These metrics must include:
- The number of requests to know that the business received, complied with in whole or in part, and denied;
- The number of requests to delete that the business received, complied with in whole or in part, and denied;
- The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
- The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.
Businesses may choose to compile and disclose metrics for all individuals, instead of just California consumers, but this choice must be clearly identified in the disclosure. The metrics for only California consumers must also be available for disclosure to the California Attorney General upon request.