Right to Know
Under CCPA, consumers have the right to request that businesses disclose what personal information they have collected, used, shared, or sold.
What is the Right to Know?
Under the California Consumer Privacy Act (CCPA), consumers have the right to request that businesses disclose what personal information they have collected, used, shared, or sold about them, and why they collected, used, shared, or sold that information.
What Information Can Consumers Request?
Consumers can request the following information:
Categories of Information
Categories of personal information collected
Specific Pieces
Specific pieces of personal information collected
Sources
Categories of sources from which personal information is collected
Purpose
Business or commercial purpose for collecting personal information
Third Parties
Categories of third parties with whom the business shares personal information
Sold Information
Categories of personal information sold or disclosed for a business purpose
How to Submit a Request
Businesses must provide at least two methods for consumers to submit requests for information, including, at minimum, a toll-free telephone number and a website address (if the business has a website).
Pro tip: When submitting a request, be specific about what information you're seeking to ensure a complete response from the business.
Timeline for Response
Initial Response Period
Businesses must respond to verifiable consumer requests within 45 days of receipt.
Extension Period
The response period may be extended once by an additional 45 days when reasonably necessary.
Notice of Extension
The consumer must be given notice of the extension within the first 45-day period.
Verification Process
Businesses must verify the identity of the consumer making the request to a reasonable degree of certainty. The level of verification should be proportional to the sensitivity of the information requested.
Important: Businesses may ask for additional information to verify your identity, but they cannot require you to create an account just to submit a request.
Business Obligations
Businesses subject to the CCPA must:
- Inform consumers of their right to request information
- Provide clear instructions on how to submit requests
- Respond to verifiable consumer requests within the required timeframe
- Provide the requested information free of charge
- Maintain records of consumer requests and responses for at least 24 months