Access, Correction, and Deletion Rights
All five states grant access and deletion; the right to correction is provided by everyone except Utah. Deletion scope differs: Colorado, Connecticut, Virginia cover all held data, while California and Utah limit deletion to data collected from the consumer.
| Right | States providing it | Notable scope |
|---|---|---|
| Access | All five | Confirm processing and access categories/specific data |
| Right to correction | California, Colorado, Connecticut, Virginia | Utah lacks it |
| Right to delete | All five | CO/CT/VA = all held data; CA/UT = only data collected from the consumer |
Deletion is subject to exceptions - completing a consumer-requested transaction, detecting/protecting against security incidents, and complying with legal obligations. California adds a requirement to notify service providers, contractors, and third parties (if possible) to delete the data.
Utah is the only state without a right to correction. And for deletion, California and Utah limit it to data collected from the consumer, whereas Colorado, Connecticut, and Virginia reach all data the business holds.