CCPA and CPRA data request compliance checklist for social media apps

What to take away

Which requests the CCPA and CPRA cover for social media apps

Social media apps collect a wide set of identifiers, content, and inferences. Under the California Consumer Privacy Act, a California consumer can ask what you collect. They can also ask you to delete it and to stop selling or sharing it.

The full statutory text sits at Codes Display Text.

The California Privacy Rights Act amended the CCPA and added a right to correct inaccurate personal information. It also added a right to limit the use and disclosure of sensitive personal information. It created the California Privacy Protection Agency, which writes rules and can investigate.

The amended text is at amended CCPA text.

For a social app, the request types usually map to these product surfaces:

A request can arrive through a webform, email, in-app support, or a phone line. The CCPA does not require one channel, but you must offer at least two methods. Businesses that deal with consumers offline must also list a toll-free number.

Many apps run a webform plus a dedicated privacy email. A request from a parent on behalf of a child under 13 also triggers the Children's Online Privacy Protection Act, which the Federal Trade Commission enforces.

The FTC's privacy guidance is at Consumer Privacy | Federal Trade Commission.

Some requests fall outside the law. If you cannot link the data to a consumer or household, it is not personal information. If you keep data only for a permitted purpose, such as security or fraud prevention, you may decline deletion and tell the consumer why.

For a broader intake design, see the ccpa social media data requests checklist.

Verification standards for consumer and authorized agent requests

The CCPA requires a business to verify that the requester is the consumer about whom it holds information. The rules do not name one method. They require a reasonable degree of certainty that matches the sensitivity of the data.

Deletion and access requests call for a reasonably high degree of certainty. For opt-out requests, you may not demand verification beyond what is necessary.

For a social app, verification usually means matching two data points the app already holds. Common pairs are account email plus a one-time code, or account phone plus a login challenge. Do not ask for new data you would then have to store. If you cannot verify, tell the consumer and explain why.

Authorized agent verification adds a step. An agent can be a person or an entity registered with the California Secretary of State. The consumer must give the agent signed permission to act.

You may require the agent to show that permission. You may also require the consumer to verify their identity directly with you. You may not require the consumer to verify with the agent. For a deletion request, the agent must confirm the consumer gave permission to delete.

A few practical rules help:

Some apps also face the Illinois Biometric Information Privacy Act, which sets its own written consent and retention rules for face or voice data. A social app that uses face filters or voice matching should treat those requests as sensitive.

If your app also runs age checks, the design overlaps with the texas social media age verification law debate, where states differ on acceptable proof.

Timelines: acknowledgment, response, and extension rules

The CCPA sets two clocks. You must confirm receipt within 10 business days. You must respond within 45 calendar days of receipt. You may extend once by another 45 days, reaching 90 days, if you notify the consumer and give the reason before day 45. CPRA consumer request timelines kept those clocks and added the correction and limit rights.

A response does not always mean you hand over data. If you deny a request in whole or in part, the response must explain the basis. It must also explain how to appeal if you offer an appeal. The CPRA does not require an appeal for every request, but the California Privacy Protection Agency has encouraged one for denials.

The table below shows the core timeline rules for a social media app.

For a deletion request, the clock starts when you receive the request, not when verification ends. If verification drags, acknowledge within 10 business days and state what you need. If the consumer goes quiet for a reasonable period, you may close the request, but document the attempts.

Some requests arrive as a global opt-out signal, such as the Global Privacy Control. The CPRA treats a browser or device signal as a valid opt-out for that browser or device.

You do not verify the consumer to honor it. You do need to pass the signal to third parties that receive the data. If several duties run at once, a government regulation checklist can keep the owners and deadlines straight.

Access, deletion, correction, and opt-out mechanics

Each right has its own mechanics. A single request may combine several rights, so handle each part on its own track.

Access. The consumer can ask for the specific pieces of personal information you hold. You must provide the data in a portable and, to the extent technically feasible, readily usable format. For a social app, that means exporting posts, messages, and profile data in a common format such as JSON or CSV.

Do not include data about other people. If a message thread contains another user's content, redact it.

Deletion. The consumer can ask you to delete personal information you collected from them. You must also direct service providers and contractors to delete it. You may keep data for a permitted purpose, such as completing a transaction, detecting security incidents, or complying with a legal obligation.

You must tell the consumer if you keep data and why. For a social app, deletion raises hard questions about backups, logs, and shared content. A reasonable approach is to delete or de-identify live data within the response period and clear backups on the normal rotation, which you should disclose.

Correction. The CPRA lets a consumer correct inaccurate personal information. You must use commercially reasonable efforts to fix it. If you cannot, tell the consumer and explain why.

For a social app, this often means profile fields, but it can also mean a recommendation label or an ad interest segment. If the data is an inference, you may offer a way to reset it rather than edit it.

Opt-out of sale or sharing. You must post a clear and conspicuous link. A common title is "Do Not Sell or Share My Personal Information." A longer version adds "and Limit the Use of My Sensitive Personal Information."

You must also honor opt-out preference signals. For a social app, sharing for cross-context behavioral advertising is the usual trigger. You must stop sharing the data for that purpose and tell third parties to do the same.

Limit use of sensitive data. A consumer can direct you to limit your use of sensitive personal information to what is necessary to perform the service. For a social app, precise geolocation and biometric data are the usual categories. You must apply the limit and pass it to service providers.

A consumer deletion request process should also handle content other users have reshared. You cannot delete another user's copy, but you can stop displaying the original and remove it from your systems.

If the content is also the subject of a copyright dispute, a dmca counter notice may be part of the same workflow, but it does not replace the privacy deletion duty.

Data mapping and third-party disclosures behind the response

You cannot answer a request you cannot trace. Data mapping for privacy requests means a current record of what you collect, why, where it lives, how long you keep it, and who receives it. For a social app, the map should cover account systems, content stores, ad platforms, analytics, and support tools.

A workable data map has these fields:

You must also disclose the categories of third parties that receive personal information. If you sell or share data, list those third-party categories and the data categories. The CPRA requires a contract with service providers, contractors, and third parties that limits their use of the data.

If a third party uses the data for its own purposes, the transfer may be a sale or share, and the consumer can opt out. Third-party notices matter for deletion, correction, and opt-out.

Keep a record of every notice you send, because the California Attorney General can ask for it. If a privacy failure also triggers an app store or account ban, a platform bans checklist covers that separate track.

Social apps that train models on user content should treat that content as part of the data map. If you cannot remove a data point from a trained model, say so in your notice and explain the retention.

Do not claim deletion you cannot deliver. The FTC has brought cases over deceptive privacy claims, and its data security guidance is at Data Security | Federal Trade Commission.

Penalties, cure periods, and AG enforcement posture

The CCPA gives the California Attorney General civil enforcement power. The AG can seek an injunction and civil penalties of up to $2,500 per violation. The figure rises to $7,500 for each intentional violation involving the personal information of a consumer under 16.

The CPRA also created the California Privacy Protection Agency, which can investigate and bring actions.

Compliance resources are at CCPA enforcement guidance.

The CPRA removed the mandatory 30-day cure period for most violations. The AG may still give notice in some cases, but a business should not count on a cure window. The agency has said it will focus on high-impact violations, such as failures to honor opt-out requests and failures to post required notices.

For social apps, the highest-risk areas are opt-out signals, deletion of children's data, and dark patterns in consent flows.

The FTC also has authority over unfair or deceptive practices. A privacy policy that promises deletion but does not deliver can be deceptive. A breach caused by weak security can be unfair. The FTC has brought cases against apps on both grounds.

State attorneys general in Texas, Florida, and elsewhere can enforce their own privacy laws. The Illinois Biometric Information Privacy Act carries a private right of action with statutory damages. A single request can become a class issue if the process fails at scale. If your webform breaks, or you ignore authorized agents, the pattern can support an enforcement action.

A step-by-step compliance checklist for request handling

A texas teacher social media policy review can surface contract clauses before a request arrives.

Use this sequence for every request. Assign an owner and a target date at each step.

A pre-flight checklist for each request:

A worked example helps. A California user asks a photo app to delete their account and all data. The app acknowledges on day 2. Verification uses the account email plus a one-time code, completed on day 5.

On day 12 the data map is complete: profile data, photos, ad identifiers, and a support ticket. The app deletes live data and tells the ad partner and cloud host to delete. A backup copy remains for 30 days on the normal rotation, and the notice discloses that.

The app responds on day 20 with a confirmation and a list of retained categories. The request log is kept for 24 months.

Common questions