California residents have a set of legal rights over their personal data held by Whatnot, including the right to access, delete, correct, and opt out of data sharing, and can exercise these rights by contacting Whatnot directly.
This analysis describes what Whatnot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These rights give California users meaningful control over how Whatnot uses their personal data, including the ability to stop data sharing for advertising purposes and to have their data deleted.
California residents can submit requests to access, delete, or correct their personal data, or to limit how their sensitive personal information is used, by contacting privacy@whatnot.com or through the Whatnot website.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell about you. You have the right to request deletion of your personal information, subject to certain exceptions. You have the right to opt out of the sale or sharing of your perso...
If you are a California resident, you have the right to know what personal information we collect about you, the right to delete personal information we have collected from you, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of your personal informa...
Monitoring
Whatnot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"California residents have the right to know what personal information is collected, used, shared or sold, not to sell or share personal information, to access personal information, to request deletion of personal information, to request correction of inaccurate personal information, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights. To exercise these rights, please contact us by submitting a request at privacy@whatnot.com or through our website.— Excerpt from Whatnot's Whatnot Privacy Policy
REGULATORY LANDSCAPE: This provision reflects CCPA as amended by CPRA, enforced by the California Privacy Protection Agency and the California AG. CPRA expanded consumer rights to include correction and limitation of sensitive personal information, and introduced enhanced protections for sharing data with advertising partners. Non-discrimination provisions are also mandated by CCPA. GOVERNANCE EXPOSURE: Medium. The breadth of rights asserted is consistent with CPRA requirements. The primary compliance risk lies in the operationalization of these rights, including response timelines (45 days under CCPA, with one extension), identity verification procedures, and the technical capability to fulfill correction and limitation requests. JURISDICTION FLAGS: California-specific. However, several other US states including Virginia, Colorado, Connecticut, Texas, and others have enacted similar comprehensive privacy laws that may impose analogous rights obligations for users in those states, and the policy should be assessed for adequacy across those jurisdictions. CONTRACT AND VENDOR IMPLICATIONS: Vendor contracts should include provisions requiring service providers to assist with consumer rights requests, including deletion and access, within required timeframes. Failure to flow down these obligations may impair Whatnot's ability to fulfill requests. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the consumer rights request process end-to-end, including identity verification steps, response timing, and the technical capability to correct or restrict processing of specific data categories. The process for honoring 'limit sensitive personal information' requests deserves particular attention given CPRA's expanded sensitive data category definitions.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
These rights give California users meaningful control over how Whatnot uses their personal data, including the ability to stop data sharing for advertising purposes and to have their data deleted.
California residents can submit requests to access, delete, or correct their personal data, or to limit how their sensitive personal information is used, by contacting privacy@whatnot.com or through the Whatnot website.
ConductAtlas has identified this type of provision across 15 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Whatnot.