CCPA requires companies to comply with user requests for: All data collected and stored. Each category of sources where data is collected (e.g., financial, contact, medical). The business purpose for collecting and selling user data.