CCPA Request Steps - San Francisco Residents

Technology and Data California 4 Minutes Read · published February 06, 2026 Flag of California

San Francisco, California residents have rights under the California Consumer Privacy Act (CCPA) to access, delete, and opt out of the sale of personal information. This guide explains practical steps to prepare and submit a request to a business, how to escalate to state enforcement, and what to expect from responses under California law. It combines consumer-facing steps with official contact points so you can act quickly and track deadlines.

Gather a concise list of what you want before contacting a business.

What the CCPA covers

The CCPA gives consumers rights to know categories of personal information collected, to request access to specific data, to request deletion, and to opt out of sales of personal information. Businesses that fall within the CCPA scope must provide notice with privacy practices and a method to submit requests.

How to prepare your request

  • Identify the right: access, deletion, or opt-out and describe the specific records you want.
  • Collect proof of identity the business may require (photo ID, account info) but limit sharing of unnecessary data.
  • Prefer written requests (email or web form) so there is a record of the date and content.
  • Note the request date and expect a business timetable to start from that date.

Submitting the request to a business

Find the business’s published privacy request method (web form, email, or designated agent). Use clear language: state you are making a request under the California Consumer Privacy Act, specify the right sought, list the data or accounts affected, and attach identity proof if requested. Keep copies of all correspondence and delivery receipts.

A succinct written request reduces verification delays.

Penalties & Enforcement

Enforcement of the CCPA is handled by the California Attorney General for most violations; certain private rights apply for data breaches. Specific civil enforcement procedures and penalties are governed by California law and administrative action.

  • Enforcer: California Attorney General; file complaints using the AG consumer submission process [1].
  • Fine amounts: not specified on the cited AG overview page for every enforcement scenario; see state law and AG notices for amounts and per-violation calculations [1].
  • Escalation: initial notice and opportunity to cure may apply under state enforcement practice; exact escalation timelines are not specified on the cited AG page [1].
  • Non-monetary sanctions: injunctive relief, court orders, and other remedies may be sought by the AG or in civil litigation; specifics depend on the action and are governed by state statute [1].
  • Appeals/review: enforcement actions follow California administrative and court appeal routes; precise statutory time limits are available in state code and related guidance [2].

Common violations and typical responses:

  • Failure to provide requested records—may lead to enforcement action or corrective orders (penalty details: not specified on the cited AG page) [1].
  • Refusal to delete data without lawful basis—may be subject to AG investigation (penalty details: not specified on the cited AG page) [1].
  • Insufficient privacy notices or request mechanisms—often corrected through administrative action or consent decrees (penalty details: not specified on the cited AG page) [1].

Applications & Forms

No standardized municipal form is required to make a CCPA request to a business; businesses often publish their own web forms or designated-agent instructions. To escalate to state enforcement, use the California Attorney General’s consumer complaint submission process [1].

If you suspect misuse of your data after a business denial, file a complaint with the California AG promptly.

How-To

  1. Identify the business and locate its privacy request method (privacy page, designated agent, or customer support).
  2. Prepare a concise written request: state "CCPA request," the specific right (access, deletion, opt-out), account details, and attach identity verification as required.
  3. Send the request via the business’s published channel and save proof of delivery (email copy, submission confirmation).
  4. Track responses: note the date received; businesses typically acknowledge and then provide further steps or data transfer.
  5. If the business fails to respond or denies an appropriate request, gather documentation and submit a complaint to the California Attorney General consumer complaint portal [1].
Start with the business’s published web form to create an auditable record.

FAQ

How long does a business have to respond to a CCPA request?
The CCPA response timetable is set by California law and guidance; businesses commonly respond within the statutory period described in state guidance. For state enforcement and practical steps, consult the California Attorney General resources [1].
Can I file a CCPA request with a San Francisco city agency?
For city-held records, contact the relevant San Francisco department or use San Francisco public records channels; the CCPA applies to private businesses, while municipal records are governed by public records law and city policies.
What if a business asks for too much personal information to verify me?
Provide the minimum verification requested and ask the business in writing to explain any additional verification steps; document the request and response for escalation to the AG if needed.

Key Takeaways

  • Prepare a focused written request and keep records of all submissions.
  • Use the business’s published request channel first, then escalate to the California AG if needed.

Help and Support / Resources

  1. [1] California Attorney General - CCPA overview
  2. [2] California Attorney General - file a consumer complaint

Categories

General Governance and Administration Public Safety Public Health and Welfare Land Use and Zoning Housing and Building Standards Transportation Environmental Protection Parks and Public Spaces Business and Consumer Protection Taxation and Finance Labor and Employment Education Civil Rights and Equity Elections and Campaign Finance Events and Special Uses Signs and Advertising Utilities and Infrastructure Technology and Data