CCPA / CPRA Privacy Rights

Last updated: October 12, 2026

This notice supplements our Privacy Policy and applies to residents of California under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Similar rights are available in other states, such as Virginia, Colorado, Connecticut and Utah, and we honour them in the same way.

1. Information we collect

In the past 12 months we may have collected the following categories of personal information, as defined by the CCPA:

Identifiers: IP address, cookie identifiers and device identifiers.
Internet or other electronic network activity: pages viewed, interactions with the Site and referring URLs.
Geolocation (approximate): country or region inferred from your IP address. We do not collect precise geolocation.
Commercial information: none, as we do not sell products on the Site.
Inferences: none drawn to create a profile about you beyond aggregate analytics and advertising interest segments set by ad partners.

2. Sensitive personal information

We do not knowingly collect or use sensitive personal information as defined by the CCPA. Files you open in the tool are processed only on your device and are not provided to us.

3. Sources, purposes and disclosure

We collect this information directly from your browser when you visit the Site and from our analytics and advertising partners. We use it for the business purposes listed in our Privacy Policy: operating and securing the Site, analytics, advertising and legal compliance.

We disclose identifiers and network activity information to service providers and contractors who help us operate the Site, and to advertising partners as described below.

We do not sell personal information for money. However, allowing advertising partners such as Google to place cookies and use identifiers for interest-based advertising may be considered a “sale” or “sharing” for cross-context behavioural advertising under California law.

You have the right to opt out at any time. We do not knowingly sell or share the personal information of consumers under 16 years of age.

5. Your rights

Right to know: what categories and specific pieces of personal information we collected, the sources, purposes and the categories of third parties we disclosed it to.
Right to delete: request deletion of personal information we collected, subject to legal exceptions.
Right to correct: request correction of inaccurate personal information.
Right to opt out of sale or sharing: stop the sale or sharing of your personal information for cross-context behavioural advertising.
Right to limit use of sensitive personal information: not applicable because we do not collect it.
Right to non-discrimination: we will not deny service, charge a different price or provide a lower quality of service because you exercised your rights.

Use the “Do Not Sell or Share My Personal Information” or cookie settings link on the Site where it is available.
Turn on a Global Privacy Control (GPC) signal in your browser or extension. We treat it as a valid opt-out request for that browser.
Opt out of Google personalised ads at adssettings.google.com, and of other participating vendors at aboutads.info/choices.
Email contact@exiftool.net with the subject “Do Not Sell or Share”.

7. How to submit a request

Email contact@exiftool.net with the subject “CCPA Request” and tell us which right you wish to exercise. We will verify your request by matching the information you provide against what we hold, which may be limited because we do not require accounts. We will respond within 45 days and may extend by a further 45 days where reasonably necessary, and we will tell you if so.

You may use an authorised agent to submit a request on your behalf. We may ask for written proof of authorisation and may verify your identity directly. If we deny a request, you may appeal by replying to our decision, and we will review it and reply in writing.

8. Retention

We retain each category of personal information only as long as reasonably necessary for the purposes described in our Privacy Policy, which is generally no longer than 14 months for analytics and log data.

9. California “Shine the Light”

California Civil Code section 1798.83 permits California residents to ask for information about disclosures of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing.

Contact us

If you have questions about this page or want to exercise any of the rights described here, email us at contact@exiftool.net. We aim to reply within 30 days, and sooner whenever the law requires it.