Can a consumer use an authorized agent to submit a CCPA request?

A consumer does not have to submit a CCPA request personally. California's regulations let someone else do it for them, and they spell out exactly what a business can and cannot demand before acting on it.

What Section 7063 actually allows

11 CCR Section 7063(a) covers requests to delete, requests to correct, and requests to know submitted through an authorized agent. When a consumer uses one, a business may require the authorized agent to provide proof that the consumer gave the agent signed permission to submit the request. Separately, the business may also require the consumer to do one of two things: verify their own identity directly with the business, or directly confirm with the business that they gave the agent permission.

Read that structure carefully. The agent-side proof and the consumer-side check are two different safeguards, and the regulation lets a business use both the signed-permission proof and one consumer-facing check. What it will not allow is turning that consumer-facing check into a second submission. The subsection closes on this point directly: "businesses shall not require the consumer to resubmit their request in their individual capacity."

The power of attorney exception

Subsection (b) carves out a separate path entirely. Subsection (a) does not apply when a consumer has provided the authorized agent with power of attorney under Probate Code sections 4121 to 4130. In that situation, the power of attorney itself already establishes the agent's authority to act, so the signed-permission and direct-verification requirements in (a) are unnecessary.

The regulation then flips the usual assumption on its head: "a business shall not require power of attorney in order for a consumer to use an authorized agent to act on their behalf." Power of attorney is one way to prove authority, not the baseline requirement. A business that tells every consumer their agent needs power of attorney before it will act is reading the regulation backward.

Duties that fall on the agent, not the consumer

Two further obligations in Section 7063 bind the agent directly, and a business is entitled to expect both. Subsection (c) requires an authorized agent to implement and maintain reasonable security procedures and practices to protect the consumer's information. Subsection (d) prohibits an authorized agent from using a consumer's personal information, or any information collected from or about the consumer, for any purpose other than fulfilling the consumer's request, verification, or fraud prevention.

Those two duties matter for a business evaluating whether a third party claiming to act as an "authorized agent" is a legitimate rights-management service or something closer to a scraper harvesting consumer data under the cover of a CCPA request. The regulation gives you grounds to push back on the latter without touching the former.

How this fits with verification generally

Section 7063 is one piece of a larger verification framework. The general rules for verifying any CCPA request, agent-submitted or not, sit in the verifiable consumer request duty, and the deadlines for responding once a request is verified are the same whether it arrives directly from a consumer or through an agent. If the request is to delete personal information, see the right to delete for what happens after verification is complete.

Next step

A business that handles consumer requests at any volume will eventually receive one through a company claiming to act as an authorized agent. Knowing which checks the regulation actually permits, and which one it forbids, keeps you from either rejecting a legitimate agent request or accepting one with no real authority behind it. The free 2-minute Obligation Scan checks whether the CCPA applies to your business at all before you need to worry about the mechanics of any single request. See the CCPA applicability test to start there.