Your data privacy rights in California

What the CCPA/CPRA does for you

The California Consumer Privacy Act, as amended by the California Privacy Rights Act gives California residents legal control over the personal data that companies collect about them. The only state with a dedicated privacy regulator (the CPPA) and the only one with a one-stop data-broker deletion platform (DROP) under the DELETE Act. It is enforced by California Privacy Protection Agency (CPPA) and the Attorney General, and businesses generally must respond to your requests within 45 days. California also regulates data brokers directly: Yes — the DELETE Act (SB 362) created a data-broker registry and the DROP one-stop deletion platform.

Your rights under the CCPA/CPRA

How to exercise your rights in California

1. Use the state DROP platform
   Register with the California Privacy Protection Agency’s DROP platform to send a single deletion request to every registered data broker at once.
2. Submit requests to individual businesses
   For companies that aren’t data brokers, use their "Do Not Sell or Share My Personal Information" link or privacy request form to access, delete or opt out.
3. Verify your identity
   Provide the information the business needs to confirm who you are; it generally must respond within 45 days.
4. Escalate if ignored
   If a business doesn’t comply, file a complaint with the CPPA or the California Attorney General.

Sample opt-out letter for California residents

A ready-to-send deletion request that cites your rights under the CCPA/CPRA. Add your name and the broker in the generator, then send it to the company’s privacy address.

To the Privacy / Opt-Out Team at [Broker name],

I am writing to request that you remove my listing and delete all personal information you hold about me, and that you stop selling or sharing it. I am making this request under my rights as a California resident under the California Consumer Privacy Act (CCPA), as amended by the CPRA.

To identify my records:
Full name: [Your full name]

Please take the following actions:
1. Delete all personal information you have collected about me.
2. Suppress my profile so it no longer appears on your website or any affiliated/partner sites.
3. Stop selling, sharing or licensing my personal information to third parties.
4. Confirm in writing once these steps are complete.

Please process this request and respond within 45 days. If you need to verify my identity, contact me using the details above — but please do not require more information than is necessary to do so.

Thank you for your prompt attention.

Sincerely,
[Your full name]

Who has to comply

For-profit businesses doing business in California that meet any one of: $25M+ annual revenue; buy/sell/share the data of 100,000+ consumers or households; or earn 50%+ of revenue from selling/sharing personal data.

Because the law only binds businesses above these thresholds, many of the smaller sites and data brokers that expose you aren’t covered — which is why a direct opt-out matters even in California.

Enforcement & penalties

The CCPA/CPRA is enforced by California Privacy Protection Agency (CPPA) and the Attorney General. Penalties run to Up to $2,500 per violation, or $7,500 per intentional violation or violation involving a minor. Yes — limited to certain data breaches.

Data brokers and people-search sites in California

Yes — the DELETE Act (SB 362) created a data-broker registry and the DROP one-stop deletion platform. That’s a real advantage — but the registry doesn’t remove you automatically. You still have to file removals, and brokers re-list you from fresh public records. See our full guide to the California DELETE Act & DROP platform. Our free data-broker opt-out guide walks each one, and our free breach & dark-web check shows what’s already leaked.