What Contact Methods Must I Provide to Consumers Under CCPA?

Your business needs to offer at least two, and possibly three, contact methods to consumers enabling them to make privacy rights requests:  

Methods for Accepting CCPA Requests
Methods for Accepting CCPA Requests

1. Provide an interactive web form or an email address 

If you do not “sell” personal information for CCPA purposes, you can use an email address as one of your contact methods, and if you do “sell” personal information, you must provide an interactive web form. If you are selling information, the “Do Not Sell My Personal Information” link on your homepage can point to this web form. A web form is simple to install if you use third party tools such as the software provided by CCPA Toll Free. See The Webform is the Preferred Method for Consumers to Contact you with CCPA Requests, including examples of how to embed a webform in a privacy policy vs. allowing a third party to host it.  

2. Provide a toll-free or 800 phone number

The CCPA provides that businesses must provide a toll-free number to accept right to know and deletion requests. However, there is an exception if your business never interacts with consumers offline, and if you only collect information about your consumers from them directly. While offline interaction is easier to control, having a direct relationship is not due to all of the information collection that happens routinely as part of online advertising activities (e.g., retargeting and other forms of interest based advertising are predicated on information collected on third party sites rather than from your owned and operated properties). This means businesses exploiting modem marketing techniques need the toll-free number. For more information about this requirement, see Do I Need a Toll Free Number for CCPA.

For convenience, you can combine your toll-free number and webform into a single privacy manager panel, as this distribution company does, with Option 1 as the webform and Option 2 as the toll-free number. 

3. Provide your primary method of interaction if different. 

If neither of the two contact methods above include the primary method by which you interact with consumers, provide your primary method as a third contact option. E.g., if you have an offline storefront, provide a method for consumers to make requests in your store. Note the mandate to provide your “primary method” only applies to receiving opt-out requests and to answering additional consumer inquiries. 

For all of the contact methods you provide, if you offer a choice to delete or opt out of selling less than all information, you must present an option to delete or opt out of selling all information with more prominence than any partial options.  

What is a Sale Under CCPA?A Guide to Verifying Consumer Requests for CCPA