Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance

Can I skip verifying consumer requests in California?

Verifying Consumer Requests in CaliforniaUnder the California Consumer Privacy Act (CCPA), a business must establish, document, and comply with a reasonable method for verifying that the person making a request to delete, request to correct, or request to know is the consumer about whom the business has collected information [2.1]. Therefore, verifying the identity of the requestor is a crucial step in processing consumer requests.Methods for Submitting Requests to Delete, Requests to Correct, and Requests to KnowA business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to delete, requests to correct, and requests to know. A business that does not fit the description in subsection (a) shall provide two or more designated methods for submitting requests to delete, requests to correct, and requests to know. One of those methods must be a toll-free telephone number. If the business maintains an internet website, one of the methods for submitting these requests shall be through its website, such as through a webform. Other methods for submitting requests to delete, requests to correct, and requests to know may include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail [1.2].Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to KnowBusinesses shall respond to a request to delete, request to correct, and request to know no later than 45 calendar days after receipt of the request. The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request. If the business cannot verify the consumer within the 45-day time period, the business may deny the request. If necessary, businesses may take up to an additional 45 calendar days to respond to the consumer's request, for a maximum total of 90 calendar days from the day the request is received, provided that the business provides the consumer with notice and an explanation of the reason that the business will take more than 45 days to respond to the request [1.3].Can a Company Skip Verifying Consumer Requests in California?No, a company cannot skip verifying consumer requests in California. A business shall establish, document, and comply with a reasonable method for verifying that the person making a request to delete, request to correct, or request to know is the consumer about whom the business has collected information [2.1]. If a business cannot verify the identity of the requestor pursuant to the regulations set forth in Article 5, the business may deny the request to correct or delete [1.1][1.4]. However, the business shall inform the requestor that their identity cannot be verified [1.1][1.4]. Therefore, verifying the identity of the requestor is a crucial step in processing consumer requests, and a company cannot skip this step.