When people think about exercising their privacy rights under laws like the CCPA, deletion usually comes to mind first — "just make them get rid of my data." But deletion isn't always the right first move, and sending it too early can mean you never actually find out what a company has been doing with your information.
Two Different Rights, Two Different Letters
The California Consumer Privacy Act (as amended by the CPRA) actually grants consumers several distinct rights, and two of the most commonly used are:
- Right to Know / Right to Access (Cal. Civ. Code §1798.100 and §1798.110) — asks a business to disclose what personal information it has collected, where it came from, why it collects it, and who it's been shared with.
- Right to Delete (Cal. Civ. Code §1798.105) — asks a business to delete personal information it holds about you.
These aren't interchangeable. If you send a deletion request first, you may never learn what data the company actually had, how it was sourced, or who it was shared with — because it's gone before you got to see it.
When to Use a Right to Know Request
Send a disclosure request first when you want to understand the scope of what's being collected before deciding what to do about it — for example, before closing an account, before deciding whether to keep using a service, or simply because you're curious what an app has inferred about you from your usage.
What a Proper Request Should Include
A complete right-to-know request should ask for five things: the categories of personal information collected, the specific pieces of personal information collected, the categories of sources it came from, the business purpose for collecting it, and the categories of third parties it's been shared with or sold to. Missing any of these gives the company room to provide a partial answer.
The 45-Day Clock
Under Cal. Civ. Code §1798.130(a)(2), a business must confirm receipt of a verifiable request within 10 business days and generally respond within 45 days, with one possible 45-day extension if you're notified. Track this date — if a company misses it without explanation, that's worth following up on, or escalating to the California Privacy Protection Agency.
What About Non-California Residents?
The CCPA's guaranteed rights apply to California residents. That said, many companies have chosen to extend the same disclosure process to users nationally to keep one consistent privacy policy — it's still worth sending the request, just with the expectation that it may be handled as a courtesy rather than under a binding legal deadline.
Bottom Line
Know before you delete. A right-to-know request costs you nothing but a letter and 45 days of patience, and it gives you the full picture before you decide whether deletion is actually the next step you want to take.
Frequently Asked Questions
A deletion letter asks a company to erase your data. This tool generates a disclosure request that asks the company to tell you what data it holds, where it came from, and who it's been shared with — without asking them to delete anything.
Yes — the CCPA "Right to Know" Data Access Request Generator does exactly this. It's a one-time $5.99 purchase — no subscription, no account required.
The CCPA's guaranteed statutory rights apply to California residents, but the tool lets you select another state too — it explains that outside California, the request relies on a company's own willingness to honor it nationally rather than a binding legal deadline.
For California residents, the CCPA requires a response within 45 days (with one possible 45-day extension). The tool calculates this deadline automatically, but it can't guarantee a company's compliance — it's a properly formatted request, not a legal filing.
Yes — you can check or uncheck each of the five disclosure categories (categories collected, specific pieces, sources, business purpose, and third parties) before generating the letter.