California has the strongest consumer privacy protections in the United States. If you are a California resident, you have powerful rights over your personal data — including the right to know what companies collect about you, the right to delete that data, and the right to stop the sale of your personal information. This guide breaks down everything you need to know about California's privacy laws and how to use them to protect yourself.
The CCPA and CPRA: California's Privacy Framework
California's privacy protections are built on two landmark laws:
- The California Consumer Privacy Act (CCPA), signed into law in 2018 and effective January 1, 2020, established foundational privacy rights for California consumers.
- The California Privacy Rights Act (CPRA), approved by voters in November 2020 as Proposition 24, amended and expanded the CCPA with additional protections effective January 1, 2023.
Together, these laws give California residents the most comprehensive set of data privacy rights available to any U.S. consumers. They apply to businesses that collect personal information from California residents and meet certain revenue or data volume thresholds.
Your Rights Under California Privacy Law
As a California resident, you have the following rights:
Right to Know
You can request that any covered business disclose what personal information they have collected about you, where they got it, why they collected it, and who they shared it with. Businesses must respond to your request within 45 days.
Right to Delete
You can request that a business delete the personal information they have collected from you. With some exceptions — such as data needed to complete a transaction or comply with legal obligations — businesses must honor your deletion request.
Right to Opt Out of Sale or Sharing
You can tell businesses to stop selling your personal information or sharing it for cross-context behavioral advertising. Businesses must provide a clear "Do Not Sell or Share My Personal Information" link on their website.
Right to Correct
If a business has inaccurate personal information about you, you can request that they correct it.
Right to Limit Use of Sensitive Information
You can restrict how businesses use your sensitive personal information — such as your Social Security number, financial account information, precise geolocation, race, ethnicity, health data, and biometric information.
Right to Non-Discrimination
Businesses cannot deny you services, charge you different prices, or provide a different quality of service because you exercised your privacy rights.
How to Exercise Your Rights
To exercise any of these rights, look for the "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link on a company's website. You can also submit requests directly through a company's privacy or customer service contact. Businesses must respond within 45 days and cannot charge you a fee for making a request.
2026 Updates: New Regulations in Effect
In September 2025, the California Privacy Protection Agency (CPPA) finalized a major package of new regulations that took effect on January 1, 2026. Key updates include:
- Automated decisionmaking rights. Consumers now have the right to receive notice about, access information regarding, and opt out of businesses' use of automated decisionmaking technology — including AI-powered systems that make decisions about employment, housing, insurance, and credit.
- Enhanced opt-out mechanisms. New rules strengthen how businesses must honor opt-out signals, including browser-based Global Privacy Control (GPC) settings.
- Stricter enforcement. The CPPA, the first dedicated data privacy enforcement agency in the United States, has expanded its investigative and audit capabilities.
The California DELETE Act and DROP
In addition to the CCPA/CPRA, California passed the DELETE Act (SB 362), which specifically targets data brokers. Key provisions:
- All data brokers must register with the California Privacy Protection Agency.
- The Delete Request and Opt-Out Platform (DROP) launched on January 1, 2026, allowing California residents to submit a single deletion request that goes to every registered data broker simultaneously — over 500 companies.
- Data brokers must honor these requests and delete your personal information at no cost to you.
DROP Has Limitations
While the DROP platform is a significant step forward, it only applies to data brokers registered in California. Many people search sites and data aggregators operate outside California's jurisdiction or may not comply promptly. For comprehensive protection, consider using a data removal service like PrivacyOn that actively monitors and removes your data from 100+ brokers nationwide.
What Counts as "Personal Information"?
California's privacy laws define personal information broadly. It includes:
- Name, address, email, phone number, Social Security number
- Purchase history and browsing history
- Geolocation data
- Biometric information (fingerprints, face recognition data)
- Internet activity (search history, browsing behavior)
- Employment and education information
- Inferences drawn about you (consumer profiles, preferences)
How to Take Action Today
Knowing your rights is the first step. Here is how to put them into practice:
- Search for yourself online. Google your name and check people search sites to see what information is publicly available.
- Submit opt-out requests. Use the "Do Not Sell" links on websites you use and submit requests to data brokers to delete your information.
- Use California's DROP platform. If you are a California resident, submit a deletion request through DROP to reach all registered data brokers at once.
- Enable Global Privacy Control. Install the GPC browser extension or use a browser that supports it (like Firefox or Brave) to automatically signal your opt-out preferences to every website you visit.
- Sign up for PrivacyOn. For comprehensive protection that goes beyond what any single law can provide, PrivacyOn removes your data from 100+ data broker sites, monitors for re-listings, and provides ongoing protection — regardless of where the data broker is based.
California's privacy laws give you powerful tools, but exercising those rights across hundreds of companies requires time and persistence. PrivacyOn automates the process so you can enjoy the protections you deserve without the hassle.