--- title: "California privacy law (CCPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/california/consumer-rights" source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) # California privacy law (CCPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may know and access their personal information, delete it, correct it, opt out of its sale or sharing (sharing means cross-context behavioral advertising), and limit the use of sensitive personal information. Businesses must answer requests to know, delete and correct within 45 days, extendable once by 45 days with notice. There is no statutory appeal process, unlike most other states. From 2027-01-01 the regulations add rights to opt out of, and access information about, automated decisionmaking technology used for significant decisions, and SB 923 extends deletion to data obtained from third parties. ## Key points 1. Right to know and access the categories and specific pieces of personal information, including what is sold or shared and to whom. Section: [Cal. Civ. Code §§ 1798.110, 1798.115](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 2. Right to delete personal information collected from the consumer; from 2027-01-01 SB 923 extends this to information obtained from other sources. Section: [Cal. Civ. Code § 1798.105](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 3. Right to correct inaccurate personal information. Section: [Cal. Civ. Code § 1798.106](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 4. Right to opt out of sale and sharing, with a 'Do Not Sell or Share My Personal Information' link or a qualifying opt-out preference signal. Section: [Cal. Civ. Code §§ 1798.120, 1798.135](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 5. Right to limit use and disclosure of sensitive personal information; businesses must comply within 15 business days. Section: [Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027(g)(1)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 6. Response within 45 days of a verifiable request, extendable once by 45 days with notice in the first period; disclosures in a portable, readily usable format. Section: [Cal. Civ. Code § 1798.130(a)(2)(A)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 7. ADMT: pre-use notice, opt-out and access rights for ADMT used for significant decisions, applying from 2027-01-01. Section: [Cal. Code Regs. tit. 11, §§ 7200(b), 7220, 7221, 7222](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 8. No retaliation for exercising rights; financial incentives allowed only on stated terms. Section: [Cal. Civ. Code § 1798.125](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) ## Sources - [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) - [CPPA, CCPA Updates, Cyber, Risk, ADMT and Insurance regulations: approved text](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) Reference material, not legal advice. ## Other topics for California - [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents