptions</a> (see FAQ D.5) that allow businesses to keep your personal information.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse2d" aria-expanded="true" aria-controls="collapse2d"> 2. How do I submit my right to delete? </a> </h4> </div> <div id="collapse2d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2d"> <div class="panel-body"> <p>Review the business’s privacy policy, which must include instructions on how you can submit your request to delete.</p> <p>Businesses must designate at least two methods for you to submit your request—for example, a toll-free number, email address, website form, or hard copy form. However, if a business operates exclusively online, it only needs to provide an email address for submitting requests.</p> <p>Businesses cannot make you create an account just to submit a deletion request, but if you already have an account with the business, it may require you to submit your request through that account.</p> <p>Make sure you submit your deletion request through one of the business’s designated methods, which may be different from its normal customer service contact information.</p> <p>If a business’s designated method of submitting requests to delete is not working, notify the business in writing and consider submitting your request through another designated method if possible.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse3d" aria-expanded="true" aria-controls="collapse3d"> 3. How long does the business have to respond to my request to delete? </a> </h4> </div> <div id="collapse3d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3d"> <div class="panel-body"> <p>Businesses must respond to your request within 45 calendar days. They can extend that deadline by another 45 days (90 days total) if they notify you. </p> <p>If you submitted a request to delete and have not received any response within the timeline, check the business’s privacy policy to make sure you submitted your request through the designated way. Follow up with the business to see if the business is subject to the CCPA and to follow up on your request.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse4d" aria-expanded="true" aria-controls="collapse4d"> 4. Why is the business asking me for more information? </a> </h4> </div> <div id="collapse4d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4d"> <div class="panel-body"> <p>Businesses must verify that the person making a request to delete is the consumer about whom the business has personal information. Businesses may need to ask you for additional information for verification purposes. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading5d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse5d" aria-expanded="true" aria-controls="collapse5d"> 5. Why did the business deny my request to delete? </a> </h4> </div> <div id="collapse5d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading5d"> <div class="panel-body"> <p>There are exceptions to the right to delete. Common reasons why businesses may keep your personal information include: <ul> <li>If the information is exempt from the CCPA. This includes: <ul> <li><strong>Publicly available information (such as your address, which is often in public real estate/property records)</strong>. However, if you are a law enforcement officer, public official, or Safe at Home participant (available to victims of domestic violence, stalking, sexual assault, human trafficking, elder and dependent abuse, as well as reproductive health workers), you may request a website to not publicly post your address as described <a href="/privacy/special-protection">here</a>.</li> <li><strong>Certain <a href="#heading4">types of information</a></strong> such as medical information or consumer credit reporting information.</li> </ul> </li> <li>The business cannot verify your request</li> <li>To complete your transaction, provide a reasonably anticipated product or service, or for certain warranty and product recall purposes</li> <li>For certain business security practices</li> <li>For certain internal uses that are compatible with reasonable consumer expectations or the context in which the information was provided</li> <li>To comply with legal obligations, exercise legal claims or rights, or defend legal claims</li> <li>If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA</li> </ul> </p> <p>See <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.105." target="_blank">Civil Code sections 1798.105(d)</a> and <a href="https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.145." target="_blank">1798.145</a> for more exceptions.</p> <p>If you do not know why a business denied your request to delete, follow up with the business to ask it for its reasons.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading6d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse6d" aria-expanded="true" aria-controls="collapse6d"> 6. Why did I get a response that the business is a service provider that does not have to act on my request? </a> </h4> </div> <div id="collapse6d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading6d"> <div class="panel-body"> <p>Many businesses use other businesses to provide services for them. For example, a retailer may contract with a payment card processor to process customer credit card transactions or a shipping company to deliver orders. These entities may qualify as “service providers” under the CCPA.</p> <p>The CCPA treats service providers differently than the businesses they serve. It is the business that is responsible for responding to consumer requests. If you submit a request to delete to a service provider of a business instead of the business itself, the service provider may deny the request. You must submit your request to the business itself.</p> <p>If a service provider has said that it does not or cannot act on your request because it is a service provider, you may follow up to ask who the business is. However, sometimes the service provider will not be able to provide that information. You may be able to determine who the business is based on the services that the service provider provides, although sometimes this may be difficult or impossible.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading7d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse7d" aria-expanded="true" aria-controls="collapse7d"> 7. Why is a debt collector still calling me about my debt even though I asked it to delete my information? </a> </h4> </div> <div id="collapse7d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading7d"> <div class="panel-body"> <p>Creditors, collection agencies, and other debt collectors can still try to collect debts that you owe even if you asked them to delete your personal information. Learn more about debt collectors—including what they can and can’t do—<a href="/consumers/general/debt-collectors">here</a>.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading8d"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse8d" aria-expanded="true" aria-controls="collapse8d"> 8. Why is a credit reporting agency still giving out my credit information even though I asked it to delete my information? </a> </h4> </div> <div id="collapse8d" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading8d"> <div class="panel-body"> <p>Credit reporting agencies like Equifax, Experian, and TransUnion can still collect and disclose your credit information, subject to regulation under the <a href="https://uscode.house.gov/view.xhtml?req=granuleid%3AUSC-prelim-title15-chapter41-subchapter3&edition=prelim" target="_blank">Fair Credit Reporting Act</a>. Learn more about your rights under the Fair Credit Reporting Act <a href="https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf" target="_blank">here</a>. Learn more about how to check and fix your credit report <a href="/consumers/general/credit-scores-credit-reports">here</a>.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectione">E. REQUESTS TO CORRECT (RIGHT TO CORRECT) </h3> <div class="panel-group" id="ccpafaqe" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1e"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqe" href="#collapse1e" aria-expanded="true" aria-controls="collapse1e"> 1. What is the right to correct? </a> </h4> </div> <div id="collapse1e" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1e"> <div class="panel-body"> <p>You may ask businesses to correct inaccurate information that they have about you.</p> <p>The California Privacy Protection Agency is currently engaged in a formal rulemaking process and has <a href="https://cppa.ca.gov/regulations/consumer_privacy_act.html" target="_blank">proposed CCPA regulations pertaining to the right to correct</a>, but these are not currently final or effective. </p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2e"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqe" href="#collapse2e" aria-expanded="true" aria-controls="collapse2e"> 2. How do I submit my request to correct? </a> </h4> </div> <div id="collapse2e" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2e"> <div class="panel-body"> <p>Review the business’s privacy policy, which should include instructions on how you can submit your request to correct.</p> <p>Businesses must designate at least two methods for you to submit your request—for example, a toll-free number, email address, website form, or hard copy form. However, if a business operates exclusively online, it only needs to provide an email address for submitting requests.</p> <p>Businesses cannot make you create an account just to submit a correction request, but if you already have an account with the business, it may require you to submit your request through that account.</p> <p>Make sure you submit your correction request through one of the business’s designated methods, which may be different from its normal customer service contact information.</p> <p>If a business’s designated method of submitting requests to correct is not working, notify the business in writing and consider submitting your request through another designated method if possible.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3e"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse3e" aria-expanded="true" aria-controls="collapse3e"> 3. How long does the business have to respond to my request to correct? </a> </h4> </div> <div id="collapse3e" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3e"> <div class="panel-body"> <p>Businesses must respond to your request within 45 calendar days. They can extend that deadline by another 45 days (90 days total) if they notify you.</p> <p>If you submitted a request to correct and have not received any response within the timeline, check the business’s privacy policy to make sure you submitted your request through the designated way. Follow up with the business to see if the business is subject to the CCPA and to follow up on your request.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4e"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse4e" aria-expanded="true" aria-controls="collapse4e"> 4. Why is the business asking me for more information? </a> </h4> </div> <div id="collapse4e" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4e"> <div class="panel-body"> <p>Businesses must verify that the person making a request to correct is the consumer about whom the business has personal information. Businesses may need to ask you for additional information for verification purposes. If the business asks for personal information to verify your identity, it can only use that information for this verification purpose.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading5e"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqd" href="#collapse5e" aria-expanded="true" aria-controls="collapse5e"> 5. Why did the business deny my request to correct? </a> </h4> </div> <div id="collapse5e" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading5e"> <div class="panel-body"> <p>There are exceptions to the right to correct. Common reasons why businesses may deny your request to correct include: <ul> <li>The business cannot verify your identity to complete your request</li> <li>The request is manifestly unfounded or excessive</li> <li>The information is publicly available information, certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA</li> </ul> </p> <p>If you do not know why a business denied your request to correct, follow up with the business to ask it for its reasons.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectionf">F. REQUESTS TO LIMIT USE OF PERSONAL INFORMATION (RIGHT TO LIMIT)</h3> <div class="panel-group" id="ccpafaqf" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1f"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqf" href="#collapse1f" aria-expanded="true" aria-controls="collapse1f"> 1. What is the right to limit? </a> </h4> </div> <div id="collapse1f" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1f"> <div class="panel-body"> <p>You can direct businesses to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested.</p> <p>The California Privacy Protection Agency is currently engaged in a formal rulemaking process and has <a href="https://cppa.ca.gov/regulations/consumer_privacy_act.html" target="_blank">proposed CCPA regulations pertaining to the right to limit</a>, but these are not currently final or effective.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectiong">G. RIGHT TO NON-DISCRIMINATION</h3> <div class="panel-group" id="ccpafaqg" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-body"> <p>Businesses cannot deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA.</p> <p>However, if you refuse to provide your personal information to a business or ask it to delete or stop selling your personal information, and that personal information or sale is necessary for the business to provide you with goods or services, the business may not be able to complete that transaction.</p> <p>Businesses can also offer you promotions, discounts and other deals in exchange for collecting, keeping, or selling your personal information. But they can only do this if the financial incentive offered is reasonably related to the value of your personal information. If you ask a business to delete or stop selling your personal information, you may not be able to continue participating in the special deals they offer in exchange for personal information. If you are not sure how your request may affect your participation in a special offer, ask the business.</p> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectionh">H. REQUIRED NOTICES</h3> <div class="panel-group" id="ccpafaqh" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1h"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqh" href="#collapse1h" aria-expanded="true" aria-controls="collapse1h"> 1. What is a notice at collection? </a> </h4> </div> <div id="collapse1h" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1h"> <div class="panel-body"> <p>The CCPA requires businesses to give consumers certain information in a “notice at collection.” A notice at collection must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information. (To find out how you can learn what specific information a business has collected about you, see the <a href="#sectionc">Right to Know section</a>.) If the business sells consumers’ personal information, then the notice at collection must include a <a href="#sectionb">Do Not Sell or Share link</a>. The notice must also contain a link to the business’s privacy policy, where consumers can get a fuller description of the business’s privacy practices and of their privacy rights.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2h"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqh" href="#collapse2h" aria-expanded="true" aria-controls="collapse2h"> 2. Where can I find a business’s notice at collection? </a> </h4> </div> <div id="collapse2h" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2h"> <div class="panel-body"> <p>This notice must be provided <em>at or before</em> the point at which the business collects your personal information. For example, you might find a link to the notice at collection on a website’s homepage and on a webpage where you place an order or enter your personal information for another reason. On a mobile app, you might find a link to the notice in the settings menu. In a retail store, you might find the notice on a printed form used to collect your personal information.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3h"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqh" href="#collapse3h" aria-expanded="true" aria-controls="collapse3h"> 3. What is a privacy policy? </a> </h4> </div> <div id="collapse3h" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3h"> <div class="panel-body"> <p>A business’s privacy policy is a written statement that gives a broad picture of its online and offline practices for the collection, use, sharing, and sale of consumers’ personal information. The CCPA requires business privacy policies to include information on consumers’ privacy rights and how to exercise them: the <a href="#sectionc">Right to Know</a>, the <a href="#sectione">Right to Delete</a>, the <a href="#sectionb">Right to Opt-Out of Sale</a>, the <a href="#sectione">the Right to Correct</a>, the <a href="#sectionf">the Right to Limit</a>, and the <a href="#sectiong">Right to Non-Discrimination</a>.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading4h"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqh" href="#collapse4h" aria-expanded="true" aria-controls="collapse4h"> 4. Where can I find a business’s privacy policy? </a> </h4> </div> <div id="collapse4h" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading4h"> <div class="panel-body"> <p>Most businesses post their privacy policy on their websites. A link to it can usually be found at the bottom of the homepage and other webpages. The link’s title may include “Privacy” or “California Privacy Rights.” In a mobile app, the privacy policy may be linked on the download page for the app or in the app’s settings menu.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectioni">I. DATA BROKERS AND THE CCPA</h3> <div class="panel-group" id="ccpafaqi" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading1i"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqi" href="#collapse1i" aria-expanded="true" aria-controls="collapse1i"> 1. What is a data broker? </a> </h4> </div> <div id="collapse1i" class="panel-collapse collapse in" role="tabpanel" aria-labelledby="heading1i"> <div class="panel-body"> <p>Another California law, <a href="http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.48.&part=4.&chapter=&article=" target="_blank">Civil Code section 1798.99.80</a>, defines a data broker as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” This law exempts certain businesses that are regulated by other laws from this definition. Exempted businesses include consumer reporting agencies (commonly known as credit bureaus) and certain financial institutions and insurance companies.</p> <p>Data brokers collect information about consumers from many sources including websites, other businesses, and public records. The data broker analyzes and packages the data for sale to other businesses.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading2i"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqi" href="#collapse2i" aria-expanded="true" aria-controls="collapse2i"> 2. How can I find data brokers that collect and sell my personal information? </a> </h4> </div> <div id="collapse2i" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading2i"> <div class="panel-body"> <p>The <a href="http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.48.&part=4.&chapter=&article=" target="_blank">California law on data brokers</a> requires data brokers covered by the law to register with the Attorney General and to provide certain information on their practices. The Data Broker Registry can be found on the Attorney General’s website at <a href="https://oag.ca.gov/data-brokers">https://oag.ca.gov/data-brokers</a>.</p> <p>Data brokers are subject to the CCPA. On the Data Broker Registry website, you will find contact information and a website link for each registered data broker, as well as additional information to help you exercise your CCPA rights.</p> </div> </div> </div> <div class="panel panel-default"> <div class="panel-heading" role="tab" id="heading3i"> <h4 class="panel-title"> <a role="button" data-toggle="collapse" data-parent="#ccpafaqi" href="#collapse3i" aria-expanded="true" aria-controls="collapse3g"> 3. How can I stop a data broker from selling my personal information? </a> </h4> </div> <div id="collapse3i" class="panel-collapse collapse" role="tabpanel" aria-labelledby="heading3i"> <div class="panel-body"> <p>You can click on the “View Full Submission” link on the <a href="/data-brokers">Data Broker Registry</a> to get instructions on how to opt-out of the sale of your personal information. However, you may not be able to stop the sale of all of your information. The CCPA’s definition of “personal information” does not include information lawfully made available from government records, which are often sources used by data brokers.</p> <p>You can also go to a data broker’s website through the link posted on the Registry and find the broker’s privacy policy to learn more about its privacy practices and how to exercise your CCPA rights.</p> </div> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> <h3 id="sectionother">Other Consumer Resources on CCPA</h3> <div class="panel-group" id="ccpafaqo" role="tablist" aria-multiselectable="true"> <div class="panel panel-default"> <div class="panel-body"> <p>California Privacy Protection Agency’s FAQ on the CCPA</p> <p><a href="https://www.consumer-action.org/modules/module-ccpa-privacy" target="_blank">Consumer-Action.org</a> <ul> <li><a href="https://www.consumer-action.org/modules/articles/CCPA-Privacy-Rights" target="_blank">Take action! Exercise your rights under the California Consumer Privacy Act</a></li> </ul> </p> </div> </div> </div> <p class="pull-right" style="margin-bottom: 0px;"><a href="#top" title="Back to the top of the page">Back To Top</a></p><br /><hr> </div></div></div> </div> </div> </div> </div> </div>    </section> <aside class="col-sm-3" role="complementary"> <div class="region region-sidebar-second"> <div id="block-block-427" class="block block-block"> <div class="content"> <style> #subscribe-ccpa.panel-title { font-size: 1.2em; font-weight: normal; } .sidelinks li:last-child { margin-bottom: -1em; } .sidelinks a { width: 220px; border: 1px solid; margin-left: -1.3em; font-size: 0.8em !important; } </style> <h4>California Consumer Privacy Act (CCPA)</h4> <ul class="nav-list"> <li><a href="/privacy/ccpa">California Consumer Privacy Act (CCPA) Home</a></li>  <li><a href="/privacy/ccpa/enforcement">CCPA Enforcement Case Examples</a></li> <li><a href="/report">File a Complaint</a></li>  <li><a href="/privacy/ccpa/regs">CCPA Regulations</a></li> <li><a href="/privacy/ccpa/icons-download">CCPA Opt-Out Icon</a></li> <li><a href="/privacy/ccpa/prelim">Preliminary Rulemaking Activities</a></li>  </ul>  </div> </div><div id="block-block-258" class="block block-block"> <div class="content"> <h3>Privacy and Data Security</h3> <div class="CS"> <ul class="CSList"> <li><a href="/privacy">Privacy and Data Security Home</a></li> <li><a href="/privacy/business-privacy">Business Privacy Resources</a></li> <li><a href="/privacy/ccpa">California Consumer Privacy Act</a></li> <li><a href="/privacy/consumer-privacy-resources">Consumer Privacy Resources</a></li> <li><a href="/ecrime/databreach/list">Data Breaches</a></li> <li><a href="/idtheft">Identity Theft</a></li>  <li><a href="/privacy/privacy-enforcement-actions">Privacy Enforcement Actions</a></li> <li><a href="/privacy/privacy-reports">Report a Breach</a></li> <li><a href="/cybersafety/children">Protecting Children Online</a></li> <li><a href="/privacy/law-enforcement">Resources for Law Enforcement</a></li> <li><a href="/privacy/special-protection">Special Protection</a></li> </ul> </div> <h3>Data Brokers</h3> <div class="CS"> <ul class="CSList"> <li><a href="/data-brokers">Data Broker Listing</a></li> </ul> </div>  </div> </div> </div> </aside>  </div> </div> <footer class="footer container"> <div class="region region-footer"> <div id="block-block-373" class="block block-block"> <div class="content"> <div class="row hidden-print"> <div class="container sect-separator"> <div class="col-xs-12 col-md-1"> <img class="footer-seal" src="/sites/default/themes/custom2017/oag2017/img/seal.png" alt="State of California Department of Justice - Office of the Attorney General" /> </div> <div class="col-xs-12 col-md-5"> <div class="office">State of California Department of Justice <br> Office of the Attorney General</div> </div> <div class="col-xs-12 col-md-6"> <div class="form-group"> <form action="/search-results/" accept-charset="utf-8"> <div class="input-group"> <label class="sr-only" for="query-footer">Search</label> <input class="form-control form-search" name="query" type="text" id="query-footer"> <span class="input-group-btn"> <button class="btn btn-default form-submit" type="submit">Search</button> </span> </div> </form> </div> </div> </div> </div> <div class="row hidden-print"> <div class="container sect-separator">  <div class="col-xs-12 col-md-3"> <p class="heading"><a href="/office"> WHO WE ARE </a></p> <ul class="nav"> <li><a href="/about">About AG Rob Bonta</a></li> <li><a href="/history">History of the Office</a></li> <li><a href="/careers/aboutus">Organization of the Office</a></li> </ul> <p class="heading">WHAT WE DO</p> <ul class="nav"> <li><a href="/careers/aboutus/psle">Public Safety</a></li> <li><a href="/opinions">Opinions and Quo Warranto</a></li> <li><a href="/research">Research</a></li> <li><a href="/children-seniors">Children & Families</a></li> <li><a href="/civil">Civil Rights</a></li> <li><a href="/consumers">Consumer Protection</a></li> <li><a href="/environment">Environment & Public Health</a></li> <li><a href="/grant-opportunities">Grant Opportunities</a></li> <li><a href="/tobacco/directory">Tobacco Directory</a></li> <li><a href="/tobaccogrants">Tobacco Grants</a></li> </ul> </div> <div class="clearfix visible-sm"></div> <div class="col-xs-12 col-md-3">  <p class="heading"><a href="/government">OPEN GOVERNMENT</a></p> <ul class="nav"> <li><a href="/initiatives">Ballot Initiatives</a></li> <li><a href="/conflict-interest">Conflicts of Interest</a></li> <li><a href="/cjsc/aboutcjsc">Criminal Justice Statistics</a></li> <li><a href="/meetings">Meetings and Public Notices</a></li> <li><a href="https://openjustice.doj.ca.gov/">OpenJustice Initiative</a></li> <li><a href="/consumers/general/pra">Public Records</a></li> <li><a href="/publications">Publications</a></li> <li><a href="/regulations">Regulations</a></li> </ul> <p class="heading">Memorial</p> <ul class="nav"> <li><a href="/memorial">Agents Fallen in the Line of Duty</a></li> </ul> <p class="heading">Vote</p> <ul class="nav"> <li><a href="http://registertovote.ca.gov/" target="_blank">Register to Vote</a></li> </ul> </div> <div class="col-xs-12 col-md-3"> <p class="heading">WHAT WE'RE WORKING ON</p> <ul class="nav"> <li><a href="/21st-century-policing">21st Century Policing</a></li> <li><a href="/bcj">Children’s Rights</a></li> <li><a href="/economic">Consumer Protection and Economic Opportunity</a></li> <li><a href="/environment">Environmental Justice</a></li> <li><a href="/equality">Equality</a></li> <li><a href="/health-care">Health Care</a></li> <li><a href="/immigrant">Immigration</a></li> <li><a href="https://openjustice.doj.ca.gov/" target="_blank">OpenJustice</a></li> </ul>  </div> <div class="col-xs-12 col-md-3"> <p class="heading"><a href="/media">MEDIA </a></p> <ul class="nav"> <li><a href="/consumers/alerts">Consumer Alerts</a></li> <li><a href="/media/news">Press Releases</a></li> <li><a href="/media/library">Media Library</a></li> </ul> <p class="heading"><a href="/careers">CAREERS</a></p> <ul class="nav"> <li><a href="/careers/civil">Getting a State Job</a></li> <li><a href="/careers/exams">Examinations</a></li> <li><a href="/careers/job-vacancies">Job Vacancies</a></li> <li><a href="/careers/students">Internships & Student Positions</a></li> <li><a href="/careers/honors/introduction">Attorney General's Honors Program</a></li> <li><a href="/careers/osg-fellowship" class="sub two-line">Geoffrey Wright Solicitor General Fellowship</a></li> </ul> </div> </div> </div> <div class="row"> <div class="container"> <div class="col-xs-12"> <ul class="list-inline"> <li><a href="https://oag.ca.gov/">Office of the Attorney General</a></li> <li><a href="/accessibility">Accessibility</a></li> <li><a href="/privacy-policy">Privacy Policy</a></li> <li><a href="/conditions">Conditions of Use</a></li> <li><a href="/disclaimer">Disclaimer</a></li> <li>© 2024 DOJ</li> </ul> </div> </div> </div> </div> </div><div id="block-block-418" class="block block-block"> <div class="content"> <script type="text/javascript"> jQuery(document).ready(function() { findEle = jQuery('.breadcrumb').find('li:first-child').text(); if (findEle == '') { jQuery('.breadcrumb').hide(); } }); </script> </div> </div> </div> </footer> <script src="https://oag.ca.gov/sites/default/themes/contrib/bootstrap/js/bootstrap.js?sn7qdx"></script> </body> </html>

CINXE.COM

California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General