A Practical Guide to Your Privacy Rights Under the CCPA

California residents hold practical rights over the personal information businesses store, and the CCPA consumer privacy rights explained below are the ones most websites actually have to honour.

The California Consumer Privacy Act, expanded by the California Privacy Rights Act, gives California residents practical rights over personal information held by covered businesses. It is not identical to the GDPR, but it has become one of the most important privacy laws for US websites, apps, and marketing teams.

This guide is for consumers and for teams that need to understand what users are entitled to request.

Who the CCPA Protects

The CCPA protects California residents. A business can be covered even if it is not physically located in California, as long as it does business in California and meets the law's thresholds.

The California Privacy Protection Agency explains in its FAQ that personal information is broad. It can include identifiers, browsing activity, commercial information, precise geolocation, biometric data, inferences, and sensitive personal information such as government identifiers, health information, racial or ethnic origin, religious beliefs, union membership, and the contents of certain communications.

Your Main CCPA Rights

Right to know

You can ask a covered business what categories of personal information it collected, where it came from, why it was collected, what categories of third parties received it, and whether it was sold or shared.

You can also request specific pieces of personal information, although businesses may withhold certain sensitive values for security reasons.

Right to delete

You can ask a business to delete personal information it collected from you. This right has exceptions. A business is allowed to keep information needed to complete a transaction, detect security incidents, comply with legal obligations, exercise free speech, or use the information internally in ways compatible with the original context.

Right to correct

You can ask a business to correct inaccurate personal information. This is especially important for profile data, account data, billing records, and eligibility decisions.

Right to opt out of sale or sharing

The CCPA covers more than literal money-for-data sales. Sharing personal information for cross-context behavioral advertising can trigger opt-out rights. Websites that sell or share personal information need a clear "Do Not Sell or Share My Personal Information" mechanism.

California also requires businesses to honor valid opt-out preference signals in many contexts. The Global Privacy Control is the best-known browser signal. The CPPA has published materials on upcoming CCPA regulatory updates that continue to emphasize opt-out preference signals and consumer choice.

Right to limit sensitive personal information

You can limit certain uses and disclosures of sensitive personal information. For example, precise geolocation, health information, and government identifiers should not be used for unrelated profiling if the consumer has limited that use.

Right of non-discrimination

A business cannot retaliate against you for exercising CCPA rights. It cannot deny goods or services, charge a different price, or provide a different level of service because you made a privacy request, unless a permitted financial incentive program applies and is properly disclosed.

How to Exercise Your Rights

Look for a privacy policy link in the website footer. A covered business should explain request methods, verification steps, opt-out methods, and categories of data collected.

For access, deletion, or correction requests, you may need to verify your identity. Businesses should not demand more information than needed for verification. For opt-out requests, they generally should not make you create an account.

A practical request can be short:

I am a California resident exercising my CCPA rights. Please provide the categories and specific pieces of personal information you collected about me, the categories of sources, purposes, categories of third parties, and whether my personal information was sold or shared. Please also delete personal information that is not subject to an exception.

Keep a copy of the request and the date. If you use a browser that supports Global Privacy Control, enable it as an additional signal.

What Businesses Should Learn From the CCPA

For analytics and marketing teams, the CCPA creates real operational work:

• Know whether your analytics vendor receives personal information.
• Decide whether advertising integrations count as sale or sharing.
• Honor opt-out preference signals.
• Do not send sensitive personal information into analytics events.
• Keep a data map that connects cookies, pixels, forms, CRM records, and ad platforms.
• Make deletion and correction possible across vendors, not just your main database.

Privacy-first analytics reduces the burden because aggregate, cookieless measurement avoids many high-risk data flows. If your analytics tool does not identify visitors, does not set tracking cookies, and does not share data for advertising, CCPA operations become simpler.

CCPA vs GDPR

The GDPR starts from a lawful-basis model: organizations need a valid legal basis before processing personal data. The CCPA is more consumer-control oriented: businesses can process many categories of information but must provide notices, access rights, deletion rights, and opt-outs for sale, sharing, and sensitive data use.

The practical difference is burden. GDPR pushes more responsibility onto organizations before processing begins. CCPA gives consumers strong tools, but consumers often have to notice the issue, find the control, and act. That is why privacy by design matters. A company that collects less data creates fewer consumer-rights headaches and fewer trust problems.

When a Business Does Not Respond

If a business ignores a request, gives an incomplete answer, or makes opt-out unnecessarily difficult, keep screenshots and copies of the request. California residents can file complaints with the California Privacy Protection Agency or the California Attorney General. For everyday users, the most effective first step is a clear written request, followed by a reminder that names the right being exercised.

For businesses, the lesson is to make privacy requests operational before they become complaints. A footer link is not enough if the backend cannot find, delete, correct, or suppress the relevant data.

CCPA Action Checklist

Consumers should know the right they are exercising: access, deletion, correction, opt-out of sale, opt-out of sharing for cross-context behavioral advertising, limit sensitive personal information, or non-discrimination. Keep the request short, save the date, and preserve screenshots if the business makes the process difficult.

Businesses should translate those rights into operational controls. Map cookies, pixels, forms, CRM records, enrichment vendors, and ad platforms; distinguish sale from sharing; honor valid Global Privacy Control signals where required; and avoid sending analytics data to advertising vendors when aggregate measurement is enough.

Frequently Asked Questions

What personal information does the CCPA cover?

Personal information under the CCPA is broad. It includes identifiers, browsing activity, commercial information, precise geolocation, biometric data, and inferences drawn about you. Sensitive personal information gets extra protection and covers things like government identifiers, health information, racial or ethnic origin, religious beliefs, union membership, and the contents of certain communications.

Does the CCPA apply to businesses located outside California?

A business can be covered by the CCPA even with no physical location in California. What matters is whether it does business in the state and meets the law's thresholds. Plenty of out-of-state companies fall under the law for that reason, because they serve California customers.

What happens when I ask a business to delete my data?

The business has to delete personal information it collected from you, but the right has exceptions. It can keep data needed to complete a transaction, detect security incidents, comply with legal obligations, exercise free speech, or use internally in ways compatible with why it was collected. A deletion request rarely wipes every record a company holds.

Can a business charge me more for exercising my privacy rights?

A business cannot retaliate against you for exercising CCPA rights under normal circumstances. It cannot deny goods or services, charge a different price, or give you a worse level of service because you made a privacy request. The one exception is a permitted financial incentive program that the business discloses properly.

What is Global Privacy Control?

Global Privacy Control is a browser signal that tells websites you want to opt out of the sale or sharing of your personal information automatically. It is the best-known opt-out preference signal, and California requires businesses to honor valid signals like it in many contexts. The CPPA's materials on upcoming regulatory updates keep pointing toward opt-out preference signals and consumer choice.

Do I need to create an account to opt out of my data being sold?

For opt-out requests specifically, businesses generally should not make you create an account first. Account creation requirements are more common for access, deletion, or correction requests, where identity verification is the point.

What can I do if a business ignores my privacy request?

Keep screenshots and copies of your original request. You can file a complaint with the California Privacy Protection Agency or the California Attorney General. For most everyday situations, a clear written follow-up that names the specific right you are exercising works before you escalate to a formal complaint.

How is the CCPA different from the GDPR?

The GDPR starts from a lawful-basis model, meaning organizations need a valid legal reason before they process personal data at all. The CCPA works the other way. Businesses can process many categories of information already, but they owe consumers notices, access rights, deletion rights, and opt-outs for sale, sharing, and sensitive data use.

What should a CCPA request actually say?

A short request naming your California residency and the right you are exercising is enough. Ask for the categories and specific pieces of personal information collected about you, the sources, the purposes, the categories of third parties, and whether the information was sold or shared. You can add a line asking the business to delete anything not covered by an exception.

Can I limit how a business uses my sensitive personal information?

Yes. The CCPA lets you limit certain uses and disclosures of sensitive personal information such as precise geolocation, health information, and government identifiers. If you exercise that limit, the business should not use that data for unrelated profiling.