Complete Guide to CCPA Rights

CCPA applies to: **California Residents:** - Anyone who is a California resident, even temporarily - Includes U.S. citizens, permanent residents, and undocumented residents - Applies to students, military personnel, and anyone living in CA **When You Move:** - If you move out of California, you generally lose CCPA rights - However, companies may not always verify current residence - Some companies honor requests from former residents **What Companies Must Comply:** - For-profit businesses that do business in California - Collect personal information from California residents - Meet ONE of these thresholds: - Have gross annual revenue over $25 million - Buy/sell personal information of 100,000+ consumers/households - Derive 50% or more of annual revenue from selling personal information **Does It Apply to You Outside California?** Many nationwide companies honor CCPA requests for all users, not just Californians. Always reference CCPA in your requests, even if you're not in California.

The Right to Know gives California residents the right to request that businesses disclose what personal information they collect, use, share, or sell. **What You Can Request:** - The categories of personal information collected - The categories of sources from which information is collected - The business purposes for collecting or selling information - The categories of third parties with whom information is shared - The specific pieces of personal information collected about you **How to Make a Request:** 1. Look for a "Do Not Sell My Personal Information" link on the company's website 2. Submit a request through the company's designated method 3. Verify your identity (email may be sufficient) 4. Wait for response **Response Time:** Businesses must respond within 45 days of receiving your request, extendable by another 45 days if necessary with notice. **Frequency:** You can make two requests per year per business. **Cost:** Requests must be free unless you make more than two requests in a year. **Format:** Businesses must provide information in a readily usable format that allows you to transmit the information to another entity without hindrance.

The Right to Delete gives California residents the right to request deletion of personal information held by businesses. **What Can Be Deleted:** - Personal information you provided to the business - Personal information obtained from other sources **Exceptions (When They Can Refuse):** - Necessary to complete a transaction - Detect security incidents or protect against malicious activity - Debug products/services - Exercise free speech (with appropriate safeguards) - Comply with legal obligations - Enable internal uses that are reasonably expected - Enable scientific research (in the public interest) - Enable internal uses for a homeless shelter or similar service - Comply with legal warrants/subpoenas - Make certain uses of your information within your reasonable expectations **How to Make a Request:** Use the same process as the Right to Know, but clearly state you are requesting deletion. **Response Time:** 45 days, extendable by another 45 days with notice. **Verification:** Businesses must verify your identity but cannot make the process unreasonably difficult.

The Right to Opt-Out gives California residents the right to direct businesses to not sell their personal information. **What Constitutes a "Sale":** - Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information - For monetary or other valuable consideration - Does NOT include sharing for a business purpose (different than sale) **How to Opt-Out:** 1. **Look for the "Do Not Sell or Share My Personal Information" link** - Required to be on the homepage of any business covered by CCPA - Must be a clear and conspicuous link 2. **Submit Your Opt-Out Request** - Some businesses allow you to opt-out with one click - Others require you to submit a request - You may need to verify your identity 3. **Global Opt-Out Signals** - Businesses must honor browser-based opt-out signals - Examples include Global Privacy Control (GPC) browser extensions - The signal is legally binding under CPRA amendments **Response Time:** Businesses must honor your opt-out request within 15 days for requests made via authorized agents. **Duration:** Your opt-out preference remains in effect unless you revoke it.

CCPA prohibits businesses from discriminating against you for exercising your privacy rights. **Prohibited Discrimination:** - Denying goods or services - Charging different prices or rates - Providing a different level of quality of goods or services - Suggesting you will receive a different price or rate of service **Allowed Financial Incentives:** - Businesses can offer financial incentives for your data - Must be reasonably related to the value of your data - You must be able to opt-in - You must be able to revoke consent **If You Experience Discrimination:** 1. Document the evidence 2. Submit a complaint to the California Attorney General 3. You may be entitled to statutory damages of $100-$750 per violation This right ensures that businesses cannot punish you for exercising your other CCPA rights.

**Subject: California Consumer Privacy Act (CCPA) Data Access Request - [Your Name]** To: [Company Privacy Team] Dear Sir/Madam, I am a California resident and am writing to exercise my rights under the California Consumer Privacy Act (CCPA). I request that you provide me with the following information regarding my personal data: 1. The categories of personal information you have collected about me 2. The specific pieces of personal information you have collected about me 3. The categories of sources from which my personal information is collected 4. The business or commercial purpose for collecting or selling my personal information 5. The categories of third parties with whom you share, sell, or disclose my personal information 6. The categories of personal information you have sold or disclosed for a business purpose I understand that under CCPA, you must respond to this request within 45 days of receipt. If you need additional information to verify my identity, please contact me at [Your Email Address] or [Phone Number]. Please send all information to: [Your Email Address] Sincerely, [Your Full Name] [California Address - required to verify residency] [Account Username/Email on file] [Date]

**Subject: California Consumer Privacy Act (CCPA) Deletion Request - [Your Name]** To: [Company Privacy Team] Dear Sir/Madam, I am a California resident and am writing to exercise my right to deletion under the California Consumer Privacy Act (CCPA). I request that you delete my personal information from your records, except as permitted by law. This includes all personal information you have collected about me from any source. I understand that under CCPA, you must respond to this request within 45 days of receipt. If you cannot comply with my request, please provide a detailed explanation of the reasons why under CCPA exceptions. If you need additional information to verify my identity, please contact me at [Your Email Address] or [Phone Number]. Please confirm deletion to: [Your Email Address] Sincerely, [Your Full Name] [California Address - required to verify residency] [Account Username/Email on file] [Date]

**Subject: California Consumer Privacy Act (CCPA) Do Not Sell Request - [Your Name]** To: [Company Privacy Team] Dear Sir/Madam, I am a California resident and am writing to exercise my right to opt-out of the sale of my personal information under the California Consumer Privacy Act (CCPA). Please do not sell my personal information to any third parties. Please confirm that you have processed this request and will not sell my personal information going forward. I understand that under CCPA, you must honor this request within 15 days of receipt. If you need additional information to verify my identity, please contact me at [Your Email Address] or [Phone Number]. Please confirm to: [Your Email Address] Sincerely, [Your Full Name] [California Address - required to verify residency] [Account Username/Email on file] [Date]

CCPA allows you to authorize someone else to make requests on your behalf. **Who Can Be an Authorized Agent:** - A family member - A lawyer - A privacy service (e.g., DeleteMe, Incogni) - Any person or entity you authorize in writing **Requirements:** - You must provide the agent with written authorization - The agent must submit proof of authorization to the business - The business must verify the agent's authority **When to Use an Authorized Agent:** - You want professional help navigating the process - You're using a privacy service that handles requests for you - You have a lawyer handling privacy issues - You need assistance due to disability or language barriers **How to Authorize an Agent:** "I, [Your Name], authorize [Agent Name] to act as my authorized agent for the purpose of making requests under the California Consumer Privacy Act (CCPA) on my behalf. This authorization includes the right to access, delete, and opt-out of the sale of my personal information." [Your Signature] [Date] Authorized agents can be particularly helpful if you have many requests to make across multiple businesses.