The United States has no general federal privacy statute. Rights come from state law, and California’s is the most developed. Under the CCPA a consumer can use an authorised agent to submit requests to know, delete or correct personal information, and to opt out of its sale or sharing.
What a business can ask for
The CCPA regulations (section 7063) let a business require an agent to show the consumer’s signed permission. The business may also ask the consumer to verify their own identity directly, or to confirm directly that they gave the agent permission. Those extra steps fall away where the agent holds a power of attorney under the California Probate Code, but a business cannot insist on one.
What an agent cannot do
An agent must keep the consumer’s information reasonably secure. It must not use that information, or anything collected from or about the consumer, for any purpose other than fulfilling the consumer’s requests, verification or fraud prevention.
The agent role is a service to the consumer. It is not a licence to use the data.
A business that wants to act as agent and also earn from the data needs a separate legal footing for that second activity, and a clear line between the two.
Beyond California
Other states, Colorado and Connecticut among them, recognise authorised agents, typically for opt-out requests only. The detail differs state by state.
California has also built an intermediary of its own. Under the Delete Act, its Delete Request and Opt-Out Platform lets a resident send one request to every registered data broker. Brokers have had to act on those requests since 1 August 2026.
For anyone building in this space, an authority that works in the UK or EU will not automatically satisfy California’s rules. Map the requirements state by state before designing the mandate.
This article is general information on the law as at October 2026. It is not legal advice and has not been updated since that date. See the terms of use.