Right to Know
What is the Right to Know?
Under the California Consumer Privacy Act (CCPA), consumers have the right to request that businesses disclose what personal information they have collected, used, shared, or sold about them, and why they collected, used, shared, or sold that information.
What Information Can Consumers Request?
Consumers can request the following information:
- Categories of personal information collected
- Specific pieces of personal information collected
- Categories of sources from which personal information is collected
- Business or commercial purpose for collecting personal information
- Categories of third parties with whom the business shares personal information
- Categories of personal information sold or disclosed for a business purpose
How to Submit a Request
Businesses must provide at least two methods for consumers to submit requests for information, including, at minimum, a toll-free telephone number and a website address (if the business has a website).
Timeline for Response
Businesses must respond to verifiable consumer requests within 45 days of receipt. The response period may be extended once by an additional 45 days when reasonably necessary, provided the consumer is given notice of the extension within the first 45-day period.
Verification Process
Businesses must verify the identity of the consumer making the request to a reasonable degree of certainty. The level of verification should be proportional to the sensitivity of the information requested.
Business Obligations
Businesses subject to the CCPA must:
- Inform consumers of their right to request information
- Provide clear instructions on how to submit requests
- Respond to verifiable consumer requests within the required timeframe
- Provide the requested information free of charge
- Maintain records of consumer requests and responses for at least 24 months