skip to content

Consumer Rights

4 roadmaps6 questions

Rights to know what was collected, delete it, correct it and receive it in a portable form, plus the ban on penalising anyone who exercises them. Interviewers focus on the difference between disclosing categories and handing over specific pieces, and on how you verify who is asking.

part ofCompliance & governance standardsoverview, primer and where to startread it →
on this pageshow

explore

questions

6

Under the CCPA, what can a consumer learn through the right to know, and how do 'categories' differ from 'specific pieces' of personal information?

level: juniorimportance: must knowfreq 52%

answer

  1. two sections, one right
  2. a description versus the data itself
  3. the statutory category labels
  4. some values are never sent back
  5. 1798.110 and 1798.115

basics

~20 s

Under Civil Code 1798.110 and 1798.115, a consumer can learn the categories of personal information collected, its sources, purposes and recipients by category, what was sold, shared or disclosed, and the specific pieces: the actual data values held.

solid answer

~40 s

The right to know sits in Civil Code `1798.110` and `1798.115`. A **categories** answer describes the business's practice about this consumer: the categories of personal information collected, the categories of sources, the business or commercial purpose, the categories of third parties it discloses to, and, under `1798.115`, what it sold or shared and what it disclosed for a business purpose, in separate lists. Categories must use the statutory terms in `1798.140(v)(1)`, such as identifiers or geolocation data. **Specific pieces** are the data itself: for a fitness-tracker user, her email address, her recorded GPS tracks, the inferences drawn about her. The CCPA regulations (11 CCR 7024) require an individualised categories answer, and bar sending back values such as a Social Security number, account password or security answers; the business confirms it holds that type instead.

go deeper

for a junior

Recall the two halves: categories describe what is collected, from where, why and for whom; specific pieces are the actual data values held about the person.

for a middle

Explain how 1798.110 and 1798.115 divide the right, why categories must use the statutory terms, and which values 11 CCR 7024(d) forbids sending back.

for a senior

Show how you would generate both answers: a category-mapped data inventory for the description and a per-consumer lookup across stores, including service providers' copies.

for a principal

Weigh a self-service export against case-by-case responses: consistency and cost against the risk of over-disclosure when the protected-type filter misses a field.

## Two sections, one right Under the CCPA as amended by the CPRA, the **right to know** is split across two Civil Code sections: - `1798.110` covers what a business **collects**: a consumer may request the categories of personal information collected about them, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, the categories of third parties to whom the business discloses it, and **the specific pieces** of personal information collected. - `1798.115` covers what a business **passes on**: the categories it sold or shared and the categories of third parties that received each, and the categories it disclosed for a business purpose and the categories of persons that received them. `1798.130(a)(4)` requires the sold-or-shared list and the business-purpose list to be kept separate. ## What a categories answer contains A categories answer is a **description**, not a copy. It must: 1. Use the enumerated categories of `1798.140(v)(1)`, as `1798.130(c)` requires: identifiers, commercial information, internet activity, geolocation data, inferences and the rest, plus the sensitive-personal-information categories of `1798.140(ae)`. 2. Name the categories of sources (the consumer's device, the mobile app, a partner) and the purposes. 3. Name the categories of third parties, and for sold, shared or business-purpose disclosures, which category went to which category of recipient. 4. Be **individualised**. Under 11 CCR 7024(j), a business may point to its privacy policy only if its answer would be the same for every consumer and the policy discloses everything the answer must contain. 11 CCR 7024(l) adds that the categories must give the consumer a **meaningful understanding** of what is listed. ## What specific pieces are Specific pieces are the **actual values** held about the consumer. For a fitness-tracker company: | Statutory category (1798.140(v)(1)) | A categories answer says | A specific-pieces answer delivers | |---|---|---| | Identifiers (A) | 'Identifiers such as email address and device identifier' | Her email address and the tracker's device identifier | | Geolocation data (G) | 'Geolocation data from recorded workouts' | The GPS tracks of her runs | | Commercial information (D) | 'Purchase history of devices and subscriptions' | Her order and subscription records | | Inferences (K) | 'Inferences about fitness level and habits' | The fitness score and activity profile computed about her | The disclosure must cover personal information collected **directly or indirectly**, including through a service provider or contractor (`1798.130(a)(3)(A)`). ## What is never sent back verbatim The regulations keep certain values out of the response entirely. Under 11 CCR 7024(d), a business must **not** disclose, in response to a request to know: - a Social Security number, driver's licence number or other government-issued identification number; - a financial account number, or a health insurance or medical identification number; - an account password or security questions and answers; - unique biometric data generated from measurements or technical analysis of human characteristics. Instead, it must say with sufficient particularity that it holds that **type** of information; the regulation's own example is answering that it collects 'unique biometric data including a fingerprint scan' without sending the scan. Separately, `1798.130(a)(3)(B)(iii)` says specific pieces do not include data generated to help ensure security and integrity. ## Limits a candidate should know - **Frequency.** Under `1798.130(b)`, a business need not answer the same consumer's requests under `1798.110` and `1798.115` more than twice in a 12-month period. - **Partial denials.** If an exception or a conflicting law blocks part of a request for specific pieces, 11 CCR 7024(e) requires the business to explain the basis and still disclose the rest. - **Transmission.** 11 CCR 7024(f) requires reasonable security when transmitting the personal information to the consumer. ## Why interviewers ask it The distinction decides what an engineering team must build. A categories answer can be generated from a data inventory that maps each store to statutory categories, sources, purposes and recipients. A specific-pieces answer needs a per-consumer **lookup across every store** that holds her data, including those run by service providers, with a filter that withholds the protected types. Candidates who describe only one of the two have described half the right.

  • Must a categories answer use the business's own labels for its data?
    No. Civil Code 1798.130(c) requires categories to be described using the specific terms in 1798.140(v)(1)(A) to (K), such as identifiers, commercial information and inferences, and the sensitive-personal-information terms of 1798.140(ae). Internal table names or product labels do not satisfy it, though the regulations also require the listing to give the consumer a meaningful understanding.
  • How many times a year must a business answer the same consumer's requests to know?
    Civil Code 1798.130(b) says a business is not obligated to provide the information required by 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period. A confirmation of corrected data under 11 CCR 7023(j) does not count toward that limit.

saying these in an interview costs you the question

  • Thinks a link to the privacy policy always answers a request to know categories
  • Believes the right to know covers only categories, never the data itself
  • Would send the consumer's password or government ID number back in the response
  • Describes categories in internal system labels rather than the statutory terms
  • Merges sold-or-shared and business-purpose disclosures into one list
open as a page

Under the CCPA, a food-delivery app user with an open refund dispute asks for deletion — what must the business delete, keep and pass on?

level: seniorimportance: must knowfreq 50%

basics

~20 s

Under Civil Code 1798.105, the business keeps only what the open dispute or a legal obligation reasonably needs, deletes the rest, uses kept data for nothing else, and notifies service providers, contractors and third parties it sold or shared to.

open as a page

Under the CCPA as amended by the CPRA, a customer says her stored address is wrong — how must the business decide and act?

level: middleimportance: should knowfreq 38%

basics

~20 s

Under Civil Code 1798.106 and 11 CCR 7023, the business weighs the totality of the circumstances, may refuse on accuracy grounds only if the address is more likely than not accurate, and otherwise corrects it and instructs its service providers.

open as a page

Under the CCPA, a fitness-tracker user who joined in 2020 asks for everything held on her — what period and which records must the response cover?

level: middleimportance: should knowfreq 36%

basics

~20 s

By default, the 12 months before the request (Civil Code 1798.130(a)(2)(B)); on her request, earlier data too, but only data collected on or after 2022-01-01 and unless impossible or disproportionate, including what service providers collected for the business.

open as a page

Under the CCPA, when is a discount for customers who let a business keep and use their data a lawful financial incentive rather than discrimination?

level: seniorimportance: should knowfreq 34%

basics

~20 s

Under Civil Code 1798.125, a price or service difference is lawful if reasonably related to the value of the consumer's data, noticed, entered by revocable prior opt-in consent, and not unjust, unreasonable, coercive or usurious.

open as a page

Under the CCPA, a fitness-tracker user switching to a rival device asks for her data — what does the portability requirement demand of the format?

level: middleimportance: nice to knowfreq 27%

basics

~20 s

Under Civil Code 1798.130(a)(3)(B)(iii), the specific pieces must be easily understandable and, to the extent technically feasible, in a structured, commonly used, machine-readable format she can transmit to another entity without hindrance, free of charge.

open as a page