Consumers can request disclosure of PI collected, sources, purposes, third-party recipients

CCPA § 1798.100 and § 1798.110 grant California consumers the right to know exactly what personal information a business holds about them, where it came from, why it is processed, and who receives it. Without an accessible disclosure mechanism — a web form, email address, or toll-free number — you are in statutory violation the moment a California resident asks. The California Privacy Protection Agency (CPPA) can impose fines of up to $7,500 per intentional violation, and class-action exposure under § 1798.150 covers statutory damages of $100–$750 per consumer per incident. Beyond the monetary risk, the absence of a rights mechanism signals to regulators that the rest of your privacy program is equally unprepared.

Create a consumer privacy rights request page at app/privacy/request/page.tsx that covers all five request types — know-categories, know-specific, delete, correct, and opt-out — and POST to a backend route that generates a verification token, stores the pending request, and sends a confirmation email within the required 45-day window.

// app/privacy/request/page.tsx — cover all five CCPA request types
'use client'
import { useState } from 'react'

type RequestType = 'know_categories' | 'know_specific' | 'delete' | 'correct' | 'opt_out'

export default function PrivacyRequestPage() {
  const [requestType, setRequestType] = useState<RequestType>('know_categories')
  const [email, setEmail] = useState('')
  const [submitted, setSubmitted] = useState(false)

  async function handleSubmit(e: React.FormEvent) {
    e.preventDefault()
    await fetch('/api/privacy/request', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ requestType, email }),
    })
    setSubmitted(true)
  }

  if (submitted) return (
    <p>Request received. We will respond within 45 days as required by California law.</p>
  )

  return (
    <form onSubmit={handleSubmit}>
      <h1>California Privacy Rights Request</h1>
      <input type="email" value={email} onChange={e => setEmail(e.target.value)}
        placeholder="Your email address" required />
      {/* Render radio buttons for all five request types */}
      <button type="submit">Submit Request</button>
    </form>
  )
}

Link this page from your privacy policy under a "California Privacy Rights" heading and ensure the 45-day response SLA is documented in PRIVACY_OPERATIONS.md.