The CCPA Regulations require that businesses that buy, receive, sell, or share personal information about more than 10 million Californians disclose metrics within their privacy notices regarding the quantity of data subject requests that they received in the previous calendar year. Among other things, businesses must publicly report the number of access requests that the business received.^[1]

Based upon a review of the websites of the Fortune 500, major retailers received an average of 14,998 access requests.^[2] It is important to note, however, that the quantity of access requests was heavily skewed by three companies within the retail industry. When those outliers were removed, the average number of access requests decreased dramatically – the remaining Fortune 500 retailers received on average 230 requests per year.

FOOTNOTES

^[1] Cal. Code Regs. tit. 11, § 999.317(g) (2021).

^[2] Review was conducted in August 2021.