California consumer rights
CCPA / CPRA consumer rights in a customer data platform (CDP)
This customer data platform (CDP) guide helps privacy and engineering teams plan California consumer-rights workflows. Applicability, exceptions and contractual roles require review; deployment ownership alone does not satisfy CCPA or CPRA duties.
Applicability first
Determine the business, data and contractual scope
California consumer-rights duties depend on the applicable statute, regulations and facts. Customer-managed hosting alone does not establish compliance or determine the parties' roles.
Use the California Privacy Protection Agency FAQs and current laws and regulations with the responsible privacy adviser. This guide is a technical planning aid, not approval of a deployment.
Rights workflow
Test the complete source-to-destination process
These are evaluation tasks for the proposed configuration. They are not claims that every control is implemented or enabled in every release.
Collection and purpose
Inventory identifiers and fields, their stated purposes and the parties receiving them. Ask the privacy owner to determine applicability, contractual roles and exceptions.
Access and correction
Test identity verification, permitted export and correction using synthetic identities. Check how changes propagate to derived audiences and selected destinations.
Deletion and retention
Define the approved process, exceptions and backup expiry. Reconcile profiles and destinations rather than assuming a successful request removes every copy instantly.
Opt-out and suppression
Test the applicable opt-out workflow across identity joins, new events and activation retries. Keep the operating owner and evidence with the accepted configuration.
Prevent a later event from undoing an approved restriction
A rights workflow crosses more than the profile store. Use a synthetic identity to test a withdrawn permission, changed identifier, duplicate event and unavailable destination. Inspect whether a retry or identity merge recreates a restricted audience membership. Document any retention exception, reconciliation job or downstream dependency that changes what completion means.
Assign an owner to intake, identity verification, system execution and final review. Agree what evidence shows that the approved action reached each destination. A request being accepted by an API is not proof of the full effect, and a private deployment does not remove the need to review external data flows.
Use the industry index to add workflow context and privacy-first martech for related engineering questions.
Discuss your deployment with engineers.
Bring your data flow, operating owners and evaluation questions.
Frequently asked questions
Does CCPA apply to every customer data platform?
Applicability depends on the business, data and statutory criteria. Ask the privacy owner to document scope before implementing rights workflows. Primary source
Which consumer rights should our team evaluate?
Review the applicable rights to know, delete, correct, opt out and limit certain uses, including exceptions and response procedures. Primary source
Does self-hosting settle CCPA or CPRA obligations?
No. Collection purposes, notices, contractual roles, rights handling and destination behavior still require review. Primary source
How should opt-outs reach activation destinations?
Test suppression with synthetic identities and confirm each selected destination applies it. Retain failures and retries as acceptance evidence. Primary source
Can deleted identities be recreated by a later event?
Test this explicitly. Agree how suppression, retention and permitted re-ingestion interact so a pipeline does not silently undo the approved rights workflow. Primary source
Where can we read current California rules?
Use California Privacy Protection Agency resources and the current statute and regulations, then review applicability with your privacy adviser. Primary source
Further reading
- Customer data regulation guides
- HIPAA-Compliant CDP: What It Takes
- DORA and Your Marketing Stack: Register
- CDP for iGaming Operators
- Compliance guide
Published: · Updated:
Editorial dates describe content changes. Confirm current sources before making legal, security or purchasing decisions.