DPO SchoolDPO School

California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)

California privacy law (CCPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may know and access their personal information, delete it, correct it, opt out of its sale or sharing (sharing means cross-context behavioral advertising), and limit the use of sensitive personal information. Businesses must answer requests to know, delete and correct within 45 days, extendable once by 45 days with notice. There is no statutory appeal process, unlike most other states. From 2027-01-01 the regulations add rights to opt out of, and access information about, automated decisionmaking technology used for significant decisions, and SB 923 extends deletion to data obtained from third parties.

Key points

  1. Right to know and access the categories and specific pieces of personal information, including what is sold or shared and to whom.

    Section: Cal. Civ. Code §§ 1798.110, 1798.115

  2. Right to delete personal information collected from the consumer; from 2027-01-01 SB 923 extends this to information obtained from other sources.

    Section: Cal. Civ. Code § 1798.105

  3. Right to correct inaccurate personal information.

    Section: Cal. Civ. Code § 1798.106

  4. Right to opt out of sale and sharing, with a 'Do Not Sell or Share My Personal Information' link or a qualifying opt-out preference signal.

    Section: Cal. Civ. Code §§ 1798.120, 1798.135

  5. Right to limit use and disclosure of sensitive personal information; businesses must comply within 15 business days.

    Section: Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027(g)(1)

  6. Response within 45 days of a verifiable request, extendable once by 45 days with notice in the first period; disclosures in a portable, readily usable format.

    Section: Cal. Civ. Code § 1798.130(a)(2)(A)

  7. ADMT: pre-use notice, opt-out and access rights for ADMT used for significant decisions, applying from 2027-01-01.

    Section: Cal. Code Regs. tit. 11, §§ 7200(b), 7220, 7221, 7222

  8. No retaliation for exercising rights; financial incentives allowed only on stated terms.

    Section: Cal. Civ. Code § 1798.125

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the California statute

Reference material, not legal advice.