Data Subject Rights and Consent Management
What this domain tests
This domain tests the operational mechanics of consumer rights and consent: scope, verification, timelines, exceptions, authorized agents, appeals, and preference signals.
Core rules and concepts
- Common rights in state laws: know/access, delete, correct, portability, opt out of sale/share, opt out of targeted advertising, limit sensitive data, and non-discrimination.
- Timelines: CCPA/CPRA generally requires response within 45 calendar days, with a 45-day extension when reasonably necessary and notice given. Other states vary; some use 45 days, some 30 or 60.
- Verification: match identity to data already held; do not collect extra sensitive data just to verify. Use authorized agents with written permission and appropriate verification.
- Exceptions: legal obligations, security, free speech, internal use reasonably aligned with consumer expectations, and others vary by state.
- Consent: opt-in for sensitive data where required, for sale of minors’ data under 16, and for certain marketing. Consent must be freely given, specific, informed, and unambiguous; dark patterns undermine it.
- Preference signals: California requires businesses to honor Global Privacy Control as a valid opt-out of sale/share.
Worked example
A consumer emails a deletion request but the company’s records show two accounts-one consumer, one employee. The company verifies the consumer account, deletes eligible data, retains payroll records under a legal obligation, and explains the exception. It does not demand a passport copy.
Traps that cost marks
- Applying a single 30-day GDPR deadline to all US requests.
- Denying requests from authorized agents without checking state rules.
- Treating “do not sell” as covering targeted advertising in every state; some have separate opt-outs.
- Collecting more data during verification than the original record contained.