# Regulatory Standards — California Consumer Rights

## Primary Legislation

### Cal. Civ. Code §1798.100 — General Duties of Businesses that Collect Personal Information

- §1798.100(a): Consumer right to know what PI is collected and how it is used, sold, or shared
- §1798.100(b): Right to request deletion; business must disclose in privacy notice
- §1798.100(c): Data minimization — collection, use, retention, and sharing must be reasonably necessary and proportionate
- §1798.100(d): Required data processing agreements

### Cal. Civ. Code §1798.105 — Right to Delete

- §1798.105(a): Consumer right to request deletion of PI collected from the consumer
- §1798.105(b): Business must comply and direct service providers/contractors to delete
- §1798.105(c): Service providers/contractors must cooperate with deletion requests
- §1798.105(d): Nine enumerated exceptions to deletion obligation

### Cal. Civ. Code §1798.106 — Right to Correct

- §1798.106(a): Consumer right to request correction of inaccurate PI
- §1798.106(b): Business must use commercially reasonable efforts to correct

### Cal. Civ. Code §1798.110 — Right to Know — Specific Disclosures

- §1798.110(a): Consumer right to request categories and specific pieces of PI
- §1798.110(c): Required disclosures — categories collected, sources, purposes, third parties, PI sold/shared

### Cal. Civ. Code §1798.115 — Right to Know — Sale and Sharing Disclosures

- §1798.115(a): Consumer right to request categories of PI sold or shared, categories of third parties
- §1798.115(c): Third parties may not sell or share PI sold/shared to them unless consumer receives explicit notice and opt-out opportunity

### Cal. Civ. Code §1798.120 — Right to Opt-Out

- §1798.120(a): Consumer right to direct business to not sell or share PI
- §1798.120(b): Business must comply; no selling or sharing after opt-out request
- §1798.120(c): Minor protections — opt-in required under 16; parental consent under 13
- §1798.120(d): Business must wait at least 12 months before re-requesting consent after opt-out

### Cal. Civ. Code §1798.121 — Right to Limit Use of Sensitive PI

- §1798.121(a): Consumer right to direct business to limit use of sensitive PI to specified purposes
- §1798.121(b): Business must comply; restrict to enumerated purposes only
- §1798.121(d): "Limit the Use of My Sensitive Personal Information" link requirement

### Cal. Civ. Code §1798.125 — Right to Non-Discrimination

- §1798.125(a): Prohibition on discriminatory treatment for exercising rights
- §1798.125(b): Financial incentive programs permitted with opt-in and reasonable relationship to data value

### Cal. Civ. Code §1798.130 — Consumer Request Processing Requirements

- §1798.130(a)(1): Two or more designated methods for submitting requests
- §1798.130(a)(2): Response within 45 calendar days, extendable by 45 days
- §1798.130(a)(3): Disclosures cover 12-month period preceding request
- §1798.130(a)(4): Machine-readable format for portability requests
- §1798.130(a)(5): Privacy notice content requirements

## CPPA Implementing Regulations

### 11 CCR §7022 — Requests to Know

- §7022(a): Methods for submitting requests (minimum two)
- §7022(b): Business must confirm receipt within 10 business days
- §7022(c): Response must address each category of PI

### 11 CCR §7023 — Requests to Delete

- §7023(a): Confirmation of consumer's intent to delete for non-portal requests
- §7023(b): Two-step confirmation process recommended
- §7023(c): Notify service providers and contractors of deletion

### 11 CCR §7024 — Requests to Correct

- §7024(a): Commercially reasonable efforts standard
- §7024(b): Consider nature of PI and purposes of processing
- §7024(c): May request documentation supporting correction

### 11 CCR §7025 — Requests to Opt-Out / Opt-Out Preference Signals

- §7025(a): "Do Not Sell or Share My Personal Information" link requirements
- §7025(b): Two-step opt-out process prohibited (no confirmation clicks)
- §7025(c): Opt-out preference signals must be processed without verification
- §7025(d): Business must not display pop-up questioning the signal
- §7025(e): If consumer identity unknown, apply to browser/device
- §7025(f): Conflict resolution when authenticated user has different setting

### 11 CCR §7026 — Requests to Limit Sensitive PI

- §7026(a): "Limit the Use of My Sensitive Personal Information" link requirements
- §7026(b): May be combined with opt-out link as single "Your Privacy Choices" link

### 11 CCR §7060-7063 — Verification

- §7060: Reasonable security measures for verification
- §7061: Verification for non-accountholders — probability-based matching
- §7062: Verification for accountholders — re-authentication
- §7063: Authorized agent verification requirements

## Case Law

### In re Sephora Inc. (August 24, 2022)
First public CCPA enforcement action. $1.2 million settlement for failure to disclose sale of PI and failure to honor GPC opt-out signals.

### CPPA Administrative Decision No. 2024-002
Enforcement against an unnamed retailer for requiring consumers to call a toll-free number and navigate multiple IVR menus to opt out — deemed a "dark pattern" under CPPA Enforcement Advisory No. 2024-01.