You have the right to request that a business disclose:
- Categories of personal information collected
- Specific pieces of personal information held
- Sources of the information
- Purposes for collection
- Third parties with whom data is shared
Your Consumer Privacy Rights
State privacy laws give you important rights over your personal information. As a consumer, you have the power to know what data companies collect about you, request deletion of that data, and opt out of data sales. Here's what you need to know about exercising your privacy rights.
Consumer Privacy Requests Are Increasing
Consumer data access and deletion requests have increased 246% from 2021 to 2023. As awareness of privacy rights grows, more consumers are taking control of their personal information.
Your Core Privacy Rights
→
Right to Know
Access your data
→
Right to Delete
Request data removal
You can request that businesses delete your personal information. Exceptions may apply for:
- Completing transactions you initiated
- Security and fraud prevention
- Legal compliance
- Internal research purposes
→
Right to Correct
Fix inaccurate data
If a business has inaccurate information about you, you can request that they correct it. This right is available in most states including California, Colorado, Connecticut, and Virginia.
→
Right to Opt Out
Stop data sales and sharing
You can opt out of:
- Sale of your personal information
- Sharing for targeted advertising
- Profiling for certain decisions
→
Right to Portability
Get your data in usable format
You can request your personal information in a portable, readily usable format that allows you to transmit the data to another entity.
→
Right to Non-Discrimination
Exercise rights without penalty
Businesses cannot discriminate against you for exercising your privacy rights by:
- Denying goods or services
- Charging different prices
- Providing different quality
How to Exercise Your Rights
Step 1: Find the Company's Privacy Request Portal
Look for links in the website footer such as:
- "Privacy Policy"
- "Do Not Sell or Share My Personal Information"
- "Your Privacy Choices"
- "Consumer Rights Request"
Step 2: Submit Your Request
Companies must provide at least two methods for submitting requests. Common options include:
- Online web form
- Toll-free phone number
- Email address
Step 3: Verify Your Identity
Companies may ask you to verify your identity to protect against fraudulent requests. Be prepared to provide:
- Name and email address on file
- Account information (if applicable)
- Additional verification information
Step 4: Await Response
Companies typically must respond within:
- California: 45 days (can be extended by 45 more days)
- Other states: 45 days (can be extended by 45 more days)
Using Global Privacy Control (GPC)
Global Privacy Control is a browser setting that automatically signals your opt-out preferences to websites. When enabled, it tells websites not to sell or share your personal information.
How to Enable GPC
- Firefox: Settings > Privacy & Security > Enhanced Tracking Protection
- Brave: Enabled by default
- DuckDuckGo: Enabled by default in browser and extensions
- Privacy Badger: Enable GPC in extension settings
Your Rights Are Protected
Companies are legally required to honor GPC signals in California and several other states. If a company doesn't honor your opt-out request or GPC signal, you can file a complaint with your state's Attorney General.
What to Do If Your Rights Are Violated
- Document the violation: Take screenshots and save any correspondence
- Contact the company: Follow up in writing about the issue
- File a complaint: Contact your state's Attorney General or privacy agency
- California: File complaints with the California Privacy Protection Agency (CPPA)