Consumer Rights Overview and Response Timelines
These laws grant GDPR-like rights (access, correction, deletion, portability, opt-outs, etc.). Response times: Colorado, Connecticut, Utah, Virginia allow 45 days (+45 more if needed); California uses 45 days generally but only 15 days for opt-out requests. Right to appeal exists in Colorado, Connecticut, Virginia only.
Consumer rights mirror the GDPR and include: access, correction, deletion, data portability, opt out of sales, opt out of targeting/cross-context behavioral advertising, right against automated decision-making, right concerning sensitive personal information, and nondiscrimination.
| State | Standard response time | Special rule | Right to appeal? |
|---|---|---|---|
| Colorado | 45 days (+45 if reasonably necessary) | - | Yes |
| Connecticut | 45 days (+45 if reasonably necessary) | - | Yes |
| Virginia | 45 days (+45 if reasonably necessary) | - | Yes |
| Utah | 45 days (+45 if reasonably necessary) | - | No |
| California | 45 days for certain requests | Opt-out requests: 15 days | No |
Two California traps: opt-out requests get only 15 days (not 45), and California lacks an explicit right to appeal (so does Utah). The right to appeal belongs to Colorado, Connecticut, and Virginia.