1. CCPA Metrics Requirement
2. View Metrics and Charts
3. Contribution
4. Thank You!
California Code of Regulations §999.317 requires the following:
(g) A business that knows or reasonably should know that it, alone or in combination, buys, receives for the business's commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year shall:
(1) Compile the following metrics for the previous calendar year:
a. The number of requests to know that the business received, complied with in whole or in part, and denied;
b. The number of requests to delete that the business received, complied with in whole or in part, and denied;
c. The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
d. The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.
(2) Disclose, by July 1 of every calendar year, the information compiled in subsection (g)(1) within their privacy policy or posted on their website and accessible from a link included in their privacy policy.
a. In its disclosure pursuant to subsection (g)(2), a business may choose to disclose the number of requests that it denied in whole or in part because the request was not verifiable, was not made by a consumer, called for information exempt from disclosure, or was denied on other grounds.
(h) A business may choose to compile and disclose the information required by subsection (g)(1) for requests received from all individuals, rather than requests received from consumers. The business shall state whether it has done so in its disclosure and shall, upon request, compile and provide to the Attorney General the information required by subsection (g)(1) for requests received from consumers.
This repo contains data on business' disclosures per §999.317(g). The data is entered and visualized in a Google Sheet.
Contribute by opening an issue or a pull request. Contact: sebastian[at]privacytechlab.org
- June 7 2024: @ecorren provided 2021 data. Her paper is available on SSRN: An Empirical Study on the Real Use of Data Control Rights and Policy Implications, 109 IOWA L. REV.
- March 8, 2023: @coreystone provided an update.
We would like to thank our supporters!
Major financial support provided by the National Science Foundation.
Additional financial support provided by the Alfred P. Sloan Foundation, Wesleyan University, and the Anil Fernando Endowment.
Conclusions reached or positions taken are our own and not necessarily those of our financial supporters, its trustees, officers, or staff.
