Best Practices: Processing CCPA Opt-Out Requests

OneTrust Privacy Rights enables organizations to streamline their Data Subject Access Requests (DSAR) lifecycle processes by leveraging intake templates, automated workflows, identity verification measures, secure messages portals, database audit preparedness, and Targeted Data Discovery (TDD). These features allow privacy professionals to accommodate large volumes of requests while responding to each within a proper fulfillment time range.

Link to a CCPA web form from your website's privacy policy to provide consumers access to initiate their opt-out request. Submitted requests will appear in the Requests screen, a dedicated location for filtering, organizing, and processing requests. You can also communicate directly and securely with consumers in the Activity tab's messaging portal.

Data collection for requests begins with setting up a web form with specific audiences, request types, and collection parameters in mind. From there, you can configure web forms to maximize request intake efficiency with visibility rules, ID verification, and attachment uploads while also maintaining the customer experience with guidance text and style branding. For more information on web forms, see Customizing a Web Form.

The seeded OneTrust CCPA Workflow helps businesses substantiate that the request is valid under the CCPA, as businesses are only required to respond to consumers whose identity and residency can be verified. Organizations receiving opt-out of sale requests may request personally identifiable information (PII) or documentation from consumers for validation of their identity and California residency. These documents can be attached to the web form if you have enabled required attachments in the Web Form Customization settings.

Response Templates can be leveraged as your organization's preferred method of contact when responding to requests in the Privacy Portal. Use the text editor to customize the style and format of your organization's custom message that notifies consumers a decision was made regarding their request. For more information on response templates, see Using Response Templates.

Configuring a Do Not Sell Web Form

You can configure a web form to set a Do Not Sell My Information request type as the default value. Simply add a new field type and enable the Hide from Web Form setting in the Web Form Customization screen. Then, select your new field type as the default value.

Identity Verification

Identity (ID) verification presents one of the biggest challenges for fulfilling CCPA consumer rights requests. Integrating CCPA consumer rights requests with existing ID verification standards helps alleviate the pressures of ID verification while seamlessly maintaining the customer experience. For more information on OneTrust's supported approaches to ID verification, see Enabling Web Form Verification Settings.

Notifying the Data Subject

When organizations initially receive opt-out of sale requests, they must first verify the identity and residency of the consumer or the person who has been duly authorized to make the request on behalf of the consumer. The Verify Consumer Request (CCPA) response template is an effective first-contact method for request intakes and verification procedures.

In the event their identity and/or residency cannot be verified, the Not a Verifiable Consumer Request (CCPA) response template can be customized to inform consumers that their request could not be honored because they could not be validated.

Consumers also have the right to request if their information is being collected by a business or if their information is being sold or disclosed to third-parties. The Right to Request Information response template seeds two standard response options: one for honored requests and one for requests not filled. Further customization of the template is at your discretion.

Once the consumer's PII is verified and identity validated, you can inform them of their request's fulfillment using the Right to Opt Out of Sale response template. Edit the response to notify consumers that their request to opt-out of the sale of personal information was received and duly honored.

For additional information on CCPA requests, see OneTrust for CCPA, CCPA Opt-Out Guide for Developers, and How OneTrust Helps with the CCPA: "Do Not Sell" & Consumer Rights Management.