If a site is registering users with name display , email and password (I am not reffering to stackexchange . ) The name is available for public display . The site provides access to account when people provide access to email and their password . Lets say an user loses a password or email . For password it is ok . For email if the user loses does the site need to provide access to account if user can write the name and password ? It is under the CCPA California . The reason I am asking is than combination of name and password is forgable copyable . I mean any user can guess the password and the combination may or may not be unique . Example to clarify : A user signs up with name "a" email [email protected] and password aaaaaaaaaa . A person furnishes name and password . The site given has only one account with name "a" and password aaaaaaaaaa . However can they say as name is public user must furnish email . Is it legal under CCPA California ?

1 Answer 1


CCPA section 1798.130 subsection (a) (2) (A) says:

The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’s duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumer’s request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period.

In many other places the CCPA refers to a "verifiable consumer request". It does not specify how a bullishness must verify the request, other than using "reasonable methods". It indicates that a business shall:

To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.

The CCPA does not say what information that may or must be. It does not mandate that a business be able to validate any possible request. It does say (in section 1798.130.subsection (a) (B) (2) ) that:

The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.

Thje CCPA does not mandate providing any password recovery or account recovery mechanism for consumers who have forgotten a password or user ID. As a business may require "reasonable authentication" it could require a stronger password than "aaaaaaa". But if a consumer can supply info sufficient to reasonably match with previously collected info and verify that the requester is the same person, it must comply with the request, whether it provides password recovery or not.

The details on how a business identifies consumers, how it verifies requests, and how it manages accounts are left to the business. But such practices must be "reasonable". If challenged, a court would decide whether any particular practice is reasonable. I do not know of any court cases yet dealing with such issues.

  • If a business tells cosumer that display name cannot reasonably verify then provides an alternate set up to register a secure code to verify . Is it ok to not allow disp name . Feb 8, 2021 at 17:13
  • @scientist the CCPA does not go into that level of detail. It only says the business must act "reasonably". If a business did that, the consumer sued, and the case went to a reported appeals court, then we might know the answer. Until then, there is no way to be sure. If there is some plausible method by which the consumer can get a request acted on, the main purpose of the CCPA will have been satisfied. That might well be enough, but no one can know now. Feb 8, 2021 at 17:18
  • @scientist There is no law that I know of that would force stack exchange, or any other site, to provide any particular level of password recovery. Wikipedia (for example) will provide a new password to an account if you know thew account user ID, and can get mail at the previously saved email address. If the user never saved an email address, has lost access toi the email, or can't find the user ID, they provide no further help. This has been their policy for over 15 years, and no one seems to have successfully challenged it. A site might provide no recovery at all. Feb 8, 2021 at 17:26
  • Ok thanks for answering . Feb 8, 2021 at 17:27
  • @scientist Under the CCPA a business subject to the law must provide a copy of saved PI to a consumer who can make a verified request. What constitutes verification is simply not spelled out. Feb 8, 2021 at 17:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .