Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I skip verifying consumer requests in California? What are the requirements?

Verifying Consumer Requests in California

Under the California Consumer Privacy Act (CCPA), a business shall establish, document, and comply with a reasonable method for verifying that the person making a request to delete, request to correct, or request to know is the consumer about whom the business has collected information [3.1]. Therefore, businesses cannot skip verifying consumer requests in California.

Requirements for Verifying Consumer Requests

The CCPA requires businesses to consider several factors when determining the method by which they will verify the consumer’s identity, including the type, sensitivity, and value of the personal information collected and maintained about the consumer, the risk of harm to the consumer posed by any unauthorized deletion, correction, or access, and the likelihood that fraudulent or malicious actors would seek the personal information [3.1].

Businesses must also avoid collecting certain types of personal information unless necessary for the purpose of verifying the consumer and generally avoid requesting additional information from the consumer for purposes of verification [3.1].

If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall either treat the request as if it had been submitted in accordance with the business’s designated manner or provide the consumer with information on how to submit the request or remedy any deficiencies with the request, if applicable [2.1].

Conclusion

In summary, businesses cannot skip verifying consumer requests in California. They must establish a reasonable method for verifying the consumer’s identity and consider several factors when determining the method of verification. If a consumer submits a deficient request, the business must either treat the request as if it had been submitted in accordance with the business’s designated manner or provide the consumer with information on how to submit the request or remedy any deficiencies with the request [2.1][3.1].

Source(s):
Jurisdiction

California