You Have More Power Than You Think
A lot of people feel like once a company has their data, there is nothing they can do. That is not true. Privacy laws have been evolving fast, and depending on where you live, you likely have real, enforceable rights over your personal information. The problem is not that these rights do not exist. The problem is that most people do not know about them.
If You Live in California: The CCPA
The California Consumer Privacy Act is one of the strongest privacy laws in the United States. Here is what it gives you.
The Right to Know
You can ask any business what personal information they have about you, where they got it, why they collected it, and who they shared it with. They must respond within 45 days.
The Right to Delete
You can request that a business delete the personal information they collected from you. They must comply and also tell any third parties they shared your data with to delete it.
The Right to Opt Out
You can tell any business to stop selling or sharing your personal information. Businesses that sell data must have a visible link on their website that says "Do Not Sell My Personal Information."
The Right to Correct
If a company has wrong information about you, you can request they fix it.
The Right to Non-Discrimination
A company cannot punish you for using your privacy rights. They cannot charge you more, give you worse service, or deny you access because you asked them to delete your data.
If You Are in the EU: The GDPR
The General Data Protection Regulation is one of the strongest privacy frameworks in the world.
Consent Must Come First
Under GDPR, companies cannot collect your data unless you explicitly agree to it. This is the opposite of the U.S. model, where companies collect by default and you have to opt out. In Europe, you opt in, and you can withdraw your consent at any time.
The Right to Be Forgotten
You can request that any company delete all personal data they hold about you. They must comply within 30 days unless there is a legal reason to keep it.
Data Portability
You can request a copy of your data in a format that lets you take it to another service. This stops companies from holding your information hostage.
Challenge Automated Decisions
If a company uses algorithms to make decisions about you—hiring, credit, content—you have the right to challenge those decisions and request human review.
Real Penalties
GDPR fines can reach 20 million euros or 4% of a company's global revenue, whichever is higher. Google has been fined 50 million euros under this law. These are not empty threats.
More U.S. States Are Catching Up
The U.S. does not have a single federal privacy law yet, but the landscape is changing fast. As of 2026, states including Colorado, Connecticut, Virginia, Utah, Indiana, Kentucky, and others have enacted comprehensive privacy laws. While details vary, most give you some version of the right to access, delete, correct, and opt out of the sale of your data. More states are expected to follow.
How to Actually Use These Rights
- Find the privacy policy. Look at the bottom of any company's website for a link labeled Privacy or California Privacy Rights. In apps, check the settings menu.
- Submit a request. Most companies have online forms or email addresses for privacy requests. Look for phrases like "Submit a Privacy Request" or "Exercise Your Rights."
- Use DROP if you are in California. The Delete Request and Opt-Out Platform went live in January 2026 and lets you send one deletion request to all registered data brokers at once. It is free.
- Be persistent. Companies have 45 days to respond. If they do not, follow up. If they refuse, file a complaint with your state attorney general or privacy agency.
- Document everything. Keep records of your requests and responses. Documentation makes formal complaints much easier.
Every time you exercise your rights, you are not just protecting yourself. You are adding to the collective pressure that forces companies to treat personal data with respect. These rights exist because people fought for them. Use them.