US CCPA Consumer Rights Workflow

Record the date received, channel, requested right, consumer or authorized-agent context, affected product or data flow, and the system owner. Treat a request received through an unlisted method as submitted or tell the consumer how to correct the deficiency. The 45-day clock starts on receipt, not after verification. A business may use one additional 45-day period when necessary if it tells the consumer and explains the reason, for a maximum of 90 calendar days.

Use a reasonable, documented identity-verification method for delete, correct, know, ADMT access, and ADMT appeal requests. For an account holder, use the existing account authentication when reasonable and require reauthentication before disclosure or deletion; for a non-account holder, match reliable data points and scale certainty to the sensitivity and risk. Do not require identity verification for sale-or-sharing opt-outs, sensitive-personal-information limit requests, or ADMT opt-outs. Ask only for information needed to complete those requests, and do not delay the scope that can already be honored.

For delete, correct, and know requests, search the systems and relationships covered by the applicable rule, apply any exception to the affected records rather than the whole request, and coordinate required action with service providers and contractors. A deletion record may be retained only for permitted purposes, such as preventing later sale or meeting legal duties. A correction decision should consider the nature of the information, how it was obtained, and documentation supplied by the consumer.

For sale-or-sharing opt-outs, stop the covered transfers as soon as feasibly possible and no later than 15 business days. A browser opt-out preference signal applies to that browser or device and associated profiles; if the consumer is known, it also applies to that consumer. Notify and instruct third parties that received the information in the interval between receipt and compliance as section 7026 requires.

A denial should state the request, the reason the business did not comply, and any available next step. Verification failure does not create a general license to ignore a request: the workflow should record what was matched, what additional information was requested, why the chosen verification level was reasonable, and which rule supports the result.

A request may involve an authorized agent, a household, a minor, data held only by a service provider, a conflict with a financial incentive, a request for information older than 12 months, or information that a separate law requires the business to retain. These facts change the evidence or response path; they do not justify a generic rejection. For information collected on or after January 1, 2022, a request to know can reach beyond the preceding 12 months unless doing so is impossible or would involve disproportionate effort.

For an opt-out preference signal that conflicts with an account setting allowing sale or sharing, honor the signal unless the consumer later gives compliant consent. A financial-incentive conflict follows a narrower rule: the business may ask whether the consumer intends to withdraw from the program and must apply the regulation's outcome for the consumer's response or nonresponse.

Test the workflow when collection points, identity systems, ad-tech, ADMT uses, request portals, retention rules, or vendors change. Sample completed cases by right and confirm that intake dates, business-day and calendar-day clocks, verification data, search scope, exceptions, downstream instructions, delivery controls, and consumer responses agree.

Collect only the information needed to verify or complete the request. The CPPA's enforcement advisory applies the CCPA's data-minimization principle to request handling, so a convenient intake field is not enough reason to collect it.