Under the CCPA, a fitness-tracker user who joined in 2020 asks for everything held on her — what period and which records must the response cover?

## The default window Under the CCPA as amended by the CPRA, Civil Code `1798.130(a)(2)(B)` says the disclosure in response to a request to know 'shall cover the 12-month period preceding the business' receipt of the verifiable consumer request'. That is the answer to an ordinary request: the last **12 months**, counted back from when the business received it. ## Asking for more The same subparagraph lets the consumer ask for a longer period once a regulation is adopted under `1798.185(a)(8)`. The CCPA regulations did so in **11 CCR 7024(h)**: 1. A consumer may request personal information the business collected **beyond the 12-month period**. 2. The right applies only to personal information **collected on or after January 1, 2022** (the same floor appears in the statute). 3. The business must provide it **unless doing so proves impossible or would involve disproportionate effort**. 4. If it relies on that ground, it must give a **detailed explanation** with enough facts for a meaningful understanding of why; it may not simply state that the effort is disproportionate. For the fitness-tracker user who joined in 2020 and asks for everything: | Data collected | Status in the response | |---|---| | In the 12 months before the request | Must be disclosed | | From 2022-01-01 up to that 12-month window | Must be disclosed because she asked, unless impossible or disproportionate with a detailed explanation | | In 2020 and 2021 | Outside the right; the business need not disclose it | ## Which records are in - **Direct and indirect collection.** `1798.130(a)(3)(A)` requires disclosure of personal information collected about the consumer 'directly or indirectly, including through or by a service provider or contractor'. - **Service providers' copies.** 11 CCR 7024(h) says the response includes personal information that service providers or contractors collected under their written contracts with the business, and 7024(i) obliges them to assist, by handing it over or enabling access. - **All stores.** Workout history, device telemetry, support tickets and derived fitness scores are all personal information if they relate to her. ## What may be left out - **Unsearchable compliance archives.** Under 11 CCR 7024(c), the business need not search for personal information if **all** of these hold: it is not kept in a searchable or reasonably accessible format; it is kept solely for legal or compliance purposes; it is not sold or used for any commercial purpose; and the business describes to the consumer the categories of records it did not search. - **Protected values.** Under 7024(d), government ID numbers, financial account numbers, health insurance or medical ID numbers, passwords, security answers and unique biometric data are not sent back; the business says it holds that type. - **Security and integrity data.** `1798.130(a)(3)(B)(iii)` excludes from specific pieces data generated to help ensure security and integrity. ## What the look-back does not require The statute is explicit: 'Nothing in this subparagraph shall require a business to keep personal information for any length of time.' The look-back defines what must be disclosed **if held**; retention is governed elsewhere. A business that deleted 2023 workout data under its retention schedule has nothing to disclose for it. ## Why it is asked Engineers building a request-to-know export have to decide the time filter, and two wrong answers are common: 'last 12 months only, always' and 'everything since sign-up'. The correct design keeps a default 12-month window, supports an extended mode bounded by 2022-01-01, pulls from service providers, and records any disproportionate-effort decision with its reasons.