Privacy requests

Requests from people in the United States

How Privacyboard handles requests under US state privacy laws such as the CCPA/CPRA: 45-day deadlines, opt-outs in 15 business days, the US notice and the Do Not Sell page.

Updated 3 November 20262 min read

California and a growing number of US states give their residents privacy rights similar to the GDPR, with their own deadlines and a right to opt out of selling or sharing data. Privacyboard handles both.

#Turn it on

In Company profile → Activity, answer US state privacy laws and Selling or sharing data (US). With "Yes":

  • your privacy policy gets a Notice for United States residents section: what you collect and why, who receives it, whether you sell or share it, the rights, how to make a request, Global Privacy Control and appeals;
  • your privacy center gets a Do Not Sell or Share My Personal Information page, linked from the rights section;
  • visitors who say they live in the United States see the US rights in the request form.

For California the law applies above $26 million in yearly revenue, 100,000 people's data, or half of revenue from selling or sharing data. Other states set their own thresholds.

#The US rights

People in the United States can ask to know and access their data, to correct it, to delete it, to receive a copy, to opt out of its sale or sharing (including for targeted advertising) and to limit the use of sensitive personal information.

#Deadlines

RequestReply byExtension
Know, access, correct, delete, copy45 days from receipt45 more days, 90 in total
Opt out of sale or sharing, limit sensitive data15 business daysNone

Unlike the GDPR, the 45 days keep running while you verify the person's identity. Each request shows its rules (GDPR or US state law) and you can change them if a request arrived by email.

#Replies

Requests under US state law use US wording: 45-day periods, an extension of 45 days, and, in a refusal, the right to appeal and to contact the state Attorney General. See Replies and templates.

#FAQ

For cookies and pixels, yes: it honours Global Privacy Control and can show a US-only link (see Regional rules). The Do Not Sell page in your privacy center covers everything else.

#What if a person outside the United States asks to opt out of sale?

In Europe the matching right is the objection to processing, with the GDPR's one-month deadline. The form offers the rights of the place the person says they live.

Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.