The verification requirement exists to prevent fraudulent requests, for example someone attempting to obtain another person's personal information by submitting a fake access request. Under the CCPA, businesses cannot fulfill a consumer rights request without first making a reasonable effort to verify the requestor's identity.
What constitutes 'reasonable' verification depends on the sensitivity of the data involved and the type of request. For data access requests, verification is more stringent than for opt-out requests, because the risk of harm from unauthorized disclosure is higher.
At scale, VCR verification is a significant operational challenge. Consumer-facing businesses may receive thousands of requests annually, each requiring identity verification before processing can begin. Automated verification workflows are essential for meeting response timelines without manual overhead.