Counter-arguments when businesses deny your CCPA/CPRA rights requests
Businesses often deny CCPA requests citing various exemptions or technicalities. Many of these denials are improper. This guide helps you understand when a business's refusal is legitimate and when you should push back or file a complaint.
Business claims they cannot verify that you are who you say you are, and therefore cannot process your request. They may ask for excessive information or simply refuse to engage.
"Your verification requirements are unreasonable under CCPA regulations. I have provided [name, email, account number, etc.] - the same information I used to do business with you. California Code of Regulations section 7062 requires verification to be proportional to the sensitivity of the request. If you truly cannot verify my identity, you must still process opt-out requests and treat deletion requests appropriately. Please specify exactly what additional information you need or process my request."
Business claims they don't meet the CCPA thresholds (annual revenue, data volume, or revenue from selling data) and therefore don't have to comply.
"Please provide documentation supporting your claim that you are not subject to the CCPA. The burden is on the business to prove an exemption applies. If your gross annual revenue (including parent companies and affiliates) exceeds $25 million, or if you process data from 100,000+ California consumers, you are covered. I note that your website includes a 'Do Not Sell My Personal Information' link, which suggests you have determined you are covered."
Business claims your data is exempt from CCPA (e.g., HIPAA-covered health data, GLBA-covered financial data, employee data, B2B contact data).
Many exemptions are partial. Even if health data is HIPAA-exempt, marketing data, website tracking, and other consumer data is still covered by CCPA. Demand they process your request for non-exempt data.
"While certain data may be subject to exemptions, the CCPA still applies to personal information not covered by those exemptions. Please identify specifically: (1) what data you hold about me, (2) which data you claim is exempt and under what specific exemption, and (3) process my request for all non-exempt data. Marketing data, website cookies, and behavioral data are not covered by HIPAA/GLBA exemptions."
In response to a deletion request, business claims they need to retain your data for legal compliance, tax records, fraud prevention, or other legal obligations.
"I understand certain data may be subject to retention requirements, but this exception is narrow. Please: (1) specify exactly what categories of my data you are retaining, (2) identify the specific legal basis for each category, (3) confirm that retained data will only be used for the stated purpose, and (4) delete all personal information not covered by a specific exception. Marketing preferences, browsing history, and behavioral data are not typically required for legal compliance."
In response to opt-out request, business claims they don't "sell" data and therefore don't need to honor the opt-out.
"The CCPA defines 'sale' broadly to include sharing data for 'monetary or other valuable consideration.' Please confirm whether you: (1) use third-party cookies or tracking pixels, (2) participate in ad exchanges or real-time bidding, (3) share data with data brokers or enrichment services, or (4) receive any benefit for data sharing. If so, this likely constitutes a 'sale' or 'sharing' under CCPA/CPRA. Please process my opt-out accordingly."
Business claims you're not entitled to CCPA rights because you don't live in California.
"I am a California resident. My California address is [address]. Under the CCPA, I am entitled to exercise my rights as a California consumer. You may not require me to provide government identification or other excessive documentation to prove residency. I declare under penalty of perjury that I am a resident of California. Please process my request accordingly."
Business claims they need additional time to respond, or claims to have already responded to your request.
"I submitted my request on [DATE]. More than [X] days have passed. I have not received: (1) proper acknowledgment within 10 days, (2) written notice of extension with explanation, or (3) a complete response to my request. Please provide an immediate update on the status of my request and a firm date for completion. If I do not receive a response within [timeframe], I will file a complaint with the California Attorney General."
Business claims your request is "manifestly unfounded or excessive" and they can therefore deny it or charge a fee.
"My request is not manifestly unfounded or excessive. I am simply exercising my statutory rights under the CCPA. The burden is on you to demonstrate that my request is excessive, and you have not done so. A routine request for access to or deletion of my own data cannot be considered 'excessive.' Please process my request or provide a detailed written explanation of why you believe it qualifies for this narrow exception."
In a data breach lawsuit, business claims they implemented reasonable security and therefore aren't liable.
"The fact that unauthorized access occurred demonstrates that your security was not 'reasonable' as required by Civil Code section 1798.150 and the Attorney General's guidance. Please provide: (1) documentation of your security measures at the time of the breach, (2) when you last conducted a security assessment, (3) whether data was encrypted, (4) whether you followed CIS Controls or equivalent framework. Your claim of 'reasonable security' is contradicted by the breach itself."
Business claims any CCPA dispute must go through arbitration per their terms of service.
"While I am reviewing my options regarding private claims, I note that: (1) my right to file a complaint with the California Attorney General is not subject to any arbitration agreement, (2) the arbitration clause may be unconscionable under California law due to [procedural issues - e.g., hidden terms, no negotiation] and [substantive issues - e.g., one-sided provisions, fee-splitting], and (3) I reserve all rights to challenge the enforceability of any arbitration provision."
Generate a professional demand letter, CA court complaint, or arbitration demand