Key Takeaways
- Data protection rights vary significantly depending on where you live and which laws apply to you.
- Many rights — such as access, correction, and deletion — require you to make a formal request to exercise them.
- Companies must generally respond to verified data requests within a defined timeframe, though exceptions exist.
- No single U.S. federal privacy law covers all sectors; sector-specific and state laws fill the gap.
- Exercising rights is most effective when combined with proactive privacy habits on your devices and accounts.
What Is Personal Data?
Personal data — sometimes called personally identifiable information (PII) — refers to any information that can be used to identify you, directly or indirectly. This includes obvious details like your name, email address, and phone number, but also less obvious data points such as your IP address, location history, device identifiers, and browsing behavior.
The exact legal definition varies by jurisdiction, but most modern privacy frameworks cast a wide net. Under California's CCPA, for example, personal information explicitly includes inferences drawn from your data that could reflect your preferences or behavior — not just the raw facts themselves.
Understanding what counts as personal data matters because it defines the scope of any rights you hold over it. If you want to understand what your browser is collecting about you, our article What Your Browser Actually Knows About You offers a detailed breakdown.
The Legal Landscape: Key Frameworks in the U.S.
The United States does not yet have a single comprehensive federal data privacy law. Instead, protection comes from a patchwork of sector-specific federal laws and an expanding set of state-level statutes.
20+
U.S. states with comprehensive privacy laws
As of recent legislative cycles, more than 20 states have enacted or are actively advancing comprehensive consumer data privacy legislation.
45 days
Typical deadline for companies to respond to data requests
Most state-level privacy laws in the U.S. require businesses to respond to verified consumer data requests within 30 to 45 days.
$7,500
Max civil penalty per intentional CCPA violation
Under California's CCPA/CPRA, the California Privacy Protection Agency can seek civil penalties of up to $7,500 per intentional violation.
- HIPAA (Health Insurance Portability and Accountability Act) protects health information held by covered medical entities.
- FERPA (Family Educational Rights and Privacy Act) governs educational records.
- COPPA (Children's Online Privacy Protection Act) restricts data collection from children under 13.
- State laws — most notably California's CCPA/CPRA, Virginia's CDPA, and Colorado's CPA — grant broad rights to residents that go beyond what federal law requires.
If you live in a state with a comprehensive privacy law, you generally have more enforceable rights than residents of states without one. The landscape continues to shift as more states pass legislation, so verifying your state's current law through official government sources is worthwhile.
Rights Apply to Covered Businesses, Not All Entities
State privacy laws typically apply to for-profit businesses that meet specific thresholds — such as annual revenue, volume of data processed, or percentage of revenue from data sales. Nonprofits, government agencies, and small businesses may fall outside the scope of these laws. Always check the specific law applicable in your state to understand who it covers.
Your Core Rights Explained
While the specifics differ by law, several rights appear consistently across major privacy frameworks:
Right to Know / Access
You can ask a company what personal data it has collected about you, where it came from, and how it's being used or shared. Most laws require the company to provide this within 30 to 45 days of a verified request.
Right to Correction
If the information a company holds about you is inaccurate or incomplete, you can request that it be corrected. This is particularly important for financial and medical records.
Right to Deletion
Often called the "right to be forgotten," this allows you to ask that your personal data be deleted. Important exceptions apply — companies may retain data needed to complete transactions, fulfill legal obligations, or protect against fraud.
Right to Opt Out of Sale or Sharing
Under laws like the CCPA, you can instruct a business not to sell or share your personal information with third parties for targeted advertising purposes. Businesses must honor these requests and may not discriminate against you for making them.
Right to Data Portability
Some frameworks allow you to request a copy of your data in a machine-readable format, so you can transfer it to another service if you choose.
Before submitting a deletion request, take a screenshot or export a copy of your data first — once it's gone, you won't be able to retrieve it.
Many data portability tools let you download your information in a structured format, which can be useful for your own records before you ask a company to erase it.
Search for '[Company Name] privacy request' to find the direct submission portal rather than hunting through long privacy policies.
Companies covered by state privacy laws are required to provide an accessible request mechanism; knowing this shortcut saves time and ensures you reach the correct channel.
How to Exercise Your Rights in Practice
Knowing your rights means little if you don't know how to act on them. Here's the general process:
- Locate the company's privacy policy or privacy request portal. Reputable businesses covered by privacy laws are required to provide a designated method for submitting data requests — often a web form, dedicated email address, or toll-free number.
- Submit a verifiable request. Companies need to confirm your identity before processing a request to prevent unauthorized access to your data. Be prepared to provide information that links you to the account in question.
- Track the response deadline. Most laws require a response within 30 to 45 days, with the possibility of one extension if the request is complex.
- Escalate if necessary. If a company fails to respond or denies your request without a valid reason, you may be able to file a complaint with your state attorney general's office.
For a parallel approach to managing what data you share going forward, see our guide to thoughtful habits for sharing personal information online.
Keep a Record of Every Request You Submit
Note the date, the channel used (web form, email, phone), and any confirmation number provided. If a company fails to respond within the legal timeframe, this documentation is essential if you need to escalate the matter to a regulatory authority.
Limits and Exceptions You Should Know
Data rights are real, but they are not absolute. Companies and organizations can lawfully decline or limit certain requests in specific circumstances:
- Legal obligations: A company may be required by law to retain certain records, even if you request deletion.
- Fraud prevention and security: Data necessary to detect or investigate security incidents may be exempt from deletion.
- Free speech and research: Journalistic, research, or public interest activities sometimes carry exemptions.
- Small businesses: Some state laws apply only to companies above a certain revenue threshold or data volume, meaning smaller operators may not be covered.
Opting Out Does Not Delete Existing Data
Submitting an opt-out of sale or sharing request stops future data sharing but does not automatically trigger deletion of data already collected. If you want existing data removed, you must submit a separate deletion request. These are two distinct rights under most privacy laws, and each must be exercised independently.
Rights also vary based on your relationship with the entity. Your employer, for example, operates under a different legal framework when it comes to workplace data than a retail company does when it processes your purchase history.
Taking a Proactive Approach to Data Privacy
Exercising your legal rights is one layer of protection, but pairing it with proactive habits makes a meaningful difference. Reviewing and adjusting your privacy settings, being deliberate about app permissions, and auditing what data you share at account setup are all practical steps.
Our article on privacy settings worth actually checking on your accounts walks through controls that are easy to overlook. Before setting up a new device, the new device privacy checklist covers defaults that favor data collection over user control. And if you want to understand what specific app permissions actually grant, app permissions on your phone explained is a useful reference.
“Privacy is not something that I'm merely entitled to, it's an absolute prerequisite for living a dignified life in a connected society.”
— Marlon Brando, Actor and public figure, frequently cited in discussions of privacy and personal autonomy
Data privacy is not a one-time task. Laws will continue to evolve, companies update their data practices, and your own digital footprint grows over time. Staying informed — and knowing where to look when something doesn't feel right — remains your most reliable tool.
This article provides general information about data privacy rights and is not legal advice. Laws vary by jurisdiction and change over time. For guidance specific to your situation, consult a qualified legal professional or your state attorney general's office.
State Privacy Law Tracker
The International Association of Privacy Professionals (IAPP) maintains a regularly updated tracker of U.S. state privacy legislation, showing which states have passed, enacted, or are advancing laws.
FTC Consumer Information: Privacy & Identity
The Federal Trade Commission's consumer site provides plain-language guidance on your rights, how to report privacy violations, and how to navigate identity-related data issues.
California Privacy Protection Agency (CPPA)
If you are a California resident, the CPPA's official site explains your rights under the CCPA/CPRA and provides resources for submitting complaints against non-compliant businesses.