A California consumer contacts a covered retailer that collects her precise geolocation and her stored payment-card details. She wants to know which rights the CCPA as amended by the CPRA actually gives her over this data. Which two statements correctly describe rights the CCPA as amended grants her? (Select TWO.)
- AShe may compel the retailer to obtain her opt-in consent before it collects any sensitive personal information from her at all.
- BShe may request that the retailer correct inaccurate personal information it maintains about her, taking account of its nature and purpose. Correct
- CShe may bring a private lawsuit against the retailer for any violation of her access, correction, or deletion rights under the statute.
- DShe may direct the retailer to limit its use and disclosure of her precise geolocation to what is necessary to provide the requested goods or services. Correct
- EShe may demand deletion of all personal information the retailer holds with no exception, including data the retailer needs to complete her pending transaction.
Why A is wrong: Opt-in consent before collecting sensitive data is the Virginia, Colorado, and Connecticut approach; California instead gives a right to limit use after collection, so this misattributes another model's rule.
Why B is correct: The CPRA added an express right to correct inaccurate personal information, requiring commercially reasonable efforts to fix it given the data's nature and the processing purpose.
Why C is wrong: Tempting because the CCPA has a private right of action, but that action is confined to certain breaches caused by unreasonable security, not to general rights violations, which the CPPA and Attorney General enforce.
Why D is correct: Precise geolocation is sensitive personal information, so the right to limit lets the consumer cap its use and disclosure to what is reasonably necessary to deliver the service she requested.
Why E is wrong: The deletion right is real, but it is subject to enumerated exceptions such as completing a transaction the consumer requested, so an absolute no-exception deletion right overstates the law.