General Rules Regarding Verification

What it requires

A business must establish, document, and follow a reasonable method for verifying that the person making a request to delete, correct, know, or access ADMT is the consumer the data is about. It may not require identity verification for a request to opt out of sale/sharing, a request to limit, or a request to opt out of ADMT, though it may ask for information needed to complete the request so long as that is not burdensome. It also may not charge the consumer or their authorized agent for verifying a request to delete, correct, or know, which rules out requiring a notarized affidavit unless the business pays for it.

Regulation text

(a) A business shall establish, document, and comply with a reasonable method for verifying that the person making a request to delete, request to correct, request to know, or request to access ADMT is the consumer about whom the business has collected information. (b) A business shall not require a consumer to verify their identity to make a request to opt-out of sale/sharing, to make a request to limit, or to make a request to opt-out of ADMT. A business may ask the consumer for information necessary to complete the request; however, it shall not be burdensome on the consumer. [...] (e) A business shall not require the consumer or the consumer’s authorized agent to pay a fee for the verification of their request to delete, request to correct, or request to know.

California Consumer Privacy Act / California Privacy Rights Act, § 7060Read the full section from California Privacy Protection Agency (CalPrivacy)