Methods for Submitting Requests to Delete, Requests to Correct, and Requests to Know

What it requires

A business that operates exclusively online and has a direct relationship with the consumer it collects from need only provide an email address for requests to delete, correct, and know. Every other business must provide two or more designated methods, one of them a toll-free telephone number, and a business with a website must accept these requests through the website, such as a webform. The section also allows a two-step confirmation for online deletion requests and requires a business that keeps data longer than 12 months to let consumers ask for data older than that window.

Regulation text

(a) A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to delete, requests to correct, and requests to know. (b) A business that does not fit the description in subsection (a) shall provide two or more designated methods for submitting requests to delete, requests to correct, and requests to know. One of those methods must be a toll-free telephone number. If the business maintains an internet website, one of the methods for submitting these requests shall be through its website, such as through a webform.

California Consumer Privacy Act / California Privacy Rights Act, § 7020Read the full section from California Privacy Protection Agency (CalPrivacy)