- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
How many deletion requests can a consumer send to a business each year?
The CCPA does not specify how many deletion requests a consumer can send to a business each year. However, it does permit businesses to “refuse to act on” a deletion request if a consumer’s requests become “unfounded or excessive.”1 The Act specifically calls out “repetitive” requests as an example of an excessive practice.2 If a dispute arises between a business and a consumer regarding whether a particular quantity of requests is, or is not, excessive, the CCPA states that the “business shall bear the burden of demonstrating” that the quantity received is “manifestly . . . excessive.”3 One method that businesses may consider adopting when determining whether deletion requests are excessive, or in demonstrating that excessiveness, is to compare the quantity of deletion requests received from a particular consumer, with the quantity of deletion requests received from other consumers. To the extent that a particular consumer’s quantity of requests significantly departs from the behavior of most (or all) other consumers, a strong argument could be made that the requests have become repetitive and excessive.