skip to content

Under the CCPA, a fitness-tracker user switching to a rival device asks for her data — what does the portability requirement demand of the format?

level: middleimportance: nice to knowfreq 27%

answer

  1. part of the right to know
  2. easily understandable
  3. machine-readable where feasible
  4. transmit without hindrance
  5. switching is not a disclosure

basics

~20 s

Under Civil Code 1798.130(a)(3)(B)(iii), the specific pieces must be easily understandable and, to the extent technically feasible, in a structured, commonly used, machine-readable format she can transmit to another entity without hindrance, free of charge.

solid answer

~50 s

The CCPA's portability requirement lives inside the right to know specific pieces. Civil Code `1798.130(a)(2)(A)` requires the disclosure free of charge, in writing, through her account if she has one or by mail or electronically at her option, 'in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance'. `1798.130(a)(3)(B)(iii)` adds that the specific pieces must be easily understandable to the average consumer and, **to the extent technically feasible**, in a **structured, commonly used, machine-readable** format. A transfer she instructs when switching services is not treated as a disclosure by the business. Under 11 CCR 7024(g), a secure self-service portal can satisfy the request if it discloses everything she is entitled to. The protected values in 7024(d), such as passwords and government ID numbers, are still withheld.

code

json · 22 lines
json
{
  "exportGeneratedAt": "2026-09-25T10:00:00Z",
  "lookbackStart": "2025-09-25",
  "identifiers": {
    "email": "[email protected]",
    "deviceId": "trk-8f21c0"
  },
  "workouts": [
    {
      "start": "2026-09-20T06:12:00Z",
      "type": "run",
      "distanceMeters": 8420,
      "heartRateAvgBpm": 151,
      "gpsTrackFile": "workouts/2026-09-20-run.gpx"
    }
  ],
  "inferences": {
    "fitnessScore": 72,
    "fitnessScoreMeaning": "Estimated cardio fitness, 0-100"
  },
  "withheldTypes": ["account password", "security questions and answers"]
}

go deeper

for a junior

Recall that CCPA specific pieces must be given in a portable, readily useable format that the consumer can move to another service, free of charge.

for a middle

Explain the two provisions of 1798.130, the 'technically feasible' qualifier on machine-readability, and the switching-services sentence.

for a senior

Show how you would build it: a documented export schema, portal delivery under 11 CCR 7024(g), secure transmission and the protected-value filter.

for a principal

Decide whether to invest in export formats other services can ingest: customer churn from easy switching against trust and regulatory expectations.

## Where portability sits in the CCPA Under the CCPA as amended by the CPRA, there is no free-standing 'portability' section. The requirement is part of how a business answers a request for **specific pieces** of personal information under `1798.110`. Two provisions of Civil Code `1798.130` set it: - `1798.130(a)(2)(A)`: the business must disclose and deliver the required information **free of charge**, in writing, through the consumer's **account** if she has one, or **by mail or electronically at her option** if she does not, 'in a **readily useable format** that allows the consumer to transmit this information from one entity to another entity **without hindrance**'. - `1798.130(a)(3)(B)(iii)`: the specific pieces must be provided 'in a format that is **easily understandable** to the average consumer, and to the extent **technically feasible**, in a **structured, commonly used, machine-readable format** that may also be transmitted to another entity at the consumer's request without hindrance'. ## What the format test demands | Property | What it rules out | What satisfies it | |---|---|---| | Easily understandable | Raw database dumps with internal codes and no field names | Labelled fields, units stated, plain explanations | | Structured and machine-readable (where technically feasible) | A PDF screenshot of the profile page | A structured export such as JSON or CSV | | Commonly used | A proprietary format only the business's own software reads | Formats that other services can ingest | | Transmittable without hindrance | Exports locked behind encryption she cannot open, or rate limits that block download | A downloadable file she controls | 'To the extent technically feasible' qualifies the machine-readable requirement; it does not excuse an unreadable format when a structured export is easy to produce. ## The switching-services rule `1798.130(a)(3)(B)(iii)` ends with a sentence that matters to a fitness-tracker company losing a customer: 'Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer's personal information from one business to another in the context of switching services.' A transfer she directs to the rival device maker is her act, not a disclosure by the business. The text requires a **format** that can be moved without hindrance; it does not spell out a duty to build a direct connection to any particular competitor. ## Delivery mechanics the regulations add - **Self-service portal.** Under 11 CCR 7024(g), a business with password-protected accounts may meet a request to know through a secure self-service portal where she can access, view and receive a **portable copy**, provided the portal discloses everything she is entitled to, uses reasonable security controls, and meets the verification rules. - **Secure transmission.** 7024(f) requires reasonable security when transmitting personal information to the consumer. - **Protected values.** 7024(d) still applies: government ID numbers, financial account numbers, health insurance or medical ID numbers, passwords, security answers and unique biometric data are not included; she is told the type is held. - **Security and integrity data** are not specific pieces (`1798.130(a)(3)(B)(iii)`). ## Fees and frequency The disclosure is **free of charge**. The only fee route in the title is for requests that are **manifestly unfounded or excessive**, in particular because repetitive, under `1798.145(h)(3)`, and the business bears the burden of showing that. Separately, a business need not answer the same consumer's requests to know more than twice in 12 months (`1798.130(b)`). ## Why it is asked For an engineer, the question tests whether the export is designed as a product: a documented schema, stable field names and units, one file per data domain, and a delivery path through the account. Treating portability as 'email a PDF' misses the machine-readable requirement wherever a structured export is technically feasible.

  • Is a PDF of the account settings page enough to meet the CCPA format requirement?
    Usually not. Civil Code 1798.130(a)(3)(B)(iii) requires a structured, commonly used, machine-readable format to the extent technically feasible. A business that holds the data in structured form can normally export it that way, so a rendered page falls short of the requirement even if it is easy to read.
  • Does the consumer-directed transfer to the rival count as the business selling her data?
    No. The same subparagraph says personal information is not considered to have been disclosed by a business when the consumer instructs it to transfer her data from one business to another in the context of switching services, so the transfer is not a disclosure by the business.

saying these in an interview costs you the question

  • Says a PDF screenshot of the profile page is enough when a structured export is feasible
  • Believes the CCPA contains no portability requirement at all
  • Charges an ordinary requester a fee for producing the portable copy
  • Assumes the CCPA text mandates a direct live connection to the rival
  • Treats a consumer-directed transfer as the business disclosing her data