Privacy laws have given consumers real rights over their personal data — but most people don't know what those rights are or how to exercise them. Here's a practical guide.
For most of the internet's history, companies collected whatever data they wanted, kept it as long as they wanted, and sold it to whoever they wanted — with no meaningful obligation to tell you what they had or give you any control over it. That has changed significantly over the past decade. The European Union's General Data Protection Regulation (GDPR), California's Consumer Privacy Act (CCPA) and its successor the CPRA, and a growing patchwork of state privacy laws have created real, enforceable rights for consumers over their personal data. Understanding these rights — and how to exercise them — is increasingly important.
GDPR: the global standard. The GDPR, which took effect in May 2018, applies to any organization that processes the personal data of EU residents — regardless of where the organization is located. Its reach is effectively global for any company with European customers. Key rights under GDPR: the right to access (request a copy of all personal data a company holds about you), the right to erasure ('right to be forgotten' — request deletion of your data), the right to rectification (correct inaccurate data), the right to data portability (receive your data in a machine-readable format), and the right to object to processing (including for direct marketing). Companies must respond to requests within 30 days.
CCPA and CPRA: California's framework. The California Consumer Privacy Act (2020) and its amendment, the California Privacy Rights Act (2023), give California residents rights similar to GDPR: the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to correct inaccurate information, and the right to limit the use of sensitive personal information. The CPRA also created the California Privacy Protection Agency, a dedicated enforcement body. California's laws apply to businesses that meet certain thresholds (annual revenue over $25 million, or processing data of 100,000+ consumers), covering most major companies.
State privacy laws: a growing patchwork. As of 2026, over 20 states have enacted comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Texas, Florida, Oregon, Montana, and others. While the specifics vary, most include the core rights to access, delete, correct, and opt out of data sales. The absence of a federal privacy law means your rights depend significantly on where you live — California residents have the strongest protections, while residents of states without privacy laws have fewer formal rights. However, many companies apply their privacy policies nationally rather than state-by-state, meaning California-level rights are often available to all users.
How to exercise your rights in practice: most major companies now have privacy request portals accessible from their privacy policy pages. Look for links labeled 'Privacy Rights,' 'Data Subject Request,' 'Do Not Sell My Personal Information,' or 'Manage My Data.' For GDPR requests, email the company's Data Protection Officer (DPO) — companies subject to GDPR are required to designate one. For CCPA requests, look for the 'Do Not Sell or Share My Personal Information' link, which California law requires to be prominently displayed. Companies are required to verify your identity before fulfilling requests, which may require providing identifying information — a reasonable trade-off for the access you're requesting.
Practical privacy actions you can take today: submit data deletion requests to the major data brokers (Spokeo, BeenVerified, Whitepages, Intelius) — they're required to honor these requests under CCPA and similar laws. Opt out of targeted advertising through the Digital Advertising Alliance's opt-out tool (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org). Request your data from major platforms (Google Takeout, Facebook's Download Your Information, Twitter's data export) to understand what they hold. Review and update the privacy settings on your social media accounts, limiting data sharing to what you're comfortable with. And consider using privacy-focused alternatives to data-hungry services where practical — DuckDuckGo instead of Google, ProtonMail instead of Gmail, Firefox instead of Chrome.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.