Published: Aug 12, 2025
Next up in our LOCKED series, we will cover your right to correct and right to know under the California Consumer Privacy Act (CCPA). This is the second blog post in the series. If you missed our first post, review our blog on your right to limit and right to opt-out before you start.
California residents have the right to know and correct the information businesses have about them. Under the law, businesses must provide instructions in their privacy policy on how to exercise these rights, along with your other privacy rights. These rules apply to businesses covered under the CCPA.
Right to Know
As a Californian, you have the right to know what personal information a business has collected about you. You can request this information from a business up to two times per year, free of charge.
The business is required to provide you with all the personal information they’ve collected about you. This includes:
- The categories and specific pieces of personal information the business has collected about you (e.g. email address, browsing history, location data)
- The categories of sources from which they got the information (e.g. your interaction with the business, social media, data brokers)
- Their reason for collecting, selling, or sharing your information (e.g. to provide you with services, personalized advertising, market research)
- The types of entities they’ve shared your information with (e.g. advertising firms, data brokers, affiliated businesses)
The information must be provided to you in an accessible format — meaning it should be easily understood, usable, and compliant with the Americans with Disabilities Act. It also must be provided in a portable format — a format that allows you to keep the information and store it where you would like.
Right to Correct
If you notice a business has incorrect information about you, you can exercise your right to correct. This can be important because inaccurate information might result in the denial of services, bills getting sent to the wrong place, or could create other logistical issues due to misidentification.
Sometimes, a business enters your information incorrectly or collects it from an inaccurate source. In some instances, your information may need to be updated due to:
- A last name change
- A citizenship change
- A change of address
- A new phone number
When reaching out to the business, be specific about what information needs to be fixed, and provide them with the correct information.
For both requests to know and requests to correct, the business must confirm that they received your request within 10 business days and respond within 45 calendar days. The business will require you to verify your identity to prevent your information from getting into the wrong hands or doing you harm. If necessary, the business may also take an additional 45 days to respond but must provide you with notice and explanation for the delay.
Why it Matters
Understanding and exercising your rights under the CCPA is crucial for maintaining control over your personal information. By knowing what information businesses have about you and ensuring its accuracy, you can protect yourself from potential misuse or errors that could impact your daily life.
Additionally, with the right to know, you can understand how a business received your information, what they are doing with it, and who they are sharing it with. This can help you decide if you want to exercise your other privacy rights, such as your right to delete or opt-out of the sale and sharing of your personal information.
As always, if you feel that your privacy rights have been violated, submit a complaint with the CPPA.
For the final post in the LOCKED series, we will go over the right to equal treatment by businesses and the right to delete. Remember to follow us on social media or check back in one week for the last post in the series.