1. (a) A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to delete, requests to correct, and requests to know.
2. (b) A business that does not fit the description in subsection (a) shall provide two or more designated methods for submitting requests to delete, requests to correct, and requests to know. One of those methods must be a toll-free telephone number. If the business maintains an internet website, one of the methods for submitting these requests shall be through its website, such as through a webform. Other methods for submitting requests to delete, requests to correct, and requests to know may include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail.
3. (c) A business shall consider the methods by which it primarily interacts with consumers when determining which methods to provide for submitting requests to delete, requests to correct, and requests to know. If the business interacts with consumers in person, the business shall consider providing an in-person method such as a printed form the consumer can directly submit or send by mail, a tablet or computer portal that allows the consumer to complete and submit an online form, or a telephone with which the consumer can call the business's toll-free number.
4. (d) A business may use a two-step process for online requests to delete where the consumer must first, submit the request to delete and then second, separately confirm that they want their personal information deleted provided that the business otherwise complies with section 7004.
5. (e) If a business maintains personal information for longer than 12 months, its method for consumers to submit requests to know shall include a means by which the consumer can request that the business provide personal information collected prior to the 12-month period preceding the business's receipt of the consumer's request. For example, the business may ask the consumer to select or input the date range for which the consumer is making the request to know or present the consumer with an option to request all personal information the business has collected about the consumer. Use of this method is not required for personal information collected prior to January 1, 2022, pursuant to Civil Code section 1798.130, subdivision (a)(2)(B).

6. (f) If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall either:

   1. (1) Treat the request as if it had been submitted in accordance with the business's designated manner, or
   2. (2) Provide the consumer with information on how to submit the request or remedy any deficiencies with the request, if applicable.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.130, 1798.140 and 1798.185, Civil Code.

History

1. Change without regulatory effect adopting article 3 heading and renumbering section 999.312 to new section 7020 filed 5-5-2022 pursuant to section 100, title 1, California Code of Regulations (Register 2022, No. 18).

2. Amendment of section heading, section and Note filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section 11343.4(b)(3) (Register 2023, No. 13).

3. New subsection (e) and subsection relettering filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).