Consumers can request correction of inaccurate personal information

CPRA (effective January 2023) added the right to correction alongside the original CCPA rights, codified at § 1798.106. A profile page where all fields are read-only — a common AI-built default — violates this right for authenticated users. For non-account-holders who have had their PI collected via a lead form or checkout, the violation is even starker: they have no path at all to correct inaccurate data. Inaccurate PI also degrades your own product — wrong email addresses bounce, wrong billing names cause payment disputes, and wrong phone numbers generate SMS failures. Correction serves both compliance and data quality.

Add editable fields to app/settings/profile/page.tsx so authenticated users can self-service correct their name, phone, and any other PI fields. Add a "Correct inaccurate personal information" radio option to the privacy rights request form for non-account-holders.

// app/settings/profile/page.tsx
'use client'
import { useState } from 'react'

export default function ProfilePage({ user }: { user: User }) {
  const [name, setName] = useState(user.name ?? '')
  const [phone, setPhone] = useState(user.phone ?? '')

  async function save(e: React.FormEvent) {
    e.preventDefault()
    await fetch('/api/user/profile', {
      method: 'PATCH',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ name, phone }),
    })
  }

  return (
    <form onSubmit={save}>
      <label>Name <input value={name} onChange={e => setName(e.target.value)} /></label>
      <label>Phone <input value={phone} onChange={e => setPhone(e.target.value)} /></label>
      <button type="submit">Save Changes</button>
    </form>
  )
}

For non-account-holders, route correction requests to a staff inbox tracked in PRIVACY_OPERATIONS.md; the 45-day response window applies here too.