1798.100(a) A consumer shall have the right to request that a business that collects a consumer’s personal
information disclose to that consumer the categories and specific pieces of personal information the business has
collected.
(b) A business that collects a consumer’s personal information shall, at or before the point of collection, inform
consumers as to the categories of personal information to be collected and the purposes for which the categories
of personal information shall be used. A business shall not collect additional categories of personal information or
use personal information collected for additional purposes without providing the consumer with notice consistent
with this section.
(c) A business shall provide the information specified in subdivision (a) to a consumer only upon receipt of a
verifiable consumer request.
(d) A business that receives a verifiable consumer request from a consumer to access personal information shall
promptly take steps to disclose and deliver, free of charge to the consumer, the personal information required by
this section. The information may be delivered by mail or electronically, and if provided electronically, the
information shall be in a portable and, to the extent technically feasible, in a readily useable format that allows
the consumer to transmit this information to another entity without hindrance. A business may provide personal
information to a consumer at any time, but shall not be required to provide personal information to a consumer
more than twice in a 12-month period.
(e) This section shall not require a business to retain any personal information collected for a single, one-time
transaction, if such information is not sold or retained by the business or to reidentify or otherwise link
information that is not maintained in a manner that would be considered personal information.
(1) Retain any personal information collected for a single, one-time transaction, if the information is not sold or
retained by the business.
(2) Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner
that would be considered personal information.