Privacy Rights & Law

Privacy Rights & Law

The rights and regulations — GDPR, CCPA, and more — that govern what happens to your data.

CCPA (California Consumer Privacy Act)

A California law giving residents rights to know, delete, correct, and opt out of the sale or sharing of their personal information held by businesses.

CPRA (California Privacy Rights Act)

A 2023 amendment that expanded the CCPA, added a new "sensitive personal information" category, and created the California Privacy Protection Agency to enforce it.

Data Controller

The organization that decides why and how personal data is processed (GDPR terminology).

Data Processor

An organization that handles personal data on behalf of a data controller, without deciding the purpose of the processing (GDPR terminology).

Data Subject

The individual a piece of personal data is about — GDPR terminology, roughly equivalent to "consumer" in U.S. privacy law.

Data Subject Access Request (DSAR / DSR)

A formal request from an individual asking a company to let them access, correct, delete, or export their personal data.

De-identified / Anonymized Data

Data that has had identifying details removed or altered so it can no longer reasonably be linked back to a specific person.

GDPR (General Data Protection Regulation)

The EU/UK's comprehensive data protection law, giving individuals rights like access, correction, deletion (the "right to be forgotten"), and portability over their personal data.

Opt-In

A consent model requiring someone to actively agree before a company can process their data for a given purpose.

Opt-Out

A consumer's right to tell a business to stop a specific data practice — most commonly, stop selling or sharing personal data, or remove a listing.

Personal Data / Personal Information

Any information that identifies, relates to, or could reasonably be linked to a specific person — names, addresses, emails, device IDs, location history, and more.

Personally Identifiable Information (PII)

A narrower, more U.S.-specific term for data that can directly identify an individual — name, SSN, driver's license number, and similar. Often used interchangeably with "personal information," though legal definitions vary by law.

Right to Access / Right to Know

The right to find out what personal data a company holds about you and how it's used.

Right to Be Forgotten

The GDPR-rooted right to have personal data erased when it's no longer needed, consent is withdrawn, or it was unlawfully collected. U.S. law generally frames the equivalent as a narrower "right to delete."

Right to Correct (Rectify)

The right to have inaccurate personal data fixed.

Right to Delete (Erasure)

The right to have a company delete personal data it holds about you, subject to certain legal exceptions.

Sale of Personal Information

Under laws like the CCPA, exchanging personal data for money or other valuable consideration — a practice that triggers opt-out rights.

Sensitive Personal Information / Special Category Data

Higher-risk data types — Social Security numbers, precise geolocation, health data, race, sexual orientation, biometric data — that get extra legal protection under the CPRA and GDPR.

Sharing (Cross-Context Behavioral Advertising)

A CCPA/CPRA-specific term for sending personal data to third parties for targeted-ad purposes, even without a sale — also covered by "do not sell or share" opt-outs.