August 9, 2025
2 min read
The California Consumer Privacy Act (CCPA) establishes a defined set of rights for consumers regarding their personal information. Analysis of the legislation and recent enforcement actions reveals four primary rights:
Right to Know: Consumers may request details about the categories and specific pieces of personal information collected, used, disclosed, and sold by businesses. This right also extends to understanding the sources from which information is collected, the business purposes for collection or sale, and the categories of third parties with whom information is shared (Cal. Civ. Code § 1798.110). Empirical studies indicate that the majority of consumer requests under CCPA focus on access to data and data provenance.
Right to Delete: Consumers can request deletion of personal information held by businesses, subject to certain exceptions (e.g., security purposes, compliance with legal obligations). Enforcement statistics show that deletion requests are frequently honored, but some businesses cite statutory exemptions to retain data, leading to ongoing debates about the balance between consumer rights and business requirements.
Right to Opt-Out: Consumers have the right to direct a business that sells personal information to third parties to stop such sales. The implementation of "Do Not Sell My Personal Information" links on websites has become widespread following CCPA enforcement. Notably, research highlights inconsistent interpretations of what constitutes a "sale," leading to varied compliance practices.
Right to Non-Discrimination: Exercising CCPA rights must not result in disparate treatment or retaliation, such as denial of goods/services or different pricing/quality. Early enforcement actions suggest that non-discrimination provisions are effective in deterring obvious forms of retaliation but less effective in addressing more subtle forms of differential treatment.
CCPA’s consumer rights framework is operationalized through mandatory privacy notices, accessible opt-out mechanisms, and detailed response procedures for data subject requests. Despite widespread implementation, studies highlight challenges related to consumer awareness, practical usability of rights, and business compliance variability (Schwartz, 2021). As such, CCPA has established a functional but evolving baseline for consumer privacy in the United States.
