US CPRA Consumer Rights Workflow

At intake, record the request exactly as received, including a request sent through a non-designated channel. An exclusively online business with a direct relationship to the consumer may designate email for delete, correct, and know requests. Other businesses must provide at least two methods, including a toll-free number, and a website method if they maintain a website. If a request is deficient for a reason unrelated to verification, treat it as submitted or tell the consumer how to cure it.

For delete, correct, and know requests, acknowledge receipt within 10 business days and explain the verification process and expected response date. The 45-calendar-day response clock starts on receipt, not after verification. When necessary, the business may extend once for up to 45 additional calendar days, but it must notify the consumer and explain the delay within the first period.

Verify from information already maintained whenever possible. Match the method to the sensitivity of the information, the harm from unauthorized deletion, correction, or disclosure, fraud risk, and the reliability of the data points. Reauthenticate a password-protected account before deleting, correcting, or disclosing data. For non-account holders, a categories request requires a reasonable degree of certainty; a request for specific pieces requires a reasonably high degree. Verify a correction request using information other than the disputed field. Delete newly collected verification data as soon as practical after the request, except for required request records.

Do not verify an opt-out, limit, or, once applicable, ADMT opt-out request. Ask only for information needed to apply the choice and do not require an account. A valid opt-out preference signal such as Global Privacy Control applies to the browser or device and, when the business knows the consumer, to the associated consumer. Complete sale or sharing opt-outs and limit requests as soon as feasibly possible and no later than 15 business days, notify affected recipients for the regulatory interval, and provide a way for the consumer to confirm completion where required.

Add the automated decisionmaking technology (ADMT) branches when the business uses ADMT to make a significant decision that provides or denies financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Advertising alone is not a significant decision under this definition. Covered uses that began before January 1, 2027, must comply with Article 11 by January 1, 2027. The workflow then needs pre-use notice and access paths, plus either an opt-out path or an applicable exception such as a qualifying human appeal, in addition to the established CCPA rights.

The record should let a reviewer reconstruct the request without storing more identity material than verification requires. Separate intake, scope, right, verification, system search, legal exception, downstream action, response, and closure. The required 24-month ticket or log must include the request date, nature, submission method, response date, response nature, and denial basis; the additional fields below make the operational result testable.

Use one parent case with right-specific child actions when a consumer asserts several rights. This prevents a delete exception from being copied into an opt-out decision or a 45-day request clock from being applied to a 15-business-day opt-out.

Review the workflow when a request misses its clock, a system or recipient is omitted, a correction is overwritten, verification collects unnecessary data, an opt-out preference signal fails, or similar requests produce inconsistent results. Re-test after material changes to products, identity systems, data stores, retention schedules, contracts, sale or sharing flows, sensitive-personal-information uses, ADMT, or the CCPA regulations.

Run a sample request for each right through production-like systems. Include a logged-out Global Privacy Control signal, an account holder, a non-account holder seeking specific pieces, a partial deletion with a backup copy, a correction fed by a data broker, an authorized agent, and a request that reaches a service provider or contractor. Confirm that the public privacy policy, support scripts, system behavior, downstream instructions, and retained ticket tell the same story.