A California resident visits your site, consumes your content, and at some point decides to exercise the rights the law guarantees. They want to know what you have about them. They want to correct inaccurate information. They want you to stop sharing their data with advertising networks.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CPRA and cookies.

What happens next?

The California Privacy Rights Act (CPRA) defines precisely what must happen: the channel for receiving the request, the response deadlines, what is free and what is not, and what happens when the business does not comply.

The major additions compared to the original CCPA: the right to correct data, the right to limit use of sensitive personal information, and automatic tripled penalties for violations involving consumers under 16.

This article covers everything.

DSAR stands for Data Subject Access Request. It is any formal request from a California consumer to exercise the rights the CPRA guarantees over their own data.

Under Civil Code § 1798.130, consumers exercise their rights through means established by the business and described in the privacy policy.

If you already know the LGPD data subject portal, the logic is familiar. The CPRA adds new rights and strengthens protections for minors.

Under Civil Code § 1798.100 through § 1798.125, California residents have the following rights:

The consumer may request that the business disclose:

The categories of personal information collected about them.

The specific categories of sources from which information was collected.

The business or commercial purpose for collecting, selling, or sharing the information.

The categories of third parties to which the business discloses information.

The specific pieces of personal information collected about the consumer.

The consumer may obtain a copy of the specific personal information the business has collected in the past 12 months (Civil Code § 1798.100(a)).

The consumer may request deletion of their personal information, with some exceptions (Civil Code § 1798.105). Exceptions include: completing the transaction, security, debugging, internal research, and legal compliance.

This is a new right the CCPA did not have (Civil Code § 1798.106). The consumer may request that the business correct inaccurate personal information it maintains about them, taking into account the nature of the information and the purposes of processing.

The consumer may obtain personal information in a portable, usable format (Civil Code § 1798.100(a)).

The consumer may refuse the selling of personal information and the sharing for cross-context behavioral advertising (Civil Code § 1798.120). This right is exercised via the "Do Not Sell or Share My Personal Information" link.

This is another new right from the CPRA (Civil Code § 1798.121). The consumer may limit use and disclosure of their sensitive personal information to essential purposes: providing the requested product or service, security and integrity, and legal compliance. This right is exercised via the "Limit the Use of My Sensitive Personal Information" link.

The business cannot discriminate against consumers who exercise their rights, including denying products, charging different prices, or offering lower quality (Civil Code § 1798.125).

Under Civil Code § 1798.130(a)(2):

45 days to respond from receipt of the verified request.

Extension of +45 days when reasonably necessary, with consumer notification within the initial period.

Free up to 2 times per year per consumer. For a third or subsequent request within the same 12-month period, the business may charge a reasonable fee.

The 45-day deadline applies to know/access, deletion, correction, and portability requests, and for confirmation that opt-outs and limitations have been applied.

The CPRA is explicit: the business cannot require the consumer to create an account or go through more than two steps to exercise the opt-out of selling and sharing (Civil Code § 1798.120(c)).

The opt-out process must:

Be direct and accessible via the "Do Not Sell or Share My Personal Information" link.

Not require creation of a new account.

Not involve more than two steps to opt-out confirmation.

Honor the Global Privacy Control (GPC) as a valid form of opt-out.

Be free of charge.

For access, deletion, correction, and portability requests, the business may verify the consumer's identity using methods reasonably designed to verify that the requesting person is the consumer about whom data was collected (Civil Code § 1798.130(a)(2)).

Verification must be proportionate to the type of data involved. For low-risk data, email confirmation may be sufficient. For more sensitive data, a second verification factor may be justified.

What is never acceptable: requiring more information than necessary to verify identity, or creating deliberately burdensome processes to discourage requests.

The business cannot require the consumer to provide their password to exercise their rights.

The consumer may designate an authorized agent to submit requests on their behalf (Civil Code § 1798.130(a)(2)(C)).

For opt-out requests: the business must respect the agent's request if the consumer has provided the agent with signed written permission, or upon reasonable verification of both the consumer's identity and the agent's authority.

The Global Privacy Control (GPC) functions as a form of technological authorized agent: by activating the GPC, the consumer is designating their browser configuration as an agent to transmit the opt-out.

The business may deny when:

It cannot verify the consumer's identity.

The request applies to information collected before January 2022 (for CPRA enforcement, except for the right to access).

There is a legal exception justifying retention.

In all cases, the denial must be communicated to the consumer, with:

Justification for the denial.

Information on how to contact the CPPA to submit a complaint.

The CPRA has specific rules for minors that directly affect the Privacy Portal.

For consumers under 16, the business cannot sell or share personal information without active opt-in. If the business receives a DSAR related to opt-out from a consumer under 16, that is moot because opt-in should never have occurred without permission.

If a consumer under 16 declined or revoked opt-in, the business must wait 12 months before requesting consent again for selling or sharing.

For consumers under 13, consent was given by parents or guardians. DSARs from consumers under 13 must be processed in coordination with parents or legal guardians.

Penalties for violations involving data of consumers under 16 are tripled and automatic: up to US$ 7,500 per violation, without needing to prove intent.

The CPRA preserves and expands the private right of action that the CCPA introduced. This is a key differentiator from other US state laws like the VCDPA, OCPA, and CTDPA, which have no private right of action.

Consumers can sue the business directly when there is an unauthorized data security breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information in specified categories.

Minimum damages are US$ 100 to US$ 750 per consumer per incident, or actual damages, whichever is greater. Class actions are permitted.

Civil Code § 1798.125 prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is loyalty, rewards, premium features, or discount programs where the difference is reasonably related to the value the business derives from the data, provided the consumer participates voluntarily.

Each processed request must be documented. This includes:

Date and time of receipt.

Type of request and right exercised.

Identity verification process conducted.

Action taken (fulfilled, denied, or alternative adopted).

Date and form of response to the consumer.

If denied: justification recorded.

This documentation is what protects the business during a CPPA investigation.

AdOpt records every consent, opt-out from selling and sharing, and SPI use limitation interaction, with a timestamp and unique identifier. When the consumer opts out via the site link or via the GPC, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the CPPA. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.

Request submission channel described in the privacy policy (Civil Code § 1798.130).

"Do Not Sell or Share My Personal Information" link visible on homepage and collection pages (Civil Code § 1798.120).

"Limit the Use of My Sensitive Personal Information" link if SPI is collected (Civil Code § 1798.121).

GPC honored as a valid form of opt-out from selling and sharing.

Coverage of all rights: know, access, deletion, correction, portability, opt-out from selling/sharing, SPI limitation, non-discrimination.

Right to correct described with process and 45-day deadline (Civil Code § 1798.106).

Right to limit SPI described with process and 45-day deadline (Civil Code § 1798.121).

Opt-out without unnecessary multiple steps (maximum 2 steps to confirmation).

Authorized agents accepted for request submission (Civil Code § 1798.130 a(2)(C)).

Deadlines: 45 days to respond (+45 ext.); reasonable period for appeals.

Free service for up to 2 requests per consumer per year (Civil Code § 1798.130 a(3)).

Documented record of each request, action taken, and response sent.

Protection for consumers under 16: mandatory opt-in for selling/sharing.

12-month waiting rule after consumers under 16 decline consent.

Information about CPPA for submitting complaints after denials.

1. What is the new right to correct data under the CPRA and how must the Privacy Portal accommodate it?
The right to correction (Civil Code § 1798.106) was added by the CPRA and did not exist under the CCPA. It allows consumers to request correction of inaccurate personal information maintained by the business. The Privacy Portal must have a specific option to request data correction, describe the verification and correction process, and respond within 45 days informing whether the correction was made or justifying why it was not possible. The business may maintain original data if it believes it is accurate, but must document the correction request and communicate the outcome to the consumer.

2. How does the right to limit use of sensitive personal information (SPI) work?
The right to SPI limitation (Civil Code § 1798.121) allows consumers to instruct the business to limit use of their sensitive personal information to essential purposes: providing the requested product or service, security, debugging, internal research, and compliance. The Privacy Portal must have a mechanism to receive this request, or the business must provide the "Limit the Use of My Sensitive Personal Information" link that leads to a page where this right can be exercised without multiple steps.

3. Why is the GPC a valid form of opt-out under the CPRA?
The CPPA confirmed in its guidance that the Global Privacy Control (GPC) is a valid technological form of opt-out from selling and sharing personal information under the CPRA. By activating the GPC, the consumer is automatically instructing each site visited not to sell or share their data. Ignoring the GPC when a visitor has it enabled is equivalent to ignoring an explicit opt-out, which constitutes a CPRA violation. A properly configured CMP detects the GPC and automatically blocks advertising trackers for visitors who have it enabled.

4. Does the CPRA have an appeal process for consumers whose requests were denied?
The CPRA does not have a formal structured appeal process like the OCPA and CTDPA. When the business denies a request, it must inform the consumer that they can submit a complaint to the California Privacy Protection Agency (CPPA). The CPPA complaint process is the primary avenue of recourse for consumers whose requests were denied without adequate justification.

5. How should the Privacy Portal handle requests from parents on behalf of minor children?
For consumers under 13, parents or legal guardians are the holders of the consent right. A DSAR submitted by a parent on behalf of a child under 13 must be processed the same way as a request from the consumer themselves, after reasonable verification of the parent/guardian relationship. For teenagers aged 13 to 15, the business may require the teenager themselves to submit the request, since the law recognizes teenagers' ability to exercise their own rights, while opt-in for selling/sharing remains required.

Ready to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.

California CPRA compliance rests on documents that need to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data.
For Canada, the access request rules under federal law are covered in our PIPEDA DSAR privacy portal guide.