CCPA toll-free number requirement

Certain businesses under CCPA jurisdiction must provide consumers with a toll-free number to make requests. Learn more about what this means for your organization

Param Gopalasamy, CIPP/E, CIPM
Content Marketing Specialist, OneTrust

December 15, 2022

photo of a man in his 20s with a backpack walking up a set of stone stairs outside while talking on a phone.

The California Consumer Privacy Act (CCPA) entered force on January 1, 2020, which had immediate effects on the relationships between consumers, businesses, and personal data. 

The toll-free number requirement was introduced to ensure that businesses are always reachable and transparent to their website users, giving them the option to call and use their rights around privacy and data protection.

The California Privacy Rights Act (CPRA), going into effect on Jan 1, 2023, follows up the CCPA with new and expanded consumer and employee privacy protections, retaining the toll-free number requirement as well. 

What businesses are required to provide a toll-free number?

An amendment to the law, confirmed in October 2019 by the Governor of California, modified a key provision. Referred to as the “toll-free number amendment”, it clearly defined which types of businesses must provide a toll-free phone number for consumers to exercise their privacy rights.

According to the amendment (AB-1564), businesses that operate primarily in-person but also have a web presence must be capable of processing consumer rights requests requests to know through a minimum of three channels. Such organizations must make at least the following methods readily available to consumers: 

  • A web form 
  • A toll-free phone number  
  • A paper form

Businesses operating in-person without a website must also offer a minimum of two request methods to consumers:

  • A toll-free phone number 
  • A paper form submitted in person and/or by mail


What businesses are exempt from providing a toll-free number?

AB-1564 changed the request method obligations for web-based businesses. If a company has direct relationships with consumers and operates exclusively online, it does not have to provide a toll-free phone number. Instead, the business must provide at least the following online contact methods to receive and process consumer rights requests:

  • An email address  
  • A web form 

Note that businesses also provide at least two methods to support the right to delete personal information. The channels listed above fulfill these requirements. 

A toll-free phone number is always an acceptable option, regardless of where the business primarily operates, so long as the fundamental requirements are met. 

What does the CCPA toll-free number requirement mean for businesses?

If a company doesn’t meet the exemption enacted by AB-1564 for web-based businesses, it must provide at least two ways for consumers to submit requests for information and requests to delete. For many businesses, those methods will include a toll-free number and web form conspicuously linked on the company’s website.

When handling requests coming in through the toll-free channel, the following steps should ensure that these requests are processed efficiently. 

  1. Keep records of each request that comes through the toll-free number, categorizing them based on the type of request (know, access, deletion, portability) 
  2. When each call comes through, have two to three ways to reasonably determine the customer’s identity based on the data you have (phone number, address, account number, etc.) 
  3. In case these requests require action to be taken on the customer’s side, use the phone call to establish a channel through email, and complete processing the request there. 
  4. Maintain a database of requests that have started through the toll-free channel, with data on whether they were resolved by phone or needed to be taken online to resolve. 


How can my business comply with the toll-free number requirement?

Compliance with the CCPA’s toll-free requirement is easier with the OneTrust CCPA suite of automated privacy management and data governance tools. 

The OneTrust CCPA Toll-Free Number feature enables businesses to integrate a phone-based workflow into an automated consumer rights process. Use it to generate a unique or shared phone number, greet callers with a customized message, and verify consumer identities to log requests effectively.

With OneTrust CCPA Toll-Free Number, you can:

  • Publish a toll-free phone number to satisfy legal requirements  
  • Set up a customized welcome greeting that aligns with your company’s messaging and CCPA/CPRA requirements 
  • Replace manual processing tasks, such as identity verification, with automated ones 
  • Integrate with existing web-based workflows, such as CCPA Consumer Rights and Do Not Sell solutions 
  • Automate request fulfillment when integrated with OneTrust Data Discovery  
  • Log consumer requests in a centralized location for compliance recordkeeping

To learn more about how OneTrust can help with the CCPA toll-free requirement and other obligations under the CPRA, visit OneTrust CPRA and request a demo today.

You may also like


Consent & Preferences

Global Privacy Control: CCPA enforcement of GPC opt-out signals webinar

Watch this on-demand webinar to gain an overview of what Global Privacy Control (GPC) is, the benefits of the signal, and how it works.

October 30, 2022

Learn more


Privacy Management

Employee vs. consumer rights: Same concept, different reality

Join this webinar to learn about the rights request fulfillment complexities introduced by the end of the employee exclusion in the CPRA.

August 25, 2022

Learn more

White Paper

Privacy & Data Governance

How OneTrust helps with California privacy law compliance (CCPA & CPRA)

This guide to California privacy law compliance helps your organization understand the requirements under the CCPA and CPRA.

June 23, 2022

Learn more