Why Most Privacy Requests Fail
Privacy law gives you powerful rights — but only if you know how to invoke them correctly. Companies receive data rights requests every day, and many have systems (sometimes deliberately designed to be confusing) that allow them to delay, deny, or ignore requests that aren't submitted in exactly the right way.
Common reasons privacy requests fail: using the wrong channel (companies can require requests be submitted through their official portal), failing to verify your identity adequately, not specifying which right you're invoking, submitting through a method the company doesn't recognize as valid, or simply not following up when the company misses its response deadline.
This guide gives you everything you need to submit data rights requests that companies take seriously, respond to on time, and comply with fully.
Step 1: Identify the Right Channel
Before writing a single word, find out how the company accepts privacy requests. Most companies with privacy obligations provide one or more of: a web form (often at /privacy or in the website footer), a toll-free phone number, an email address (often privacy@company.com), or a mail address.
Under California's CCPA, covered businesses must provide at least two methods for submitting requests. Always use the company's official channel — emailing customer support or posting on social media generally doesn't count as a formal privacy request and may not trigger their legal compliance obligations.
To find a company's privacy request portal: (1) scroll to the bottom of their website and look for "Privacy" or "Do Not Sell My Personal Information" links, (2) Google "[Company Name] + CCPA request" or "[Company Name] + privacy rights request," or (3) check their privacy policy for a section titled "Your Rights" or "Exercising Your Privacy Rights."
The Essential Elements of a Valid Request
Every privacy rights request should include:
1. Your identity: Full legal name, email address(es) associated with your account, and any account numbers or usernames. If requesting deletion or access for a specific account, include the account details.
2. Your state of residence: This determines which law applies and what rights you're entitled to. State it explicitly: "I am a resident of California" or "I am a resident of Virginia."
3. The specific right you're invoking: Be precise. "Right to Know," "Right to Delete," "Right to Opt Out of Sale," etc. Don't just say "I want to know what you know about me" — say "I am invoking my right of access under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100)."
4. Citation of the applicable law: Citing the specific law signals that you know your rights and makes it harder for companies to treat your request casually.
5. A response deadline reminder: California: 45 days. Virginia/Colorado/Connecticut/Texas: 45 days. Stating the deadline in your request signals that you're tracking the clock.
Sample Request Templates
Right to Delete (Access Request):
To Whom It May Concern,
I am a resident of [STATE] and am submitting this request pursuant to [STATE PRIVACY LAW NAME AND CODE CITATION].
I am invoking my right to deletion of all personal information you hold about me. Please confirm receipt of this request and complete the deletion within the legally required timeframe of 45 days.
My identifying information:
- Full Name: [Your Name]
- Email: [email@example.com]
- Account Number (if applicable): [XXXXXX]
Please confirm: (1) that my request has been received, (2) the specific actions taken in response, and (3) any categories of data that you are retaining and the legal basis for doing so.
Sincerely,
[Your Name]
Adapt this template by replacing the bracketed fields and choosing the appropriate right (access, deletion, correction, opt-out of sale, etc.) for your situation.
Following Up: What to Do If a Company Ignores You
If a company fails to respond within the legal deadline (typically 45 days), you have recourse:
California residents: File a complaint with the California Privacy Protection Agency at cppa.ca.gov. The CPPA investigates complaints against businesses and can levy significant fines. Also file with the California Attorney General.
Virginia residents: File a complaint with the Virginia Attorney General's Consumer Protection Section.
Colorado residents: File a complaint with the Colorado Attorney General's Consumer Protection Section.
All states: File a complaint with the Federal Trade Commission (FTC) at ftc.gov/complaint. While the FTC's privacy enforcement is limited, patterns of complaints can trigger investigations.
Before filing a formal complaint, send a follow-up email to the company citing the missed deadline and stating that you will be filing complaints with the applicable state attorney general and privacy protection agency if you don't receive a response within 5 business days. This often prompts a rapid response.