How to File a CCPA Complaint Without a Lawyer
What Is the CCPA and Why Does It Matter?
The California Consumer Privacy Act, commonly known as the CCPA, gives California residents real control over their personal information. It lets you know what data businesses collect about you, ask them to delete it, and tell them not to sell it. If a company breaks these rules, you have the right to take action — and you do not need a lawyer to do it.
Filing a CCPA complaint on your own might sound complicated, but it is more straightforward than most people think. This guide walks you through the entire process using plain language so you can protect your privacy rights without paying for legal help.
Who Can File a CCPA Complaint?
You can file a complaint if you are a California resident and a business has violated your privacy rights under the CCPA. This includes situations where a company:
- Ignored your request to know what personal data they have about you
- Refused to delete your personal information after a valid request
- Continued selling your data after you told them to stop
- Discriminated against you for exercising your privacy rights
- Failed to secure your personal data, leading to a breach
Businesses covered by the CCPA are typically for-profit companies that operate in California and meet at least one of these criteria: they earn over $25 million in annual revenue, they buy or sell the personal data of 100,000 or more consumers or households per year, or they earn more than half their annual revenue from selling consumer data.
Steps to Take Before Filing a Formal Complaint
Before you go straight to filing a complaint, there are a few important steps you should take. These steps will strengthen your case and show that you made a good-faith effort to resolve the issue directly.
Step 1: Submit a Privacy Request to the Business
The CCPA requires businesses to respond to consumer privacy requests. Start by contacting the business directly. Most companies are required to provide at least two ways to submit privacy requests — typically an email address, a toll-free phone number, or an online form. Look for a “Do Not Sell My Personal Information” link on their website or check their privacy policy.
When you submit your request, be clear and specific. State your name, explain that you are a California resident, and describe exactly what you are asking for. Keep a copy of everything you send.
Step 2: Wait for a Response
Under the CCPA, businesses have 45 days to respond to your privacy request. In some cases, they can extend this by another 45 days if they let you know within the first 45 days. If the deadline passes and you have not heard back, or if the company denies your request without a valid reason, you have grounds to move forward with a complaint.
Step 3: Document Everything
Good documentation is one of the most important parts of self-representation in any privacy complaint. Save the following:
- A copy of your original privacy request
- Any confirmation emails or reference numbers you received
- The company’s response, or proof that they did not respond
- Screenshots of their privacy policy or any relevant web pages
- Dates and times of all communications
Having a clear record makes it much easier for investigators to understand what happened and take your complaint seriously.
How to File a CCPA Complaint With the California Attorney General
The California Attorney General’s Office is the main agency that enforces the CCPA. You can submit a complaint directly through their official website. Here is how to do it step by step.
Step 1: Visit the California Attorney General’s Website
Go to the official California Department of Justice website at oag.ca.gov. Navigate to the privacy section or use the site’s search function to find the consumer complaint form. Make sure you are on the official state government website before entering any personal information.
Step 2: Fill Out the Complaint Form
The online complaint form will ask you for basic information, including:
- Your name and contact information
- The name and contact information of the business you are complaining about
- A description of what happened and which CCPA rights were violated
- The steps you already took to resolve the issue
- Any supporting documentation you can attach
Be factual and specific when describing the violation. Stick to the facts and avoid emotional language. The more clearly you explain what happened, the easier it is for the Attorney General’s office to evaluate your complaint.
Step 3: Attach Your Supporting Documents
Upload the documents you collected earlier — your original request, the company’s response or lack of response, and any screenshots or records. These attachments help support your claim and give investigators the details they need.
Step 4: Submit and Save Your Confirmation
Once you submit your complaint, you should receive a confirmation number or email. Save this information. It will help you track your complaint and follow up if necessary.
Filing a Complaint With the California Privacy Protection Agency
In addition to the Attorney General, the California Privacy Protection Agency (CPPA) now plays a major role in enforcing CCPA rules. The CPPA was created by the California Privacy Rights Act (CPRA), which expanded the CCPA in 2023. The agency has its own complaint process and investigates violations independently.
You can visit the CPPA’s official website to submit a complaint or find out more about ongoing enforcement actions. The process is similar to filing with the Attorney General — you will provide your information, describe the violation, and include any documentation you have.
It is worth submitting your complaint to both agencies if you feel your rights were seriously violated. There is no rule against filing with both, and it can increase the chance that your case gets attention.
Can You Sue a Business Under the CCPA Without a Lawyer?
The CCPA does give consumers a private right of action, but only in specific situations. You can sue a business directly if your non-encrypted or non-redacted personal information was exposed in a data breach because the company failed to use reasonable security measures. In these cases, you can seek damages between $100 and $750 per consumer per incident, or your actual damages if they are higher.
Filing a lawsuit in small claims court in California does not require a lawyer, and the state’s small claims limit allows you to handle cases up to $12,500 on your own. If your claim falls within this range and involves a data breach, small claims court is a realistic option for self-representation.
Before filing a lawsuit, however, you are required to give the business written notice and allow them 30 days to fix the problem. If the business does not cure the violation within that time, you can proceed with legal action.
What to Expect After You File
Filing a complaint does not guarantee immediate action. The Attorney General and the CPPA review complaints and decide where to focus their enforcement efforts. Individual complaints often contribute to larger investigations, especially when many consumers report the same business.
Here is what typically happens after you file:
- You will receive an acknowledgment that your complaint was received
- Investigators may contact you for more information
- The agency will review the complaint and decide whether to investigate
- You may or may not receive updates on the outcome
Be patient. Government agencies handle many complaints and investigations take time. Even if your specific complaint does not lead to immediate action, it adds to a record that can trigger enforcement later.
Tips for a Strong CCPA Complaint Without Legal Help
Filing on your own is completely possible if you stay organized and focused. Here are some practical tips to make your complaint as strong as possible:
- Be specific: Name the business, describe the exact violation, and include dates wherever possible.
- Keep copies of everything: Back up all your documents in more than one place.
- Use facts, not emotions: Investigators respond to facts and evidence, not frustration. Keep your complaint professional and clear.
- Follow the process step by step: Do not skip the step of contacting the business first. Agencies want to see that you tried to resolve it directly.
- Know your rights: Read the CCPA summary on the Attorney General’s website so you understand exactly which rights apply to your situation.
- Follow up if needed: If you have not heard anything after a few weeks, it is reasonable to follow up with the agency using your confirmation number.
Free Resources to Help You Along the Way
You do not have to figure everything out alone. There are several free resources available to help California residents navigate the CCPA complaint process:
- California Attorney General’s website (oag.ca.gov): Offers plain-language guides on CCPA rights and how to submit complaints.
- California Privacy Protection Agency (cppa.ca.gov): Provides information on your rights and how the agency enforces them.
- Privacy Rights Clearinghouse: A nonprofit that offers guides and resources for consumers dealing with privacy issues.
- Electronic Frontier Foundation (EFF): Offers educational resources about digital privacy rights and how to protect yourself.
These resources can help you understand your rights better and give you the confidence to move forward without paying for legal advice.
Your Privacy Rights Are Worth Protecting
Filing a CCPA complaint without a lawyer is not only possible — it is something thousands of California residents do every year. The process was designed to be accessible to everyday people, not just those with legal training. By knowing your rights, documenting your interactions, and following the steps outlined here, you can stand up for your privacy and hold businesses accountable.
Consumer rights only work when people use them. If a company has mishandled your personal information or ignored your requests, taking action is both your right and your power. Start with the steps in this guide, and do not let the process intimidate you. You have everything you need to move forward on your own.
