The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. This landmark law secures new privacy rights for California consumers, including:
- The right to know about the personal information a business collects about them and how it is used and shared;
- The right to delete personal information collected from them (with some exceptions);
- The right to opt-out of the sale or sharing of their personal information; and
- The right to non-discrimination for exercising their CCPA rights.
In November of 2020, California voters approved Proposition 24, the CPRA, which amended the CCPA and added new additional privacy protections that began on January 1, 2023. As of January 1, 2023, consumers have new rights in addition to those above, such as:
- The right to correct inaccurate personal information that a business has about them; and
- The right to limit the use and disclosure of sensitive personal information collected about them.
Businesses that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain notices explaining their privacy practices. The CCPA applies to many businesses, including data brokers.
If you believe a business has violated the CCPA, you may file a consumer complaint with the Office of the Attorney General. If you choose to file a complaint with our office, explain exactly how the business violated the CCPA, and describe when and how the violation occurred. Please note that the Attorney General cannot represent you or give you legal advice on how to resolve your individual complaint. Starting on July 1, 2023, you also will be able to file complaints with the California Privacy Protection Agency for violations of the CCPA, as amended, occurring on or after that date.
If a business’s “Do Not Sell My Personal Information” link or other designated method of submitting opt-out requests is not working or difficult to find, you may report the business to California Attorney General (https://oag.ca.gov/contact/consumer-complaint-against-business-or-company).
I have developed a standardized template that can be used to formally request the deletion of personal information and opt-out of the sale/sharing of such information under CCPA. The template is designed to ensure that the request meets the regulatory requirements and is processed promptly.
Subject: REQUEST FOR DELETION AND OPT-OUT OF SALE/SHARING OF PERSONAL INFORMATION UNDER CCPA/CPRA
Dear [Company Name] Privacy Team,
I trust this letter finds you well. I am writing to formally exercise my rights under the California Consumer Privacy Act of 2018 (“CCPA”), Cal. Civ. Code § 1798.100 et seq. and California Privacy Rights Act (“CPRA”) to request the deletion of my personal information from your records. Furthermore, I am also exercising my right to opt-out of the sale or sharing of my personal information.
The CCPA and CPRA require that any request related to a consumer’s personal information must be a verifiable/authenticated consumer request. Cal. Civ. Code § 1798.130(a)(2). Below info are provided to verify my identity:
– Full Name: First Middle Last
– Date of birth: DD MMM YYYY
– Email: email@example.com
– Former Addresses:
Previous Address 1
Previous Address 2
– Current Address:
Street, State, Zip
Under the CCPA, the above information can only be used for verification purposes, and you may not collect it.
I understand that the CCPA grants me the right to have my personal information deleted and to opt-out of the sale or sharing of this information. As such, I kindly request that you cease any activities related to the sale or sharing of my personal information with third parties.
In accordance with the CCPA guidelines, I expect the deletion of my personal information and the confirmation of the opt-out to be completed within 45 days from the date of receipt of this request. Additionally, I would appreciate information on the categories of personal information collected, the purposes for which the information was collected, and the third parties with whom the information was shared or sold.
If further information or identity verification is needed to process this request, please do not hesitate to contact me using the contact details provided above.
I appreciate your prompt attention to this matter and thank you for your cooperation in ensuring the privacy and security of my personal information.
Very truly yours,