Responding to Consumer Requests (1798.130)

Under the CCPA/CPRA, covered businesses are required to acknowledge and act on verified consumer requests to access, delete, or opt out of the sale of personal information. They must provide a clear response within 45 days, extendable once by another 45 days with notice, and must include required disclosures about the request handling process and any decisions made. This duty ensures consumers can exercise their privacy rights effectively.