California consumers have powerful privacy rights, but they do not apply to every company and they do not require every request to be granted. Here is how to make a request that is complete, verifiable and trackable.
Start With the Right Company
The CCPA does not apply to every organization. It generally covers for-profit businesses doing business in California that meet one of the statutory thresholds, subject to exemptions. Government agencies and many nonprofits are outside the CCPA's ordinary scope.
That distinction matters. A privacy request sent to a business that is not covered by the CCPA does not become enforceable merely because the request cites "CCPA/CPRA."
What You Can Ask For
Depending on the business and the circumstances, California consumers can exercise rights that include:
- Right to Know: request information about the personal information collected, used, disclosed or sold and, subject to the law's limits, access to the information.
- Right to Delete: request deletion of personal information, subject to statutory exceptions.
- Right to Opt-Out: tell a business to stop selling or sharing personal information.
- Right to Correct: ask a business to correct inaccurate personal information.
- Right to Limit: limit certain uses and disclosures of sensitive personal information.
The 45-Day Response Period Is Real — But It Can Become 90 Days
Under the current California regulations, a business must respond to requests to know and delete no later than 45 calendar days after receipt. Where necessary, it can take up to one additional 45-day period — a maximum of 90 calendar days — if it gives the required notice and explanation.
Current regulations also require a business to confirm receipt of a request within 10 business days and explain, in general terms, how it will process the request and when the consumer should expect a response.
The 45-day period starts when the business receives the request, regardless of how long identity verification takes.
Write the Request So Verification Does Not Become the Whole Dispute
- Use the business's designated privacy-request method.
- Identify the account or information category involved.
- State exactly which right you are exercising.
- Provide only the information reasonably needed for verification.
- Save the submission date and confirmation.
A business can deny or limit a request where verification fails or where a statutory exception applies. A deletion request is not a guaranteed command to erase every record in every system.
Authorized Agents Can Submit Requests — But They Do Not Eliminate Verification
California allows consumers to use an authorized agent. A business may require evidence that the agent was authorized, and it may require the consumer to verify identity directly or confirm the authorization.
This makes authorized-agent workflows useful for structured or repeated requests, but it is inaccurate to promise that an agent can automatically force any company to delete a person's data without verification or without regard to statutory exceptions.
Precise Geolocation Is Sensitive Personal Information
California treats precise geolocation as sensitive personal information. For covered businesses using or disclosing sensitive personal information for purposes outside the statutory exceptions, the consumer can have a right to limit those uses and disclosures.
Do not confuse that right with the separate right to opt out of sale or sharing. The two rights address different processing activities and can have different compliance requirements.
What if the Business Refuses?
Read the business's response and identify the stated exception or verification problem. If the business is covered and you believe it is not honoring the CCPA, the California Privacy Protection Agency accepts consumer complaints.
Keep the original request, the acknowledgement, the substantive response and the dates. Your evidence should show exactly what was requested and how the business responded.
What This Means Practically
- Confirm that the business is actually subject to the CCPA.
- Use the correct privacy-request channel.
- Track the 45-day deadline and any valid extension notice.
- Use an authorized agent when useful, but expect verification and proof of authority.
- Separate deletion, access, opt-out and sensitive-information rights.
Sources
- California Privacy Protection Agency — CCPA regulations effective January 1, 2026. cppa.ca.gov
- California Attorney General — California Consumer Privacy Act (CCPA) consumer FAQ. oag.ca.gov
- California Privacy Protection Agency — Consumer privacy rights and complaints. cppa.ca.gov