Though many of the rights below previously existed under the CCPA, the following sections describe these rights as amended and applicable to employers under the CPRA on January 1, 2023.

Right to Delete Personal Information

Under the CPRA, consumers have a right to request that a business delete any “personal information about the consumer which the business collected from the consumer.”1

When the business receives a verifiable request for deletion, it must delete the information from its records, subject to exceptions, and notify service providers or contractors with whom the business “sold” or “shared” the personal information to delete it.

There are exceptions to the deletion requirement. A business doesn’t have to delete the personal information if it’s “reasonably necessary” to maintain the information in order to:

• Complete a transaction for which the personal information was collected.
• Ensure security and integrity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer reviewed scientific, historical or statistical research.
• To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.
• Comply with a legal obligation.

• Employers should consult with their legal counsel on how to handle any requests from an employee, job applicant or independent contractor for deletion of their personal information. Keep in mind that employment-related information may be subject to different retention and/or confidentiality requirements than other consumer data. Prior to deleting any employment-related information via CPRA request, employers should work with legal counsel to determine whether any of the above exceptions apply to any of the personal information subject to the request.

Right to Correct Inaccurate Personal Information

Consumers can request that a business maintaining inaccurate personal information about the consumer correct the information.2

Businesses must use “commercially reasonable efforts” to correct the inaccurate personal information.

Right to Know and Access Personal Information

In addition to the notice at collection, consumers can request for businesses that collect personal information to disclose the:3

• Categories of personal information it has collected about that consumer.
• Categories of sources from which the personal information is collected.
• Business or commercial purpose for collecting, selling or sharing personal information.
• Categories of third parties to whom the business discloses personal information.
• Specific pieces of personal information it has collected about that consumer.

The disclosure of the required information covers the 12-month period preceding the receipt of the consumer request.

Businesses are not obligated to provide information under this right to the same consumer more than twice in a 12-month period.4

Right to Know What Personal Information is Sold, Shared or Disclosed and to Whom

Consumers have the right to request that a business that sells or shares their personal information, or that discloses it for a business purpose, release to them the following: 5

• Categories of personal information collected about the consumer.
• Categories of personal information that the business has sold or shared about the consumer, as well as the categories of third parties to whom the information was sold or shared, by category or categories of personal information, for each third party category.
• The categories of personal information that the business “disclosed about the consumer for a business purpose” and the categories of persons to whom it was disclosed for a business purpose.

As noted above, employers generally don’t sell or share the personal information of their employees or job applicants as defined by the CPRA, but employers should consult with legal counsel on what personal information, if any, they disclose to a third party for a “business purpose.”

The law defines “business purpose” as the use of personal information for:

• The business’ operational or other notified purposes; or
• A service provider or contractor’s operational purposes, provided that the use of personal information must be “reasonably necessary and proportionate” to achieve:
• The purpose for which the information was collected; or
• Another purpose that’s compatible with the context in which the information was collected.

The law specifically states that business purposes include:

• Auditing related to ad impressions.
• Ensuring security and integrity.
• Debugging to identify and repair functionality errors.
• Short-term, transient use, including non-personalized advertising shown as part of a consumer’s current interaction with the business.
• Performing services on behalf of the business, including maintaining and servicing accounts; providing customer service; processing or fulfilling orders and transactions; verifying customer information; processing payments; or providing financing, analytic services, storage, etc.
• Providing advertising and marketing services.
• Undertaking internal research for technological development.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured or controlled by the business.

If the business hasn’t sold, shared or disclosed consumers’ personal information, it must disclose that fact.

The disclosure of the required information covers the 12-month period preceding the receipt of the consumer request. Businesses are not obligated to provide information under this right to the same consumer more than twice in a 12-month period.

Right to Opt Out of Sale or Sharing of Personal Information

Consumers have the right to direct a business that sells or shares personal information to third parties not to do so, referred to as the right to “opt-out” of sale or sharing.6

This right generally doesn’t impact employers with respect to their employment data, as that information is generally not sold or shared within the meaning of the CPRA; however, employers should consult with their legal counsel on how this right may be implicated by their employment-related information practices.

Right to Limit Use and Disclosure of Sensitive Personal Information

Consumers have the right to restrict the use and disclosure of sensitive personal information collected by businesses to certain specific business uses (e.g., preventing fraud, payment, customer service, etc.) and those uses necessary to perform the service or provide the goods reasonably expected by the average consumer.7

Generally, this right doesn’t impact employers with respect to their employment-related information.

Right of No Retaliation

Employers cannot discriminate or retaliate against an employee, job applicant or independent contractor for exercising their rights under the CPRA.8

Administration of Rights

Covered businesses must provide two or more designated ways for consumers to make the following requests:

• Know and access their personal information.
• Know what personal information has been sold, shared or disclose.
• Delete their personal information.
• Correct inaccurate information.

The law specifies that one of two ways must be a toll-free telephone number.9 It also provides that a business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting information requests or requests to delete or correct information.10

If the business maintains a website, the business must make available to consumers a way to submit requests for information or request to delete or correct information.11

• Employer should consult with their legal counsel to determine the appropriate methods for employees, job applicants and contractors to make CPRA requests, given their circumstances and practices.

Employers are required to take action with respect to the rights above when they receive a “verifiable consumer request” — a request made by the consumer, someone authorized to act on their behalf, or someone with the power of attorney or acting as a conservator for the consumer, and that the business can verify using commercially reasonable methods.12

The CPRA also contains specific timeframes for complying with consumer requests. Covered businesses must, upon receiving a verifiable consumer request, confirm receipt of the request within 10 business days and must disclose and deliver the required information to a consumer free or charge, or correct inaccurate personal information, or delete a consumer’s personal information within 45 days after receiving the verified request. The timeframe can be extended for an additional 45 days when reasonably necessary, provided the business provides notice of the extension to the consumer.13

1. Civ. Code sec. 1798.105

2. Civ. Code sec. 1798.106

3. Civ. Code sec. 1798.110

4. Civ. Code sec. 1798.130(b)

5. Civ. Code sec. 1798.115(a)

6. Civ. Code sec. 1798.120

7. Civ. Code sec. 1798.121(a)

8. Civ. Code sec. 1798.125

9. Civ. Code sec. 1798.130(a)(1)(A)

10. Civ. Code sec. 1798.130(a)(1)(A)

11. Civ. Code sec. 1798.130(a)(1)(B)

12. Civ. Code sec. 1798.140(ak)

13. Civ. Code sec. 1798.130(a)(2)