CCPA/CPRA Redaction Guide: Personal Information Requests

By the SladdPDF team · Published August 26, 2026 · Updated August 26, 2026

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents rights over the personal information businesses hold about them — and it comes with a redaction problem most guides skip. When a business fulfills a "right to know" request by compiling a record of what it holds, that record often contains other people's data, and specific fields the law says should never appear in the response at all. Here's what counts as personal information under the CCPA, what has to stay out of a disclosure, and how to build a workflow around it.

What is the CCPA/CPRA and who must comply?

The CCPA is a California statute, codified at Cal. Civ. Code § 1798.100 et seq., that took effect January 1, 2020. In November 2020, California voters approved Proposition 24 — the California Privacy Rights Act (CPRA) — which amended and expanded the CCPA; most of its provisions took effect January 1, 2023. The CPRA also created the California Privacy Protection Agency (CPPA), the first dedicated state-level privacy regulator in the United States, with rulemaking and enforcement authority alongside the state Attorney General.

The law generally applies to a for-profit business doing business in California that meets at least one of three thresholds: annual gross revenue above $25 million, buying, selling or sharing the personal information of 100,000 or more California consumers or households in a year, or deriving 50% or more of annual revenue from selling or sharing consumers' personal information. A notable CPRA change: the temporary exemptions that had let businesses treat employee and B2B-contact data more loosely expired on January 1, 2023, so most employee and business-contact personal information now falls under the same general obligations as customer data.

What counts as personal information?

Cal. Civ. Code § 1798.140 defines "personal information" broadly: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The statute lists example categories rather than a short fixed list, including:

• Identifiers — name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, driver's license number, passport number
• Commercial information — records of products or services purchased, obtained, or considered
• Biometric information
• Internet or other electronic network activity — browsing history, search history, interaction with a website or app
• Geolocation data
• Professional or employment-related information
• Education information subject to FERPA
• Inferences drawn from any of the above to create a profile about preferences, characteristics, or behavior

Publicly available government records and de-identified or aggregate information are excluded from the definition. Everything else is broad enough that most documents a business assembles about a specific person — support tickets, order history exports, HR files, marketing profiles — will contain personal information under this definition, even without an obvious identifier like a Social Security number on the page.

Sensitive personal information: the CPRA's stricter category

The CPRA introduced a narrower, higher-risk subset called "sensitive personal information" (also defined at § 1798.140), which consumers can specifically direct a business to limit the use of. It includes:

• Social Security, driver's license, state ID card, and passport numbers
• Account log-in credentials combined with a password or security code
• Precise geolocation
• Racial or ethnic origin, religious or philosophical beliefs, or union membership
• The contents of a consumer's mail, email, and text messages, unless the business is the intended recipient
• Genetic data
• Biometric information processed for the purpose of uniquely identifying a consumer
• Health information
• Information about a consumer's sex life or sexual orientation

The consumer rights the law creates

The CCPA/CPRA gives California consumers several distinct rights, and a redaction workflow needs to know which one it's supporting:

• Right to know — what personal information a business has collected, the categories and sources, why it was collected, and who it was shared with; consumers can also request the specific pieces of personal information the business holds.
• Right to delete — request deletion of personal information the business has collected, subject to statutory exceptions.
• Right to correct — added by the CPRA, the right to request correction of inaccurate personal information.
• Right to opt out of sale/sharing — including cross-context behavioral advertising, via a "Do Not Sell or Share My Personal Information" mechanism.
• Right to limit use of sensitive personal information — restrict use to what's necessary to provide the requested goods or services.
• Right to non-discrimination — a business cannot deny goods/services, charge different prices, or provide a different quality of service because a consumer exercised a CCPA right.

Redaction work concentrates almost entirely around the right-to-know request: a business has to assemble a response document — often a PDF or export — and that document is exactly where over-disclosure risk lives.

What has to be redacted from a right-to-know response

Two separate redaction problems show up in a right-to-know response, and it's easy to only catch one of them.

First: specific fields the regulations say never to disclose. CCPA regulations direct businesses responding to a request for specific pieces of personal information not to disclose a consumer's Social Security number, driver's license number or other government-issued identification number, financial account number, health insurance or medical identification number, account password, or security questions and answers. These fields should be redacted or omitted, with the response describing the category of information held (e.g., "financial account number") instead of showing the value.

Second: other people's personal information that ends up in the same record. A support ticket, an email thread, or a shared document frequently contains a second person's name, contact details, or account information alongside the requesting consumer's own data. Disclosing that second person's personal information to someone else's right-to-know request creates its own exposure — the fix is the same discipline used for GDPR data-subject access requests: redact everyone in the record except the person who has the right to see it.

Enforcement, penalties and the limited right to sue

The CPPA and the California Attorney General share enforcement authority; the CPPA took on primary rulemaking and enforcement responsibility beginning in mid-2023. Civil penalties under § 1798.155 can reach up to $2,500 per violation, or up to $7,500 per intentional violation and for violations involving a consumer known to be under 16. The CPRA removed the mandatory 30-day cure period that businesses previously had before enforcement, though regulators retain discretion in how they proceed.

Consumers themselves cannot sue over most CCPA violations. Cal. Civ. Code § 1798.150 creates a private right of action limited to specific data breaches — where nonencrypted, nonredacted personal information is exfiltrated, stolen or disclosed because a business failed to implement and maintain reasonable security procedures — with statutory damages of $100 to $750 per consumer per incident (or actual damages, if higher). Outside that breach scenario, enforcement runs through the CPPA and Attorney General, not individual lawsuits.

A practical CCPA redaction workflow

A defensible way to prepare a right-to-know response, or any document a California business shares that contains personal information, without any of it touching a third-party server:

1. Identify which right is being exercised. A right-to-know response has different redaction rules than an internal record being shared with a vendor or produced in litigation.
2. Redact the regulator-designated fields unconditionally. Social Security number, driver's license number, financial account number, health/medical ID number, account passwords and security answers do not belong in a right-to-know disclosure.
3. Scan for other consumers' data in the same record. Shared inboxes, support tickets and multi-party documents often carry a second person's personal information that the requester has no right to see.
4. Redact with a method that removes data, not one that covers it. A rectangle drawn over text in a PDF leaves the underlying text layer intact and often still selectable — the same failure pattern behind many public redaction failures.
5. Strip metadata on export. Author fields, prior revisions and embedded file properties can carry identifiers that never appear on the visible page.
6. Verify before sending. Select all, copy, and search the exported file for the redacted values. If they surface, the redaction did not work.

You can run this entire workflow in SladdPDF, a free browser-based redaction tool. It processes files locally with JavaScript and WebAssembly — a consumer's personal-information report never leaves your device, and the tool works offline once loaded. Secure mode rasterizes each page on export, destroying the underlying text layer, and metadata can be stripped in the same pass. The free version redacts documents with no page limit; a Pro license unlocks high-resolution 300 DPI export.

This article is general guidance, not legal advice. Whether a specific field must be withheld, and how the CCPA/CPRA applies to a particular business, depends on facts that should be checked with counsel or a privacy officer.