Privacy requests
Requests from people in the United States
How Privacyboard handles requests under US state privacy laws such as the CCPA/CPRA: 45-day deadlines, opt-outs in 15 business days, the US notice and the Do Not Sell page.
California and a growing number of US states give their residents privacy rights similar to the GDPR, with their own deadlines and a right to opt out of selling or sharing data. Privacyboard handles both.
#Turn it on
In Company profile → Activity, answer US state privacy laws and Selling or sharing data (US). With "Yes":
- your privacy policy gets a Notice for United States residents section: what you collect and why, who receives it, whether you sell or share it, the rights, how to make a request, Global Privacy Control and appeals;
- your privacy center gets a Do Not Sell or Share My Personal Information page, linked from the rights section;
- visitors who say they live in the United States see the US rights in the request form.
For California the law applies above $26 million in yearly revenue, 100,000 people's data, or half of revenue from selling or sharing data. Other states set their own thresholds.
#The US rights
People in the United States can ask to know and access their data, to correct it, to delete it, to receive a copy, to opt out of its sale or sharing (including for targeted advertising) and to limit the use of sensitive personal information.
#Deadlines
| Request | Reply by | Extension |
|---|---|---|
| Know, access, correct, delete, copy | 45 days from receipt | 45 more days, 90 in total |
| Opt out of sale or sharing, limit sensitive data | 15 business days | None |
Unlike the GDPR, the 45 days keep running while you verify the person's identity. Each request shows its rules (GDPR or US state law) and you can change them if a request arrived by email.
#Replies
Requests under US state law use US wording: 45-day periods, an extension of 45 days, and, in a refusal, the right to appeal and to contact the state Attorney General. See Replies and templates.
#FAQ
#Does the cookie banner cover "Do Not Sell or Share"?
For cookies and pixels, yes: it honours Global Privacy Control and can show a US-only link (see Regional rules). The Do Not Sell page in your privacy center covers everything else.
#What if a person outside the United States asks to opt out of sale?
In Europe the matching right is the objection to processing, with the GDPR's one-month deadline. The form offers the rights of the place the person says they live.
Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.