Track a California privacy request's response dates

Build a timeline from the evidence you have

1. Save the exact request, the business's designated submission route and the date sent. Record evidence of receipt separately; a draft or an unsent form does not establish receipt.
2. For a request to know, delete or correct, record the 10-business-day acknowledgment period and the 45-calendar-day response period described by CalPrivacy.
3. If the business gives notice of an extension, save its explanation and revised date. The additional period can be up to 45 calendar days, for 90 days in total.
4. For sale or sharing opt-outs and requests to limit sensitive-information use, use the rule requiring compliance as soon as feasible, within 15 business days of receipt.
5. Record verification questions, your replies and the substantive response as separate events. Mark an uncertain receipt date as uncertain rather than calculating a definite deadline from it.

Verification does not restart the response period

For requests to know, delete or correct, the current California regulation starts the response period when the business receives the request, including time spent verifying it. A business that cannot verify the requester may deny the request; an acknowledgment is not an approval.

These periods concern covered CCPA requests. They are not promises about when paper mail will disappear, and they do not set a deadline for an ordinary catalog-removal request.

Follow up with the missing event

If an expected response is missing, send the business the request reference, receipt evidence and the unanswered question. Check any denial or extension explanation before describing what failed to happen. Keep your timeline if you later decide to report a privacy concern.

Official sources

• CalPrivacy: response time frames for consumer requests
• CalPrivacy: current CCPA regulations, section 7021