---

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CCPA and cookies.

California has the most developed consumer rights system among all US state privacy laws.

It is not just the number of rights guaranteed by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It is the specificity of the processes, the precise deadlines, the private right of action for security breaches, and the existence of an independent regulatory agency with enforcement power.

This article covers all of it: what a DSAR is under the CCPA/CPRA, what rights are guaranteed, how to structure the Privacy Portal, the exact deadlines, and what happens when the business does not comply.

DSAR stands for Data Subject Access Request, or Verifiable Consumer Request in the language of the CCPA. It is any formal request from a California resident to exercise the rights the law grants over their own data.

Under the CCPA/CPRA, the consumer can make verifiable requests to exercise six main rights, plus the private right of action for security breaches, which has its own flow.

If you are already familiar with the GDPR data subject rights framework, the structure is familiar. The CCPA/CPRA uses the term "verifiable consumer request" to describe authenticated requests.

The consumer may request that the business confirm whether it processes their data and disclose:

The categories of personal information collected.

The categories of sources.

The business or commercial purpose for collecting, selling, or sharing.

The categories of third parties with whom data was shared.

The specific pieces of personal information collected about the consumer.

The response must cover the preceding 12 months from the date of receipt.

If the business sells or shares data, the request also covers:

Categories of data sold or shared, by category of third party.

Categories of data disclosed for business purposes, separately.

The consumer may request deletion of any personal information the business collected about them.

The business must delete the data from its own records and notify service providers, contractors, and third parties to also delete, unless impossible or involving disproportionate effort.

The business may maintain a confidential record of deletion requests solely to prevent the data of a consumer who requested deletion from being resold.

Exceptions allowing retention even after a deletion request include: completing ongoing transactions, ensuring security, debugging errors, exercising free speech, complying with law, conducting approved public research, and fulfilling a legal obligation.

Added by the CPRA. The consumer may request the business to correct inaccurate personal information, taking into account the nature of the data and the purposes of processing.

The business must use commercially reasonable efforts to correct the data as directed by the consumer.

The consumer may, at any time, direct the business not to sell or share their personal information with third parties.

After receiving the consumer's direction, the business may not sell or share the data unless the consumer subsequently provides consent.

The business must wait at least 12 months before requesting the consumer to again authorize sale or sharing (§ 1798.135(c)(4)).

For consumers under 16 who did not consent to sale or sharing, the business must wait at least 12 months before requesting consent again, or until the consumer turns 16 (§ 1798.135(c)(5)).

Added by the CPRA. The consumer may direct the business to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

After receiving the consumer's direction, the business may not use the sensitive information for other purposes unless the consumer provides new consent.

The consumer may not be discriminated against for exercising any right guaranteed by the CCPA/CPRA. The business cannot deny products or services, charge different prices, provide different quality, or suggest differential treatment.

The exception is voluntary financial incentive programs where the price or quality difference is reasonably related to the value the data represents to the business.

This right has a different flow from the others. A consumer whose unencrypted and unredacted data is accessed or exposed in a security breach may file a civil lawsuit to recover US$ 100 to US$ 750 per consumer per incident, or actual damages when greater, plus injunctive relief.

Before initiating any action for statutory damages, the consumer must provide written notice to the business 30 days in advance, identifying the specific violations. If the business cures within the period and provides a written statement that no further violations will occur, no action may be initiated.

The CCPA/CPRA is specific on deadlines.

45 days from receipt of a verifiable consumer request (§ 1798.130(a)(2)(A)).

The deadline can be extended by another 45 days when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the justification and reason for the delay (§ 1798.145(h)(1)).

Service is free. The business is not obligated to provide the same information to the same consumer more than twice in a 12-month period (§ 1798.130(b)).

The CCPA/CPRA uses the term "verifiable consumer request" (§ 1798.140(ak)) to describe requests that the business can verify were made by the consumer themselves, by a minor child's parent, by an authorized representative, or by a person with power of attorney.

The business may authenticate the request using commercially reasonable methods. It may require authentication proportionate to the nature of the information requested, but cannot require the consumer to create a new account. If the consumer already has an account, the business may require use of that account.

Data collected for identity verification may only be used for that purpose, not for other uses (§ 1798.130(a)(7)).

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

If the business maintains a website, it must make it available as a submission channel.

The business cannot require the consumer to create a new account, but may require use of an existing account.

A structured Privacy Portal offers:

A submission form with clear categories (know/access, delete, correct, opt-out of sale/sharing, limit sensitive PI use).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation.

A log of each request, action taken, and response sent.

The consumer may authorize another person to exercise their rights on their behalf, including through the GPC opt-out preference signal (§ 1798.135(e)).

An authorized agent may submit requests. The business may require proof that the agent was properly authorized by the consumer.

Parents or guardians may exercise rights on behalf of minor children.

Service is free (§ 1798.130(a)(2)(A)). But the business is not obligated to provide the same information to the same consumer more than twice in a 12-month period (§ 1798.130(b)).

For manifestly unfounded, excessive, or repetitive requests, the business may charge a reasonable fee for administrative costs or decline. The burden of demonstrating the excessive nature lies with the business (§ 1798.145(h)(3)).

Receive and authenticate the consumer's identity.

Locate all personal data collected about this consumer in the preceding 12 months across all systems.

Prepare a response covering: categories of data, categories of sources, purposes, categories of third parties, and the specific pieces of information.

If the business sold or shared data: list by category of data and category of third party (in separate lists for "sold/shared" and "disclosed for business purposes").

Deliver in a readily usable format that allows transmission from one entity to another without hindrance.

Send within the 45-day deadline.

Receive and authenticate.

Check whether a legal exception allows retaining the data.

If no exception: delete from own records and notify service providers, contractors, and third parties to also delete.

Retain only the confidential record of the deletion request to prevent future resale.

Confirm to the consumer.

Receive and authenticate.

Identify which data is inaccurate and in which systems it is stored.

Use commercially reasonable efforts to correct as directed by the consumer.

Confirm the correction.

If the request is for correction of health information and the business rejects it as accurate, the consumer has the right to include an addendum of up to 250 words to the record.

Receive the request (may be via "Do Not Sell or Share" link, via GPC, or via authorized representative).

Immediately cease sale and sharing of this consumer's data.

Do not request consent again for at least 12 months.

Notify any third parties that recently received the data about the opt-out.

Receive via "Limit the Use of My Sensitive Personal Information" link or other mechanism.

Cease use of the consumer's sensitive personal information for purposes beyond what is necessary to provide the products or services reasonably expected.

Notify service providers about the limitation so they also cease unauthorized uses.

§ 1798.125 expressly prohibits businesses from discriminating against consumers who exercise their rights. The business cannot:

Deny products or services.

Charge different prices or rates.

Provide different quality of goods or services.

Suggest the consumer will receive differential treatment.

Retaliate against employees, job applicants, or independent contractors who exercise their rights.

The exception is voluntary financial incentive programs. The business may offer financial compensation, discounts, or benefits in exchange for data use, as long as the consumer expressly consents and the incentives are not unjust, unreasonable, coercive, or abusive.

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request.

Authentication process performed.

Action taken.

Date and form of response to the consumer.

In case of denial: recorded justification.

This documentation is what protects the business in a CPPA or Attorney General investigation.

The California Privacy Protection Agency (CPPA) has administrative power to:

Investigate businesses on its own initiative or based on complaints.

Impose fines of up to US$ 2,500 per violation and up to US$ 7,500 for intentional violations or violations involving minors.

The California Attorney General may seek civil penalties in the same amounts in a civil action.

There is no guaranteed cure period before CPPA actions. The agency decides by discretion whether and when to initiate an investigation.

AdOpt logs every consent, opt-out, and sensitive information limitation interaction with a timestamp and unique identifier. When the consumer opts out of sale and sharing, the system automatically updates the corresponding trackers.

The GPC is honored automatically. AdOpt's auditable log serves as evidence of compliance. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.

Two or more submission methods, including a toll-free telephone number (§ 1798.130(a)(1)).

Website available as a submission channel if the business maintains a website.

Coverage of 6 rights: access/know, deletion, correction, opt-out of sale/sharing, limit sensitive PI, and non-discrimination.

12-month lookback for access requests (§ 1798.130(a)(2)(B)).

45-day response deadline, with +45-day extension with notification (§ 1798.130(a)(2)(A)).

Free service limited to twice per consumer in 12 months (§ 1798.130(b)).

Authentication process proportionate to the nature of data, without requiring new account creation.

Acceptance of requests from authorized representatives, including parents of minors.

"Do Not Sell or Share My Personal Information" link on the site when there is sale or sharing.

"Limit the Use of My Sensitive Personal Information" link when applicable.

GPC honored when sent by the user.

12-month waiting period before requesting consent again after opt-out.

Notification of third parties for data deletion when a deletion request is fulfilled.

Confidential record of deletion requests to prevent resale.

Documentation of each request, action, and response.

1. Does the CCPA require a toll-free telephone number for the Privacy Portal?
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address. For most businesses with a website, the toll-free number is mandatory.

2. What is the "12-month lookback" and how does it affect access requests?
§ 1798.130(a)(2)(B) requires that the response to an access request cover the 12 months preceding receipt of the request. This means the Privacy Portal must be capable of retrieving data collected in the preceding 12 months from each request date, which requires appropriate tracking and retention systems.

3. How many times per year must the business process DSARs free of charge?
Twice in a 12-month period per consumer, under § 1798.130(b). For requests beyond this limit, or that are manifestly unfounded or repetitive, the business may charge a reasonable fee for administrative costs or decline, demonstrating the excessive nature.

4. How does the private right of action under the CCPA work and what does it have to do with the Privacy Portal?
§ 1798.150 grants the consumer the right to file a civil lawsuit for security data breaches. Before initiating action for statutory damages, the consumer must provide written notice 30 days in advance. The Privacy Portal should be the channel through which these notifications are received and processed. If the business cures within the period and provides an adequate written statement, no action may be initiated.

5. Must the business notify third parties when it fulfills a deletion request?
Yes. § 1798.105(c)(1) requires the business to notify any service provider or contractor to delete the data, and also notify all third parties to whom the data was sold or shared, unless impossible or involving disproportionate effort. The business may also maintain a confidential record of the deletion request solely to ensure that the data of the consumer who requested deletion is not resold.

Ready to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.