US CPRA Correction Rights

A California consumer may ask a covered business to correct inaccurate personal information that the business maintains. The business must use commercially reasonable efforts, taking into account the nature of the information and the purposes for which it is processed. It must confirm receipt within 10 business days and respond within 45 calendar days of receipt. If necessary, it may extend once for up to 45 additional calendar days, but it must notify the consumer and explain the delay.

Verify the consumer with information other than the field being disputed. The business may deny the request if it cannot verify the consumer or if, after considering the totality of the circumstances, the contested information is more likely than not accurate. The assessment should consider whether the information is objective or subjective, how it was obtained, why the business uses it, its effect on the consumer, and documentation from the consumer, the business, or another source. If the business is not the source and has no supporting documentation, the consumer's assertion may be enough to establish inaccuracy.

When granting the request, correct active systems, prevent later data imports from restoring the error, and instruct service providers and contractors that maintain the information to correct it and keep it corrected. A correction in an archived or backup system may wait until that system is restored, accessed, or used. A denial response should explain the basis and tell the consumer that they may submit a complaint to the CPPA or California Attorney General.

Other denial grounds require their own records. A business may deny the same alleged inaccuracy after a denial within the previous six months, or deny a request it reasonably and in good faith believes is fraudulent or abusive, but it must explain the decision. A claim of impossibility or disproportionate effort needs enough facts for the consumer to understand why compliance is not possible; a bare label is insufficient.

The business may delete instead of correct only if deletion will not harm the consumer or the consumer consents. If the business is not the source, it must either name the source to the consumer or tell the source to correct the information. A consumer can ask to confirm the correction; for sensitive identifiers such as account credentials, government identifiers, financial account numbers, health identifiers, and unique biometric data, provide a secure confirmation method rather than disclosing the value.

A denial involving personal information collected and analyzed about the consumer's health has an additional branch. The response must explain that the consumer may submit a written statement, limited to 250 words for each alleged inaccuracy, and ask for it to be added to the record. On request, the business must make that statement available to a person to whom it discloses, shares, or sells the disputed information.

Keep the request, receipt confirmation, verification steps, disputed field and proposed correction, accuracy evidence considered, decision, systems and recipients updated, response date, extension notice if any, and denial explanation. Minimize retained identity evidence and record how the business prevents an inaccurate source feed from overwriting the correction.

The request log should show the request date and method, request type, response date and type, and any denial basis for at least 24 months. If the business relies on a repeat-request, fraud, abuse, impossibility, disproportionate-effort, deletion, source-notification, or health-statement branch, retain the facts, notice, approval, and completed follow-up for that branch.

Common failures include starting the 45-day clock after verification, correcting only the customer-facing profile, allowing a later import to restore the error, demanding disproportionate verification, treating a disputed opinion as an objectively false fact without considering its nature, or denying a request without a factual explanation.