Notice, Disclosure, Correction, and Deletion Requirements

What it requires

Sets how consumers submit requests to know, delete, and correct. Subdivision (a)(1)(A) requires two or more designated methods, including at a minimum a toll-free telephone number, except that a business that operates exclusively online and has a direct relationship with the consumers it collects personal information from need only provide an email address. Subdivision (a)(1)(B) adds that a business that maintains an internet website must make it available for submitting those requests. Requests to opt out of sale or sharing are governed separately by 11 CCR § 7026(a), which requires two or more designated methods of every business that sells or shares. SB 923 (Becker) would amend (a)(1)(A) so an exclusively-online business must also offer an online method such as a web form; it is enrolled, not law, and becomes a statute unless vetoed by September 30, 2026, taking effect January 1, 2027 if it survives. Everything else in this record is the duty in force today.

Legal text (excerpt)

(a) In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers: (1) (A) Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively. (B) If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.

Primary source

Privisy checks

The following Privisy scanner checks are grounded in this citation:

• Privacy Request Mechanism

  An email address alone for an exclusively-online business with a direct consumer relationship; otherwise two or more methods including a toll-free number (§ 1798.130(a)(1)(A)); a website must be available for requests (§ 1798.130(a)(1)(B))