--- title: "United States — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/data-subject-rights/ source_html: /jurisdictions/united-states/data-subject-rights/index.html description: "United States — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 4 claims Amber ▾ # Rights exist only at state/sector level; federal consumers outside covered states or sectors lack statutory acc" generated_at: 2026-10-25T04:46:50Z content_sha256: 0fea29d9aa197b28e6016dbb5391a9172145e55a21176f594fa6fcecf2190fc8 generator: "fe-fleet/md-twin@1.0" --- # United States — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules4 claimsAmber▾# Rights exist only at state/sector level; federal consumers outside covered states or sectors lack statutory access/erasure/portability rights. Primary framework State comprehensive privacy statutes (e.g., CCPA/CPRA); COPPA Rule Supervisory authority [California Privacy Protection Agency (CalPrivacy)](https://cppa.ca.gov) Traffic-light rationale — Amber Rights exist only at state/sector level; federal consumers outside covered states or sectors lack statutory access/erasure/portability rights. #### Sub-modules (5) #### Access RightAmber Each US comprehensive state privacy law establishes a consumer right to access personal data held by covered businesses. Claims (1): - Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies. #### Rectification And ErasureAmber State comprehensive laws grant rights to correct and delete personal data; COPPA gives parents an independent right to require deletion of a child's data. Claims (2): - Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies. - COPPA gives parents the right to require operators to delete personal information collected from their children. #### Restriction And ObjectionAmber State laws provide opt-out rights for targeted/cross-contextual behavioral advertising, sale of personal data, and profiling. Claims (1): - US state comprehensive privacy laws provide consumer opt-out rights for targeted or cross-contextual behavioral advertising, sale of personal data, and profiling. #### Data PortabilityAmber Portability rights are included among the fourteen provisions IAPP tracks across comprehensive state privacy bills; no dedicated federal portability right exists. Absence provenance: unavailable . Searched: US federal data portability right 2026. #### Deadlines And Response WindowsAmber Response-window specifics vary by state statute (commonly 45 days) and by data-broker deletion mechanisms; California's DROP platform requires brokers to complete deletion sweeps within a defined window. Claims (1): - Under California's Delete Act, data brokers on the state registry must complete 45-day deletion sweeps once a consumer submits a request through the DROP platform. Category narrative 54 words There is no federal statutory access/erasure/portability right of general application. State comprehensive privacy laws (19 enacted as of 2025) grant consumers rights to access, correct, and delete personal data, and opt-out rights for targeted advertising, sale, and profiling. COPPA separately gives parents rights to review and delete a child's data held by covered operators. Periodic update · new data 2026-09-28 #### Data Subject Rights The newly effective Kentucky, Indiana, and Rhode Island comprehensive privacy laws are understood to grant consumers rights to access, correct, delete, and obtain copies of their personal data, consistent with the general rights structure seen in other state comprehensive privacy statutes. However, the specific scope and mechanics of these rights as codified in the Indiana, Kentucky, and Rhode Island statutes have not yet been independently verified against primary statutory text this cycle, and this summary should be read as a qualified account pending that verification. This continues the pattern established by earlier state comprehensive privacy laws, extending broadly similar access, correction, deletion, and portability rights to residents of three additional states as of January 1, 2026. #### Outlook Independent verification of the specific data-subject-rights provisions in the Indiana, Kentucky, and Rhode Island statutes against primary legislative text remains an open item for a future cycle. Until that verification occurs, the precise contours of these rights, including any exemptions or thresholds, should be treated as provisional. Evidence 4 Sources and claims (4) - Probable[IAPP](https://iapp.org/resources/article/us-state-privacy-laws-overview) — Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) — COPPA gives parents the right to require operators to delete personal information collected from their children.observed 2026-07-29 - Probable[IAPP](https://iapp.org/resources/article/us-state-privacy-laws-overview) — US state comprehensive privacy laws provide consumer opt-out rights for targeted or cross-contextual behavioral advertising, sale of personal data, and profiling.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online-as-2026-begins) — Under California's Delete Act, data brokers on the state registry must complete 45-day deletion sweeps once a consumer submits a request through the DROP platform.observed 2026-07-29