Privacy ComplianceData Subject Requests
Why Opt-Out Requests Should Not Require Identity Verification
A business should not require identity verification before honoring an opt-out request. California prohibits it, and its privacy agency has fined two companies that required it. Verification should be reserved for requests to access, delete, or correct personal information.
By Alex Proctor
Published September 28, 2026
Summary
Opt-out requests do not need identity verification, because the harm from an imposter opting someone out is minimal. California and Oregon prohibit it, and other states do not require it. In contrast, requests to access, delete, or correct personal information do require verification, because an imposter could obtain, erase, or change another person's data.
Why Is Verification Prohibited for Opt-Out Requests?
California's regulations state that a business "shall not require a consumer to verify their identity" to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information. The agency explained its reasoning in its order against Honda. The harm from an imposter opting someone out is minimal or nonexistent, so a verification requirement only impairs the consumer's ability to exercise the right. The agency treated the verification step as a design that impairs consumer choice, which is the same rule it applies to dark patterns in cookie banners.
A business may still ask for a name or an email address, but only when it needs that information to match the consumer to its records and apply the opt-out. A business that can apply the opt-out without additional information has to do so. The regulations give the example of a business that asks for a name, which is permitted, and one that requires a photo of the consumer holding a driver's license, which is not.
Opt-out preference signals follow the same principle. A signal is an opt-out request sent by the visitor's browser, so the rules for opt-out requests apply to it. A business should honor the signal for that browser without requiring a login or additional information. However, it may offer the visitor the option to log in or identify themselves, so that the opt-out can also be applied to offline data and other records the business holds beyond its web trackers.
What Do Other States Say?
State privacy laws handle opt-out requests in one of three ways. Oregon takes California's position and requires a business to comply with an opt-out request "without requiring authentication."
The largest group of states uses nearly identical wording. Connecticut, Delaware, Minnesota, and New Hampshire each provide that a business is not required to authenticate an opt-out request. That language removes the obligation to verify rather than prohibiting it.
A smaller group, which includes Virginia and Nebraska, treats an opt-out request like any other privacy request. Under those laws, a business may decline to act on a request it cannot authenticate using commercially reasonable efforts. Verifying an opt-out request is therefore permitted in those states, although it is not required.
I recommend following California's rule in every state, because a verification step on an opt-out form adds friction without protecting anyone. A business does not need a verification step to guard against fraud. Most state privacy laws, including California's and Oregon's, allow a business to deny an opt-out request when it has a good-faith, reasonable, and documented belief that the request is fraudulent.
What Have Regulators Enforced?
California's privacy agency issued an enforcement advisory in April 2024. It warned that businesses were asking consumers for excessive and unnecessary personal information when processing privacy requests. Two enforcement actions followed.
In March 2025, Honda agreed to pay $632,500, in part because of how its privacy request form handled opt-out requests. The agency found that the form required the same eight data fields for every type of request, including name, full address, email, and phone number. Honda matched that information against its records before it would process an opt-out request, which the agency treated as verification that added unnecessary friction. At least 20 opt-out requests were denied as a result of the verification process that was in place at the time.
In May 2025, Todd Snyder agreed to pay $345,178 over several violations. According to the agency, the retailer required consumers to verify their identity before they could opt out. It also required consumers to submit more information than necessary to process their requests.
Which Requests Do Require Verification?
Requests to access, delete, or correct personal information require verification. A business that discloses, deletes, or changes personal information at the request of the wrong person has harmed the consumer the law was written to protect. The level of verification depends on the type of request and the sensitivity of the information.
| Request | Verification | California standard |
|---|---|---|
| Opt out of sale or sharing | Prohibited | Only the information needed to apply it |
| Limit use of sensitive information | Prohibited | Only the information needed to apply it |
| Access specific information | Required | Reasonably high certainty |
| Access categories of information | Required | Reasonable certainty |
| Delete personal information | Required | Reasonable or reasonably high certainty |
| Correct personal information | Required | Reasonable or reasonably high certainty |
Based on California's regulations (11 CCR 7026, 7027, and 7060 to 7062), as of September 2026.
California's regulations describe what each level means for a consumer who does not have an account. A reasonable degree of certainty may include matching at least two data points against the business's records. A reasonably high degree may include matching at least three, together with a signed declaration under penalty of perjury. For deletion and correction, the business chooses between the two levels based on how sensitive the information is.
When the consumer has an account, the business may rely on its existing login and ask the consumer to sign in again. California and Colorado both direct businesses to verify with the information they already hold wherever possible. A business may not charge a fee for verification, and it should avoid collecting sensitive identifiers, such as a driver's license number, unless they are necessary.
Questions
Does a request to delete personal information require verification?+
Yes. California treats requests to delete, correct, and know as verifiable requests. The level of verification depends on the sensitivity of the information and the risk of harm from an unauthorized deletion, so a request to delete browsing history may call for less than a request to delete family photographs.
How does a business confirm that an authorized agent speaks for the consumer?+
A business may check the agent's authority, which is different from verifying the consumer's identity. For an opt-out request, it may ask the agent for the consumer's signed permission, but it may not require the consumer to confirm that permission. The agency found that step unlawful in the Honda order. For a request to delete, correct, or access personal information, a business may also require the consumer to verify their identity or to confirm the agent's permission directly with the business.
What if a business holds only an email address for the consumer?+
The data point counts in California's regulations are examples of how to reach each level of certainty, not fixed requirements. A business that holds only an email address may be able to verify a lower-risk request by confirming that the requestor controls that address. If it cannot verify a request for specific pieces of personal information, it has to deny that request, tell the requestor that it could not verify their identity, and treat it as a request for categories of information.
Briefings are informational and do not constitute legal advice.
Can visitors exercise their rights?
I'll test your request process the way a regulator would.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.