(a) A consumer is entitled to exercise the consumer rights authorized by this section at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to exercise. With respect to the processing of personal data belonging to a known child, a parent or legal guardian of the child may exercise the consumer rights on behalf of the child.
(b) A controller shall comply with an authenticated consumer request to exercise the right to:
(1) confirm whether a controller is processing the consumer’s personal data and to access the personal data;
(2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;
(3) delete personal data provided by or obtained about the consumer;
(4) if the data is available in a digital format, obtain a copy of the consumer’s personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; or
(5) opt out of the processing of the personal data for purposes of:
(A) targeted advertising;
(B) the sale of personal data; or
(C) profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.

Text of section effective on July 01, 2024