Under the CCPA regulations, how should a business verify requests to know, delete and correct from account holders, non-account holders and authorized agents?

## Intake: the designated methods Before anything can be verified it has to be received. Civil Code **1798.130(a)(1)** and 11 CCR **7020** set the intake rules for requests to know, delete and correct under the CCPA as amended by the CPRA: - **Two or more designated methods**, one of which must be a **toll-free telephone number**. A business that operates **exclusively online** and has a direct relationship with the consumer need only provide an **email address**. - If the business has a **website**, the website must be one of the methods, for example a web form (1798.130(a)(1)(B); 7020(b)). - The methods should reflect how the business primarily interacts with consumers; a business that deals with people in person should consider an in-person option (7020(c)). - The business **may not require the consumer to create an account** to make a request, though an existing account holder may be asked to use it (1798.130(a)(2)(A)). - A request sent the wrong way, or deficient for reasons unrelated to verification, must either be treated as if properly submitted or answered with instructions to fix it (7020(e)). ## The verification standard 11 CCR **7060(a)** requires a business to **establish, document and comply with a reasonable method** for verifying that the requester is the consumer the data is about. In choosing it, the business must match identifying information against what it **already maintains** whenever feasible, avoid collecting high-risk identifiers (the types in Civil Code 1798.81.5(d)) unless needed, and weigh the factors in 7060(c)(3): the sensitivity and value of the data, the harm an unauthorized deletion, correction or disclosure would cause, the likelihood of fraud, how robust the offered proof is, how the business interacts with the consumer, and the technology available. | Request | Non-account holder standard (7062) | Illustration | |---|---|---| | Know **categories** | reasonable degree of certainty | match at least two reliable data points | | Know **specific pieces** | reasonably high degree of certainty | match at least three pieces plus a signed declaration under penalty of perjury | | Delete or correct | reasonable or reasonably high, depending on sensitivity and harm | deleting browsing history vs deleting family photos | If the business cannot verify a request for specific pieces, it must deny that request (7062(f)). If no reasonable method exists at all for some data, it says so and explains why; if it has no reasonable method for any consumer, it explains that in its privacy policy and re-evaluates at least once every 12 months (7062(g)). ## Account holders For a **password-protected account**, the business may rely on its **existing authentication**, provided it follows 7060, and it must require the consumer to **re-authenticate** before deleting, correcting or disclosing data (7061(a)). If it suspects fraud on the account, it must not act until further verification confirms the requester (7061(b)). ## Authorized agents A consumer may act through an **authorized agent**. Under 7063(a) the business **may** require the agent to show the consumer's **signed permission**, and may also require the consumer to verify their own identity directly or confirm directly that they gave the permission. Those steps do not apply when the agent holds a **power of attorney** under Probate Code 4121-4130, and the business may **not demand** a power of attorney as the price of using an agent (7063(b)). The agent must secure the consumer's information and use it only to fulfil the request, verify, or prevent fraud. ## Handling the verification data itself 1. Ask for additional information only when existing data cannot verify the consumer, and use it only for verification, security or fraud prevention (7060(d)). 2. Delete newly collected verification data as soon as practical after processing, except what record-keeping requires (7060(d)); Civil Code 1798.130(a)(7) bars using it for unrelated purposes. 3. Charge **no fee** for verification; a notarized affidavit may be required only if the business pays for the notarization (7060(e)). 4. For a **correction**, verify with data other than the data being corrected (7060(h)). 5. Keep reasonable security measures that detect fraudulent verification attempts (7060(f)). ## Scope of the verification rule These standards cover requests to **know, delete and correct**. Requests to opt out of sale or sharing and requests to limit are handled differently: 7060(b) forbids requiring identity verification for them. Deidentified data need not be re-identified to verify a request (7060(g)). ## Design pitfalls - One verification level for everything: too weak for specific pieces, needlessly heavy for categories. - Emailing a full data export on the strength of an email match alone. - Requiring an account, a notarized form at the consumer's cost, or a power of attorney. - Keeping the photo ID uploaded for verification in the customer profile indefinitely.