California Privacy Rights Disclosure

What it is

If you live in California, you have specific legal rights to see what personal data T-Mobile has about you, ask for it to be deleted, or stop T-Mobile from sharing it for advertising — and you can exercise these rights through T-Mobile's Privacy Center.

Why it matters (compliance & governance perspective)

This provision implements statutory disclosure obligations under the California Consumer Privacy Act and establishes the operational mechanisms by which California residents exercise rights conferred by state law, including access, deletion, correction, and opt-out rights regarding specified data practices.

Consumer impact (what this means for users)

California residents can request a copy of their personal data, ask T-Mobile to delete it, or opt out of data sharing for behavioral advertising by visiting T-Mobile's Privacy Center online or calling 1-800-T-MOBILE, and these rights are legally enforceable under California law independent of the terms of service.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), which is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. CCPA rights include access, deletion, correction, portability, and opt-out of sale or sharing of personal information for cross-context behavioral advertising. T-Mobile as a telecommunications provider also remains subject to FCC CPNI rules, and the interaction between CCPA and CPNI frameworks for telecommunications data should be reviewed to ensure consistent compliance. GOVERNANCE EXPOSURE: Medium. The disclosure of California-specific rights is required by CCPA and their presence in the agreement is appropriate. The key compliance risk is operational: whether T-Mobile's Privacy Center processes CCPA requests within the statutory timeframes (45 days, extendable by 45 additional days with notice), accurately responds to access requests, and effectively implements opt-out of sale or sharing preferences across all downstream data flows. JURISDICTION FLAGS: This provision explicitly applies to California residents only. Other states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, and others) may provide similar rights that are not expressly acknowledged in this provision but may be enforceable under applicable state law. Compliance teams should assess whether T-Mobile's privacy infrastructure supports these additional state privacy frameworks. CONTRACT AND VENDOR IMPLICATIONS: Vendors and data processors receiving personal information from T-Mobile must be assessed for CCPA compliance, including the ability to support deletion requests that must flow downstream to processors. Data processing agreements with vendors should include CCPA-required contractual terms. COMPLIANCE CONSIDERATIONS: T-Mobile's Privacy Center should be audited for CCPA compliance, including request intake, identity verification procedures, response timelines, and documentation practices. The opt-out of sale or sharing mechanism should be tested to confirm it is operationally effective and that opt-out preferences are honored across all relevant data flows, including third-party advertising partnerships.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Mandatory Arbitration Clause high
• Class Action Waiver high
• Unilateral Right to Modify Terms medium
• CPNI Use and Marketing Opt-Out medium
• Service Suspension and Termination Rights medium
• Equipment Installment Plan and Early Payoff medium