Rules
How to Use California Privacy Rights to Limit a Finance App's Data Sharing
California privacy rights finance app users can demand deletion and opt out of sale or sharing. Learn what a request needs and what happens if ignored.
What to take away
- California residents can ask a finance app to delete personal information and to stop selling or sharing it, rights most other US consumers do not have.
- A valid request needs enough identifying detail for the business to match you, but not a full account history or a signed form.
- Businesses must confirm receipt within 10 business days and respond to the request within 45 calendar days, extendable once by another 45.
- If a company refuses, the record you keep mattersthe California Attorney General enforces the statute, and the CFPB complaint route runs in parallel.
- The strongest paper trail is a dated written request sent through a channel the company itself lists.
Who has jurisdiction
The California Consumer Privacy Act, amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet thresholds on revenue or on how much personal information they buy, sell or share. The California Attorney General's office publishes the official summary of these rights at the CCPA page.
A finance app usually sits behind a chartered bank or a licensed lender. That matters, because federal rules can preempt parts of state privacy law for data tied to a financial product. The CCPA itself carves out information covered by the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act.
So the practical split is this. Account and transaction data held under a bank charter may fall outside the CCPA. Marketing data, device data, and data sold to advertising partners usually do not. File the request anyway and let the company state its exemption in writing.
What a compliant disclosure contains
When a business collects your data, it must tell you the categories collected, the purposes, the categories of third parties receiving it, and whether it sells or shares that information. A compliant privacy notice names those categories rather than saying "partners" and stopping there.
Your own request has a lower bar. Under the statute a business may ask for information to verify you, but it cannot demand more than is reasonable. For a low-risk request it typically needs your name, the email or phone tied to the account, and your California residency.
A workable request letter contains four things:
- Your full name and the email or phone number on the account.
- A clear statement that you are a California resident exercising rights under the CCPA and CPRA.
- The specific asksdelete, opt out of sale or sharing, and correct inaccurate data.
- The date, and a request that the company confirm receipt in writing.
Keep a copy. Send it through the channel the app lists in its own privacy notice, which is often a web form rather than a support inbox.
Records to keep
Keep the confirmation of receipt, the final response, and any denial with its stated reason. If the company claims an exemption, that written claim is the thing you quote later.
A simple log works. Date sent, channel used, date of acknowledgment, date of substantive answer, and outcome. If the response arrives late or not at all, the log turns a vague grievance into a dated file.
Screenshot the privacy notice as it read on the day you filed. Notices change, and the version in force when you made the request is the one that governs it.
What happens if you do not
Nothing enforces itself. A company that ignores a request faces no automatic penalty from your inaction, and the data keeps moving.
CCPA penalties for noncompliance
- 30 daysto cure an alleged violation
- $2,500per violation
- $7,500per violation involving consumers under 16
The concrete consequence sits on the company side. The Attorney General can bring an enforcement action, and a business that fails to cure an alleged violation within 30 days can face civil penalties of up to $2,500 per violation, or $7,500 for violations involving consumers under 16. Those figures come from the statute's enforcement provisions.
For you, the consequence is different. Unanswered requests leave your data in advertising and analytics pipelines, and the opt-out right is lost for that period. The CFPB accepts complaints about consumer finance companies at the complaint portal, which creates a second, federal record.
A request sent and never answered is still useful. The dated confirmation, or the absence of one, is evidence.
Where the rules differ by place
The CCPA is not a national standard. It reaches California residents, and a handful of other states have passed their own privacy laws with narrower or differently worded rights.
Most states have no comprehensive consumer privacy statute at all. A resident of Texas or Florida cannot file the same request under the same authority, though a company may honor it as a matter of policy.
If you move, the right generally follows residency at the time of the request. If you hold a California billing address on the account, say so and cite it.
Example
A budgeting app user in Sacramento files a deletion and opt-out request through the app's privacy web form. The company acknowledges in six business days and answers in 38 calendar days.
It deletes marketing profile data and confirms the opt-out. It declines to delete transaction records, citing its bank partner and federal recordkeeping rules. The user now has a dated document naming the exemption and the data categories retained, which is more than most users ever get.
That outcome is typical. Partial compliance with a written reason is the realistic result, not total erasure.
