US-California

What rights do I have under the California Consumer Privacy Act (CCPA)?

12 months

Lookback period

$7,500

Max civil penalty

45 days

Response deadline

$100–$750

Statutory damages

The Short Answer

Under the CCPA, you have the right to know what personal information a business collects about you, to delete that information, to opt out of its sale, and to non-discrimination for exercising these rights.

What the Law Says

The California Consumer Privacy Act (CCPA) gives California residents enforceable rights over their personal information held by businesses. It applies to for-profit entities that meet certain thresholds and collect personal data from California consumers.

You have the right to know what categories and specific pieces of personal information a business has collected about you, including sources, purposes, and third-party disclosures — covering the prior 12 months.

You may request deletion of your personal information, and the business must comply unless an exception applies (e.g., completing a transaction or complying with legal obligations).

You have the right to opt out of the 'sale' of your personal information — defined broadly as exchanging it for monetary or other valuable consideration — and businesses must honor this via a 'Do Not Sell My Personal Information' link on their homepage.

Businesses cannot discriminate against you (e.g., deny goods, charge different prices) for exercising your CCPA rights, though they may offer financial incentives if clearly disclosed and opt-in consented.

Businesses must respond to verified consumer requests within 45 days (with one 45-day extension permitted if reasonably necessary), and must provide at least two methods to submit requests (e.g., toll-free number and website).

Statutory Text
A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.
— Cal. Civ. Code § 1798.105(a) — Right to deletion

Statutory Text
A consumer shall have the right to know… what personal information it has collected about that consumer.
— Cal. Civ. Code § 1798.100(a) — Right to know

Statutory Text
A consumer shall have the right to opt out of the sale of the consumer’s personal information.
— Cal. Civ. Code § 1798.120(a) — Right to opt out of sale

Statutory Text
A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights…
— Cal. Civ. Code § 1798.125(a)(1) — Non-discrimination

What to Do

Submit a verifiable consumer request to the business (via phone, email, web form, or mail) specifying which right(s) you’re exercising.

If requesting deletion or opt-out, confirm your identity using information the business already holds (e.g., account login or government ID).

Keep records of your request and the business’s response — including dates and confirmation numbers.

If the business fails to respond within 45 days or denies your request without valid exemption, you may file a complaint with the California Privacy Protection Agency (CPPA) or, in limited cases, sue for statutory damages.

Sources

statuteCal. Civ. Code § 1798.100 — Right to know statuteCal. Civ. Code § 1798.105 — Right to deletion statuteCal. Civ. Code § 1798.120 — Right to opt out of sale statuteCal. Civ. Code § 1798.125 — Non-discrimination

Same Question, Other Jurisdictions

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.