Ask a company what it knows about you

What these requests do, and what they don't

They let you see the data a company uses to profile you, delete it, stop it being sold or shared, or fix it when it's wrong. That's all. They are not a way to get lower prices, and nothing here claims they are.

Loyalty discounts aren't banned. California's law says it doesn't stop businesses offering "loyalty, rewards, premium features, discounts, or club card programs" consistent with the law Cal. Civ. Code § 1798.125(a)(3), and Virginia's carves out a "bona fide loyalty, rewards … or club card program" Va. Code § 59.1-578(A)(4). Connecticut's and Rhode Island's say the same Conn. Gen. Stat. § 42-520(b) R.I. Gen. Laws § 6-48.1-5(d).
California, Virginia and Rhode Island bar punishing you for asking. In California a business may not charge you different prices, including "through the use of discounts or other benefits", because you used these rights § 1798.125(a)(1)(B). Virginia's and Rhode Island's laws have similar rules § 59.1-578(A)(4) § 6-48.1-5(b)–(c).
Not every company is covered. Most of these laws apply only above a size threshold. Rhode Island's, for example, starts at companies holding data on 35,000 customers R.I. Gen. Laws § 6-48.1-5(a). Each law also exempts some kinds of data and organizations. A company that says it isn't covered may be right.

Right to know: ask for the profile, not just the file

Every law in the table below gives you a right to access the data a company holds on you (Minnesota's covers the categories of data, a copy of what you gave the company, and a list of the third parties it went to). In California you can ask for the specific pieces of personal information a business collected about you, plus the categories of sources it came from, why it's used, and the categories of third parties it went to Cal. Civ. Code § 1798.110(a).

Inferences: the conclusions a company drew about you

California counts "inferences drawn … to create a profile about a consumer" as personal information § 1798.140(v)(1)(K). The Attorney General's formal opinion is that you have the right to know internally generated inferences about you, unless a business shows a statutory exception applies Cal. AG Op. No. 20-303 (2022).
Connecticut: since July 1, 2026, the access right expressly includes "any inferences about the consumer derived from such personal data", plus a list of third parties the company sold your data to Conn. Gen. Stat. § 42-518(a) (P.A. 25-113).
Oregon defines personal data to include "derived data" ORS 646A.570(13)(a), and lets you get a list of specific third parties your data was disclosed to (the company chooses whether to list those that got yours or those that got anyone's) ORS 646A.574(1)(a).
Minnesota lets you get a list of the specific third parties, and where a profiling decision had a legal or similarly significant effect on you, to question it and be told why Minn. Stat. § 325M.14, subd. 1(g)–(h).
Other states give a right to access "personal data" without saying whether inferences count. The template asks for them by name anyway. The worst answer is no.

Your loyalty-program profile

Purchase histories are personal information under California's definition § 1798.140(v)(1)(D), and a loyalty account is built from them. It's worth asking for by name because the clearest 2025–26 evidence we found of personal data affecting what people pay is in discounts and offers, not the shelf price:

In a June 2026 investigation, Consumer Reports reported that two ride-hail companies say they don't use personal data to set base prices but acknowledge using it for discounts and promotions Consumer Reports, 2026-06-16.
In 2025, Consumer Reports obtained one shopper's 62-page grocery loyalty profile through a request under Oregon's privacy law. It labeled him "non-loyal", which CR says likely means fewer of the chain's best discounts, and it had his education and income wrong Consumer Reports, 2025-05-21.

Seeing the profile doesn't change the discounts. It shows you the label, tier or segment you were put in, and gives you something specific to correct or delete.

Right to delete

You can ask a company to delete the data it holds about you. How far that reaches depends on the state:

California covers information the business "collected from the consumer", and the business must also tell its service providers, contractors and anyone it sold or shared the data with to delete it, unless that "proves impossible or involves disproportionate effort" Cal. Civ. Code § 1798.105(a), (c)(1). There are exceptions, for example where a business needs the data to comply with a legal obligation § 1798.105(d).
Most other states cover data "provided by, or obtained about" you e.g. Va. Code § 59.1-577(A)(3). Oregon spells out that this includes data obtained from another source and derived data ORS 646A.574(1)(c).
Iowa and Utah cover only data you provided yourself Iowa Code § 715D.3(1)(b) Utah Code § 13-61-201(2).

Before you delete a loyalty account

Deleting your loyalty data can close the account and lose points or member prices. If you want to know what's in it, send the right-to-know request first and decide after you've read the answer.

Right to opt out of sale and sharing

Every law in the table lets you tell a company to stop selling your data. Most also cover targeted advertising and some kinds of profiling; Iowa's rights list names only the sale of data Iowa Code § 715D.3(1)(d). In California the right covers selling or "sharing" your personal information Cal. Civ. Code § 1798.120(a).

What Global Privacy Control does automatically

Global Privacy Control (GPC) is a signal your browser sends to every site you visit. Nullecho sends it (see our privacy page), and so do some browsers.

California: a business that sells or shares personal information must treat a qualifying signal as a valid opt-out "for that browser or device and any consumer profile associated with that browser or device", and, if it knows who you are, for you Cal. Code Regs. tit. 11, § 7025(b), (c)(1).
Colorado: the Attorney General lists GPC as a recognized universal opt-out mechanism Colorado AG, Universal Opt-Out.
Connecticut and Minnesota also require companies to accept opt-out preference signals for targeted advertising and sales Conn. Gen. Stat. § 42-520 Minn. Stat. § 325M.14, subd. 3.

Its limits: GPC covers only the browser that sends it, so your phone and other browsers need their own. It only matters to companies that sell or share data or use it for targeted ads, and your browser can't see whether a company honored it. A written opt-out (template 3) names you, so it can also cover your account and records that aren't tied to one browser.

In California, you don't have to prove who you are to opt out

"A business shall not require a verifiable consumer request for a request to opt-out of sale/sharing." It may ask only for what it needs to find your records, and must stop selling or sharing no later than 15 business days after it gets the request Cal. Code Regs. tit. 11, § 7026(d), (f)(1). Requests to know, delete or correct are different: the business may verify your identity first Cal. Civ. Code § 1798.140(ak). Use the company's own portal for that, and don't email copies of ID documents.

How long a company has to answer

45 days

California: to answer a request to know, delete or correct, extendable once by 45 more with notice

10 bus. days

California: to confirm it received the request

15 bus. days

California: to stop selling or sharing after an opt-out

90 days

Iowa: the longest in the table, extendable by 45

California's 45 days runs from when the business receives your request, even while it verifies who you are Cal. Civ. Code § 1798.130(a)(2)(A); the 10-day confirmation and the 15-day opt-out rule are in the regulations Cal. Code Regs. tit. 11, §§ 7021(a), 7026(f)(1). A business doesn't have to answer a right-to-know request from the same person more than twice in 12 months § 1798.130(b).

Most other states use 45 days plus one 45-day extension; Iowa allows 90 plus 45 Iowa Code § 715D.3(2)(a) and Florida 45 plus 15 Fla. Stat. § 501.706(2). Each state's is in the table. If a company refuses, these laws generally require it to tell you why and how to appeal, for example Va. Code § 59.1-577(B)(2). Keep a copy of what you sent and the date.

Which states have these rights

US states with a comprehensive consumer privacy law in force on October 14, 2026: 19 broad laws plus Florida's narrow one. We checked every row against the statute, the enacted bill, or the state attorney general's page, linked in the last column. "Profiling" here means profiling used for decisions with legal or similarly significant effects, such as housing, credit or jobs; the exact wording differs by state.

State	In force since	Know / access	Delete	Opt out of	Correct	Deadline (days)	Sources
CaliforniaCal. Civ. Code § 1798.100 et seq.	2020-01-01	Yes, incl. inferences	Data collected from you	Sale, sharing	Yes	45 + 45; opt-out 15 business days	§ 1798.110 § 1798.198 regs
ColoradoColo. Rev. Stat. § 6-1-1301 et seq.	2023-07-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	AG SB21-190
ConnecticutConn. Gen. Stat. § 42-515 et seq.	2023-07-01	Yes, incl. inferences (since 2026-07-01)	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 42-518 2026 supp.
DelawareDel. Code tit. 6, ch. 12D	2025-01-01	Yes, plus categories of third parties	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 12D-104 AG
FloridaFla. Stat. § 501.701 et seq. · narrow	2024-07-01	Yes, but only against companies with over $1 billion in revenue that also meet an online-ads, smart-speaker or app-store test	Yes	Sale, targeted ads, profiling, more	Yes	45 + 15	§ 501.702–.706 ch. 2023-201
IndianaInd. Code art. 24-15	2026-01-01	Yes (copy or summary)	Yes	Sale, targeted ads, profiling	Data you provided	45 + 45	SEA 5 (2023)
IowaIowa Code ch. 715D	2025-01-01	Yes	Data you provided	Sale	No	90 + 45	§ 715D.3 SF 262 § 10
KentuckyKy. Rev. Stat. § 367.3611 et seq.	2026-01-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 367.3615
MarylandMd. Code, Com. Law § 14-4701 et seq.	2025-10-01	Yes, plus categories of third parties	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 14-4705 SB 541
MinnesotaMinn. Stat. § 325M.10 et seq.	2025-07-31	Categories, plus specific third parties	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 325M.14 2024 c. 121
MontanaMont. Code Ann. § 30-14-2801 et seq.	2024-10-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 30-14-2808 SB 384
NebraskaNeb. Rev. Stat. § 87-1101 et seq.	2025-01-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 87-1107 LB1074
New HampshireN.H. Rev. Stat. ch. 507-H	2025-01-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 507-H:4
New JerseyN.J. Stat. § 56:8-166.4 et seq.	2025-01-15	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	P.L.2023, c.266
OregonORS 646A.570 et seq.	2024-07-01	Yes, incl. derived data, plus specific third parties	Yes, incl. data from other sources and derived data	Sale, targeted ads, profiling	Yes	45 + 45	ORS 646A DOJ
Rhode IslandR.I. Gen. Laws ch. 6-48.1	2026-01-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 6-48.1-5 § 6-48.1-6
TennesseeTenn. Code Ann. § 47-18-3201 et seq.	2025-07-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	Pub. Ch. 408
TexasTex. Bus. & Com. Code ch. 541	2024-07-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 541.051–.052
UtahUtah Code ch. 13-61	2023-12-31	Yes	Data you provided	Sale, targeted ads	Yes, since 2026-07-01	45 + 45	§ 13-61-201 § 13-61-203
VirginiaVa. Code § 59.1-575 et seq.	2023-01-01	Yes	Yes	Sale, targeted ads, profiling	Yes	45 + 45	§ 59.1-577 2021 ch. 36

"45 + 45" means 45 days, which the company may extend once by 45 more if it tells you within the first 45. Passed but not yet in force: Louisiana (Act 502, from 2027-01-01) legis.la.gov, Oklahoma (SB 546, from 2027-01-01) enrolled text, Alabama (HB 351, from 2027-05-01 per its enrolled text; we did not confirm the governor's signature on an official page, so check your state AG) enrolled text, and Vermont (Act 145, from 2028-01-01) Act 145. Not listed? If your state isn't in this table, it had no comprehensive privacy law in force on October 14, 2026, as far as we found. Some companies honor requests from everyone anyway, so it can still be worth asking. Check your state attorney general's site for anything newer.

Four letters you can send yourself

Fill in the blanks once and all four letters update. Then copy one and paste it into an email to the company's privacy address, or into its own request form. The text stays on your device: nothing you type is sent, saved or seen by anyone until you send it yourself.

CompanyAs it appears on its site Your full nameAs the company knows you Email you use with themSend from this address if you can Loyalty or account numberOptional Your stateAdds your state's law to the letter

1. "Tell me what you know about me"

Asks for your data, the inferences and segments drawn from it, and your loyalty profile.

Subject: Privacy request – what personal information you hold about me

To the privacy team at [COMPANY]:

I am making a request to know and access my personal information under the consumer privacy law of the state where I live. Please send me:

1. A copy of the specific personal information you have collected about me, from any source.
2. Any inferences, scores, segments, audiences, labels or profiles you have created about me or obtained from others, including anything that estimates my interests, habits, income, price sensitivity or likelihood to buy.
3. My loyalty or rewards program profile, including my purchase history, any tier, segment or label I am in, and the offers, coupons and discounts you have shown or sent me.
4. Where you got my information, what you use it for, and the third parties you have disclosed, sold or shared it to (by name, where the law allows).

To find my records: name [YOUR NAME], email [YOUR EMAIL]. I am sending this from that address. If you need more to verify my identity, please tell me exactly what and why, and I will use your own request page to provide it.

Please confirm you received this request and respond within the time the law allows. If you deny any part, please tell me which part, the reason, and how to appeal.

[YOUR NAME]
[DATE]

Where to send it: look for "Your Privacy Choices", "Privacy request" or "Do Not Sell or Share" in the company's site footer or privacy policy. A California business must offer at least two ways to send this, usually including a toll-free number § 1798.130(a)(1)(A).

2. "Delete my data"

Asks the company, and the companies it passed your data to, to delete it.

Include my loyalty or rewards data (this may close the account and lose points)

Subject: Privacy request – delete my personal information

To the privacy team at [COMPANY]:

I am requesting that you delete the personal information you hold about me, under the consumer privacy law of the state where I live. This includes any inferences, scores, segments and profiles about me.

Please also tell your service providers, contractors, and anyone you sold or shared my information with to delete it. If you keep any of it under a legal exception, please tell me what you are keeping and why.

To find my records: name [YOUR NAME], email [YOUR EMAIL]. I am sending this from that address.

Please confirm when this is done, within the time the law allows.

[YOUR NAME]
[DATE]

Where to send it: the same privacy-request page or address. Some companies ask you to confirm a deletion request a second time; watch for that email.

3. "Don't sell or share my data"

Opts you out of the sale or sharing of your data, targeted advertising and covered profiling.

Subject: Privacy request – do not sell or share my personal information

To the privacy team at [COMPANY]:

Under the consumer privacy law of the state where I live, I am opting out of the sale and sharing of my personal information, its use for targeted advertising, and profiling that produces legal or similarly significant effects, to the full extent the law gives me those rights.

Please apply this to every account, device and record you associate with me. If you receive a Global Privacy Control signal from my browser, please treat it as applying to my account as well.

To find my records: name [YOUR NAME], email [YOUR EMAIL].

Please confirm when this has taken effect.

[YOUR NAME]
[DATE]

Where to send it: the "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, usually in the site footer. In California a business that sells or shares must offer that link, unless it honors opt-out signals like GPC instead § 1798.135(a)–(b).

4. "Correct my data"

Asks the company to fix what's wrong, including in profiles built from it.

What's wronge.g. "my income bracket" What it should say

Subject: Privacy request – correct my personal information

To the privacy team at [COMPANY]:

Under the consumer privacy law of the state where I live, I am requesting that you correct inaccurate personal information you hold about me.

What is wrong: [WHAT IS WRONG]
What it should say: [WHAT IT SHOULD SAY]

Please correct it everywhere you hold it, including in any profile, segment or score built from it, and confirm when it is done.

To find my records: name [YOUR NAME], email [YOUR EMAIL]. I am sending this from that address.

[YOUR NAME]
[DATE]

Where to send it: the same privacy-request page. The company may ask for documents to show the correct value; send them only through its own portal.

Sources

Every source was read on October 14, 2026. "As enacted" means the bill as passed; later amendments may change details.

Cal. Civ. Code § 1798.105 (right to delete). Accessed 2026-10-14.
Cal. Civ. Code § 1798.106 (right to correct). Accessed 2026-10-14.
Cal. Civ. Code § 1798.110 (right to know). Accessed 2026-10-14.
Cal. Civ. Code § 1798.120 (opt out of sale or sharing). Accessed 2026-10-14.
Cal. Civ. Code § 1798.125 (no retaliation; loyalty programs). Accessed 2026-10-14.
Cal. Civ. Code § 1798.130 (request methods, 45-day deadline, twice per 12 months). Accessed 2026-10-14.
Cal. Civ. Code § 1798.135 ("Do Not Sell or Share" link; opt-out preference signals). Accessed 2026-10-14.
Cal. Civ. Code § 1798.140 (definitions: (v)(1)(K) inferences, (ak) verifiable consumer request). Accessed 2026-10-14.
Cal. Civ. Code § 1798.198 (operative January 1, 2020). Accessed 2026-10-14.
Cal. Code Regs. tit. 11, §§ 7021, 7025, 7026, CalPrivacy's approved regulation text (package approved September 2025). Accessed 2026-10-14.
California Attorney General, Opinion No. 20-303 (March 10, 2022) (right to know covers internally generated inferences). Accessed 2026-10-14.
CalPrivacy, Delete Request and Opt-out Platform (DROP) (status and timeline). Accessed 2026-10-14.
Colorado Attorney General, Colorado Privacy Act (rights; in effect July 1, 2023). Accessed 2026-10-14.
Colorado SB21-190 as enacted, § 6-1-1306 (rights; 45 + 45 days). Accessed 2026-10-14.
Colorado Attorney General, Universal Opt-Out Mechanisms (GPC recognized). Accessed 2026-10-14.
Conn. Gen. Stat. ch. 743jj, §§ 42-518, 42-520 (P.A. 22-15 effective July 1, 2023). Accessed 2026-10-14.
Conn. Gen. Stat. ch. 743jj, 2026 Supplement, § 42-518 as amended by P.A. 25-113, effective July 1, 2026 (inferences). Accessed 2026-10-14.
Del. Code tit. 6, ch. 12D, § 12D-104. Accessed 2026-10-14.
Delaware DOJ, Personal Data Privacy Portal: Consumers (in effect January 1, 2025). Accessed 2026-10-14.
Fla. Stat. ch. 501, part V, §§ 501.702(9), 501.705, 501.706. Accessed 2026-10-14.
Laws of Florida ch. 2023-201 (takes effect July 1, 2024). Accessed 2026-10-14.
Indiana Senate Enrolled Act 5 (2023) as enacted, IC 24-15-3-1 ("effective January 1, 2026"). Accessed 2026-10-14.
Iowa Code 2026, ch. 715D, § 715D.3. The official site, legis.iowa.gov, did not respond on October 14, 2026, so this links the Internet Archive's copy of its PDF (captured 2026-08-10). Accessed 2026-10-14.
Iowa Senate File 262 (2023), enrolled, § 10 (takes effect January 1, 2025). Internet Archive copy of legis.iowa.gov, captured 2026-10-11. Accessed 2026-10-14.
Ky. Rev. Stat. § 367.3615 (effective January 1, 2026). Accessed 2026-10-14.
Md. Code, Com. Law § 14-4705 (opens only with JavaScript on). Accessed 2026-10-14.
Maryland SB 541 (2024), Chapter 455 (effective October 1, 2025). Accessed 2026-10-14.
Minn. Stat. § 325M.14. Accessed 2026-10-14.
Minn. Laws 2024, ch. 121, art. 5, § 14 (effective July 31, 2025). Accessed 2026-10-14.
Mont. Code Ann. § 30-14-2808. Accessed 2026-10-14.
Montana Legislative Services memo on SB 384 (2023), which attaches the enacted text ("[This act] is effective October 1, 2024"). Accessed 2026-10-14.
Neb. Rev. Stat. § 87-1107 and § 87-1108. Accessed 2026-10-14.
Nebraska LB1074 (2024) slip law, § 100 (operative January 1, 2025). Accessed 2026-10-14.
N.H. Rev. Stat. ch. 507-H (2024, 5:1, eff. January 1, 2025). Accessed 2026-10-14.
N.J. P.L.2023, c.266 as enacted (approved January 16, 2024; takes effect on the 365th day after). Accessed 2026-10-14.
ORS chapter 646A, §§ 646A.570, 646A.574, 646A.576. Accessed 2026-10-14.
Oregon DOJ, Privacy (takes effect July 1, 2024). Accessed 2026-10-14.
R.I. Gen. Laws § 6-48.1-5 (effective January 1, 2026). Accessed 2026-10-14.
R.I. Gen. Laws § 6-48.1-6. Accessed 2026-10-14.
Tennessee Public Chapter 408 (2023) as enacted, § 47-18-3203 ("takes effect July 1, 2025"). Accessed 2026-10-14.
Tex. Bus. & Com. Code ch. 541 (eff. July 1, 2024). Accessed 2026-10-14.
Utah Code § 13-61-201 (effective July 1, 2026), ch. 13-61 (effective December 31, 2023), and H.B. 418 (2025), which added the right to correct as subsection (4), effective July 1, 2026 (§ 10). Accessed 2026-10-14.
Utah Code § 13-61-203. Accessed 2026-10-14.
Va. Code tit. 59.1, ch. 53, §§ 59.1-577, 59.1-578. Accessed 2026-10-14.
Va. Acts 2021 Sp. Sess. I, ch. 36, enactment 4 (effective January 1, 2023). Accessed 2026-10-14.
Louisiana SB 386 (2026), Act 502, effective January 1, 2027. Accessed 2026-10-14.
Oklahoma SB 546, enrolled ("effective January 1, 2027"); approved by the governor March 20, 2026 per the bill page. Accessed 2026-10-14.
Alabama HB 351 (2026), enrolled, § 12 ("effective on May 1, 2027"). Accessed 2026-10-14.
Vermont Act 145 (2026), as enacted, § 4 ("take effect on January 1, 2028"). Accessed 2026-10-14.
Consumer Reports press release, June 16, 2026 (ride-hail pricing investigation). Accessed 2026-10-14.
Consumer Reports, May 21, 2025 (grocery loyalty profile obtained under Oregon's law). Accessed 2026-10-14.

Ask a company what it knows about you.