California: CCPA and CPRA

California residents have the strongest data privacy rights in the United States. Here is what you can do.

Your rights under the CCPA/CPRA

Right to Know: Ask any company what personal data they have collected about you in the past 12 months — the specific pieces of data, the categories, the sources, and who it was shared with.
Right to Delete: Tell a company to delete the personal data they have collected about you. They must also tell any third parties they shared your data with.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: Tell a company to stop selling or sharing your personal information with third parties. They must comply within 15 business days.
Right to Limit Use of Sensitive Information: Restrict how companies use sensitive data like your precise location, race, health information, or financial data.
Right to Non-Discrimination: Companies cannot charge you more, give you worse service, or deny you service because you exercised your rights.

Deadline: Companies must respond within 45 days. They can extend to 90 days but must notify you within the first 45. The opt-out of sale is faster: 15 business days.

How to exercise your rights

Use the company directory to find the company. Each page shows the privacy contact, step-by-step instructions, and a link to the company's privacy request form. Use the CCPA deletion template or access template if you prefer email.

California DROP — Data Broker deletion in one place

The California Delete Request for Online Personal information (DROP) portal lets California residents submit a single request to multiple registered data brokers at once. Instead of contacting each data broker individually, you submit one request through the state and they do the distribution.

Who qualifies: California residents only.
What it covers: Registered data brokers only — companies that buy and sell personal data as their primary business. It does not cover social media platforms, retailers, or other companies that collect your data incidentally.
How to use it: Visit the California DROP portal. You will need to verify your identity.
Timeline: Data brokers must comply within 45 days.

For companies not covered by DROP — including most social media platforms, apps, and retailers — use the company pages in our directory.

Where to complain if a company ignores you

California Privacy Protection Agency (CPPA) — file online at cppa.ca.gov. Include the date of your request, the company's response (or non-response), and documentation of the missed deadline.

The difference between CCPA and GDPR

If you are a California resident but also covered by the GDPR (for example, you are an EU citizen living in California), you can exercise rights under either law. The GDPR generally gives stronger rights and shorter deadlines. See our EU rights guide for a comparison.