In Brief: Your rights under the California Consumer Privacy Act

The California Consumer Privacy Act (CCPA) gives residents important rights regarding the personal information that businesses collect about them. This condensed version of our full-length CCPA guide provides an overview of your rights as of Jan. 1, 2023.

The CCPA gives residents important rights regarding the personal information that businesses collect about them. This is a summary of those rights as of January 2023. (For a more detailed guide, go online to Consumer Action or Consumer Federation of America.)

Why your privacy rights are important

Companies sometimes need your personal information for business purposes—for example, to bill you and ship your order. The personal information you provide for one reason, however, may also be used for other purposes, and a lot of information about you and your household can be collected without your knowledge, from you (directly or indirectly) or from other sources.

Your information may be used to create a personal profile that helps advertisers target you with ads. This can result in unwelcome, and even unfair, messaging and offers. Law enforcement or government agencies could access the data. And, the collection of personal data could put you at an increased risk of identity theft.

Exercising your rights to limit the data businesses can use, store and share with others can help protect you from harmful uses of your personal information.

Who and what the CCPA covers

The CCPA applies to companies that do business in California and that:

• Have an annual gross revenue of more than $25 million;
• Buy, sell or share the personal information of 100,000 or more California residents per year; or
• Make at least half of their annual revenue from selling or sharing California residents’ personal information (this includes all data brokers).

This means that many small businesses are not covered by the law. Generally, it does not apply to non-profit organizations, and it does not apply to government agencies at all. You may not be sure if a company is covered, but law enforcement agencies can determine that.

Personal information includes your name, address, email, age and gender; ID and account numbers; login credentials; contents of messages not intended for the business; health/medical information and genetic data; and things like sexual orientation, religious affiliation, race or ethnic origin, and union membership. It also includes the address of the browser you use to connect to the internet and information about your searches, the websites you visit and the pages you view, the apps you use, and the ads you click on; location information from your smartphone and other internet-connected devices; the products or services you buy; your fingerprints, iris scans and other biometrics; your professional, educational and employment information; and other information that identifies, relates to, describes, or could reasonably be linked with you or your household.

Some of this information is considered sensitive, and you have the right to limit its use or disclosure.

Information that is “publicly available”—for example, government records, your social media posts, and information in newspapers and phone books—is not covered by the CCPA.

Your basic CCPA rights

As a California resident, you have the right to:

1) Know about a business’s privacy practices, and about your CCPA rights: Before or at the point when your personal information will be collected, the business must tell you what types of personal information are collected, for what purposes, whether the information will be sold or shared, and how long the data will be kept.

Businesses must inform you about your CCPA rights and how to exercise them. This information must be presented in simple, straightforward language, and be offered in all the languages the company normally does business in.

2) See and correct your personal information: You have the right, twice every 12 months, to ask a business to tell you (at no charge) what personal information it has about you, and whether it has sold, shared or disclosed any of it.

The business can, in some cases, ask for personal information to verify your identity, and must respond to your request within certain time limits. If it denies your request, it must explain why.

If the information the business has about you is incorrect, you have the right to ask for it to be corrected.

3) Delete (some of) your personal information: You have the right to ask a business to delete some personal information collected from you. It is only required to delete personal information that you gave it, not that it got from other sources. Furthermore, it does not have to delete information that is reasonably necessary to complete the transaction for which it was collected, or for certain other legitimate business reasons (to provide a warranty, for example).

4) Opt out of having your data sold or shared, and limit the use of your sensitive data: You have the right to ask a business that sells or shares consumers’ personal information not to sell or share yours, and to limit its use or disclosure of your sensitive personal information to only what is necessary to perform the services or provide the goods you requested.

Look for the “Do Not Sell or Share My Personal Information” link or setting online or in the app. You may see a separate link to “Limit the Use of My Sensitive Personal Information,” or a link titled “Your California Privacy Choices,” where you can exercise both rights. If you’ve opted out, the business must wait at least 12 months before asking you to opt back in.

5) Not be discriminated against for exercising your CCPA rights: Generally, businesses cannot deny goods or services, charge a higher price or provide a lower quality service because you exercised your CCPA rights, and they can’t make you waive your rights. A business can offer you financial incentives, such as discounts, if you agree to allow it to collect, keep, sell or share your data. And it can offer you a different price, rate, level or quality of goods or services if you do not, but such a trade-off must be directly related to how much your data is worth to the business.

Special protection for children

A business cannot sell or share the personal information of someone it knows is less than 16 years old unless that person agrees or, in the case of someone under age 13, a parent or legal guardian agrees.

Note that under federal law, companies that operate websites, apps and other online services directed at children under 13 cannot collect their personal information without getting parents’ permission. Learn more at the FTC website.

Exercise your rights and report violations

The Electronic Privacy Information Center provides helpful form letters for Californians to request to see and delete their data.

If you believe a business has violated the CCPA, complain to the California Attorney General (AG) or, beginning on July 1, 2023, the California Privacy Protection Agency (CPPA).

Tips for protecting your privacy

Do your due diligence. Before downloading or using an app or creating an account, understand what information the company collects about you, how it uses it and how much control you have over it. Adjust the default permissions to achieve your desired level of privacy.

Be discreet. Share the least amount of personal information needed to do what you want to do. Do not share personal information with a public audience on social media, or post sensitive information. Do not answer quizzes or enter sweepstakes, which provide valuable information to data brokers.

Limit data brokers. Data brokers that operate in California must be registered with the state. You can ask them what information they have about you and have them delete your data. Find registered data brokers.

Use technology to protect your data. Consumer Reports provides tips for some simple ways to protect your data. Consumer Federation of America explains how consumers are tracked for advertising purposes.

Learn more

Visit the AG’s CCPA webpage and the CPPA’s FAQs.

Published / Reviewed Date

Published: December 29, 2022

Download File

In Brief: Your rights under the California Consumer Privacy Act
File Name: 2023_Brief_CCPA_Privacy_Rights_EN_1.pdf
File Size: 0.49MB

Sponsors

Filed Under

Privacy Rights   ♦  

Copyright

© 2022 –2024 Consumer Action. Rights Reserved.