Right to Know

A CCPA/CPRA consumer right enabling individuals to request disclosure of personal information a business has collected, sold, or shared about them over the preceding 12 months. Under Section 1798.100, consumers can request: categories of personal information collected, categories of sources, business or commercial purposes for collection or sale, categories of third parties with whom information is shared, and specific pieces of personal information collected. Businesses must provide this information free of charge twice in a 12-month period, responding within 45 days (extendable by 45 days). Information should be provided in a readily usable, portable format that allows consumers to transmit it to another entity. The right to know parallels GDPR's access right but uses CCPA-specific terminology about 'categories' and 'specific pieces' of information. Organizations should implement processes for verifying identity, compiling responsive information, presenting it clearly, and tracking requests to enforce frequency limits.