Your Rights Under GDPR and CCPA: A Complete Guide
Key takeaways
- GDPR and California privacy law have different scope, terminology, exceptions, and request procedures.
- Rights may include access, correction, deletion, or opting out of certain processing, but none is unconditional in every situation.
- Identify the controller and data use before selecting a right; document the request and response.
- Use regulator guidance for current eligibility and escalation, not blanket claims about deadlines or guaranteed outcomes.
Understanding GDPR: The Gold Standard for Data Privacy
The General Data Protection Regulation (GDPR) went into effect on May 25, 2018, and fundamentally changed how companies handle personal data for residents of the European Union and European Economic Area. It is widely considered the most comprehensive data privacy law in the world and has served as a template for privacy legislation globally. Any company that processes data of EU residents must comply, regardless of where the company is located.
GDPR is built on seven core principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Companies must have a lawful basis for processing personal data, such as consent, contractual necessity, or legitimate interest. Violations can result in fines of up to 20 million euros or 4% of annual global turnover, whichever is higher. Since its implementation, regulators have issued over 4.5 billion euros in cumulative fines.
- Right of access: Request a copy of all data a company holds about you
- Right to rectification: Correct inaccurate personal data
- Right to erasure (right to be forgotten): Request deletion of your personal data
- Right to data portability: Receive your data in a machine-readable format to transfer to another service
- Right to object: Object to the processing of your data for direct marketing
- Right to restrict processing: Limit how a company uses your data while disputes are resolved
CCPA and CPRA: Your Rights as a California Resident
The California Consumer Privacy Act (CCPA), effective January 1, 2020, and its amendment the California Privacy Rights Act (CPRA), effective January 1, 2023, give California residents significant control over their personal data. Together, these laws apply to businesses that meet certain thresholds: annual gross revenue exceeding $25 million, handling data of 100,000 or more consumers, or deriving 50% or more of revenue from selling personal information.
Under CCPA/CPRA, you have the right to know what personal information a business collects, the right to delete that information, the right to opt out of the sale or sharing of your data, and the right to non-discrimination for exercising your privacy rights. The CPRA additionally introduced the right to correct inaccurate personal information and the right to limit the use of sensitive personal information. Businesses must respond to consumer requests within 45 days.
The California Privacy Protection Agency (CPPA), established by CPRA, is the first dedicated state-level privacy enforcement agency in the United States. It has the authority to enforce privacy laws, issue fines, and hold businesses accountable. Fines can reach $2,500 per unintentional violation and $7,500 per intentional violation.
How to Exercise Your Privacy Rights
Exercising your rights under both GDPR and CCPA typically involves submitting a formal request to the company holding your data. Most companies provide an online form, a dedicated email address, or a toll-free phone number for privacy requests. Under GDPR, send a Subject Access Request (SAR) to the company's Data Protection Officer. Under CCPA, submit your request through the company's designated privacy page.
When submitting a request, include your full name, the specific right you are exercising (access, deletion, opt-out), and enough information for the company to locate your records. You may need to verify your identity, which typically involves confirming your email address or providing additional identifying information. Keep records of all requests and responses in case you need to file a complaint with a regulatory authority.
- Locate the company's privacy policy or data protection page for their request process
- Specify which right you are exercising (access, deletion, correction, opt-out)
- Provide sufficient information to identify your records (name, email, account details)
- Set a reminder for the response deadline (30 days GDPR, 45 days CCPA)
- File a complaint with the relevant authority if the company does not respond
Key Differences Between GDPR and CCPA
While both laws aim to protect personal data, they differ in several important ways. GDPR applies to all organizations processing EU resident data, while CCPA only applies to businesses meeting specific revenue or data volume thresholds. GDPR requires an affirmative opt-in for data processing (consent must be given), whereas CCPA uses an opt-out model (data can be collected unless you specifically request otherwise).
The scope of protected information also differs. GDPR covers any data that can identify a person, while CCPA specifically includes browsing history, geolocation data, and inferences drawn from other data. GDPR allows individuals to sue companies directly for damages, while CCPA private lawsuits are limited to data breach incidents. Enforcement also differs: GDPR is enforced by independent data protection authorities in each EU member state, while CCPA is enforced by the California Attorney General and the CPPA.
Perhaps the most significant practical difference is that GDPR applies broadly to any controller or processor of personal data, while CCPA primarily targets businesses that sell personal information. This means many smaller companies may be subject to GDPR but exempt from CCPA requirements.
The Expanding Landscape of US State Privacy Laws
As of early 2026, at least 18 US states have enacted comprehensive consumer privacy laws. Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Rhode Island, and Kentucky have all passed privacy legislation with varying effective dates. Each law borrows elements from CCPA but adapts them to the state's specific priorities.
Most state laws include the rights to access, delete, and correct personal data, as well as the right to opt out of targeted advertising and data sales. However, enforcement mechanisms, applicability thresholds, and definitions of personal data vary significantly. Privacy advocates continue to push for a comprehensive federal privacy law that would create a unified standard, but as of 2026 no federal legislation has been enacted. Until then, understanding your state-specific rights remains essential.
Which privacy law applies to your request?
The answer depends on where you are, who processes the data, what activity is involved, and the law's scope. A business operating online is not automatically covered by every privacy statute for every processing activity.
Start by identifying the company named in its privacy notice and the exact personal data at issue. A broker, source agency, and downstream recipient can be separate controllers or businesses with distinct responsibilities.
What can GDPR rights cover?
The GDPR provides rights that can include access, rectification, erasure, restriction, portability, and objection, subject to conditions, legal bases, and exceptions. A person should state the right sought and specify the processing rather than demand an unqualified result.
If the response appears inadequate, consult the relevant data protection authority's guidance and complaint process. Avoid relying on a fixed response-time claim without checking the current text and circumstances.
What should California residents know about CCPA rights?
California's CCPA, as amended, provides rights that can include knowing, deleting, correcting, opting out of sale or sharing, and limiting certain sensitive personal information processing. Coverage and exceptions depend on the law and facts.
Use the CPPA's official FAQ to understand consumer rights and channels. A request about a broker profile may not address public source records or information lawfully retained under an exception.
How can a request stay focused and verifiable?
Specify the account, listing, or categories of data involved, identify the right you are invoking, and preserve the submission and reply. If a company requests verification, assess whether the method is proportionate and use the official contact route.
Do not submit the same broad request to unrelated companies and assume they share obligations. If the issue affects legal rights, employment, credit, or safety, obtain tailored advice rather than relying on a consumer guide.
At a glance
| Question | GDPR approach | California approach |
|---|---|---|
| Who is covered? | Territorial and material scope rules apply | Consumer and business scope rules apply |
| What rights may be relevant? | Access, rectification, erasure, objection, others | Know, delete, correct, opt out, other rights |
| Are rights absolute? | No, conditions and exceptions apply | No, statutory limits and exceptions apply |
| Where to verify | Official GDPR text and supervisory authority | CPPA official consumer guidance |
Make a well-scoped privacy request
Identify your jurisdiction and the organization controlling the data.
Read the company's privacy notice for the proper rights channel.
Name the exact data, profile, and right you are invoking.
Keep the request, verification steps, and response securely.
Escalate through the appropriate regulator if warranted.
Privacy-rights request path
Confirm coverage and controller, select a right, and preserve the outcome.
- Identify location and processing
- Find controller
- Check law and exceptions
- Submit specific request
- Review response and regulator options
Frequently asked questions
Can either law force deletion of every record?
No. Scope conditions, exceptions, and other legal obligations can apply.
Can a service submit rights requests for me?
Some services assist with requests, but they cannot expand the underlying legal right.
Does a broker opt-out remove a source record?
Not necessarily; each holder or source may require a distinct route.
Sources
Related privacy guides
- see the service's removal process
This describes service operations, not a legal determination of rights.
- review available service options
Compare assistance only after identifying the relevant jurisdiction and task.
- check broker-site coverage
Find whether a particular public-facing site is within the stated scope.
- browse related privacy guides
Use additional guides for practical context while checking current official law.
- read the broker-law overview
Compare general legality questions with the specific rights available in each jurisdiction.
More on Privacy & Regulation
- New Privacy Laws in 2026: What Changed and What It Means for You
Several US states passed new privacy legislation this year, and the EU is tightening GDPR enforcement. Here's a breakdown of the most important changes and how they affect your data rights.
- Are Data Brokers Legal? What the Law Actually Says
Data brokers operate legally in most countries despite collecting and selling your information without your consent. Here is what privacy laws actually cover, and the significant gaps that remain.
- How to Stop Data Brokers Legally
About the author
European Privacy & Regulation. Theo covers privacy law and regulation, including how evolving rules affect people’s rights and the ways organizations handle personal data.