What a Shine the Light Demand Letter Looks Like, and What It Can Actually Demand

Most privacy demand letters accuse a company of something. This one asks a question. It arrives on law firm letterhead, cites a 2003 California statute, and asks you to list every category of customer data you shared with third parties for their marketing last year. It gives you 30 days.

Below is a real example, redacted to remove the recipient and the client. It was sent by Swigart Law Group in November 2025 to an ecommerce business. We'll walk through what the letter asks for, what the law actually requires, and why businesses that can't answer quickly end up negotiating instead.

What the letter looks like

Page one: the request, the 12-month "established business relationship," and the start of a long list of data categories.

Page two: the rest of the 27 categories, the 30-day deadline, a government ID attached for verification, and the client's email addresses (redacted).

The structure is simple:

1. The hook. The client "had an established business relationship" with you in the past 12 months. In ecommerce terms, that usually means one order.
2. The ask. Every category of personal information disclosed to third parties for direct marketing in the prior calendar year. The letter lists seven headline items (name, email, phone, Social Security number, bank, credit, and debit card numbers) and then all 27 categories from the statute, from height and weight to political party affiliation.
3. The clock. "Within 30 days of receipt... as required by law."
4. The identity kit. A copy of the client's government ID and the email addresses they may have used with you.

Nothing in the letter threatens a lawsuit. It doesn't have to. The threat is what happens if the response is late, incomplete, or wrong.

What the law actually requires

The letter invokes California Civil Code § 1798.83↗, better known as the Shine the Light law. Reading the statute next to the letter is useful, because the two don't fully line up.

It asks for categories and recipients, not the data itself. If you disclosed customers' personal information to third parties for those third parties' direct marketing in the prior calendar year, you owe the customer a list of the categories disclosed, plus the names and addresses of the third parties that received it. The statute says a business "is not obligated to provide information associated with specific individuals." Nothing requires you to send a customer's own Social Security or card numbers back to a law firm, and you shouldn't.

The 30-day clock depends on where the request arrives. The statute requires a business to designate a mailing address or email address for these requests, and to publicize it, for example through a "Your Privacy Rights" link on the home page. Requests sent to that designated channel get a 30-day response window. Requests sent anywhere else get "a reasonable period," capped at 150 days. A letter mailed to your CEO is not necessarily on a 30-day clock. A business that never designated a channel, though, has a harder time making that argument.

Small businesses are exempt. Businesses with fewer than 20 full-time or part-time employees don't have to comply.

There's an alternative way to comply. A business that adopts and discloses, in its privacy policy, a policy of not sharing customer data with third parties for their direct marketing without opt-in (or of honoring an opt-out) can satisfy the law by telling customers about that right and giving them a free way to exercise it.

The penalties are modest per request, but they add up. Under Civil Code § 1798.84↗, a customer can recover up to $500 per violation, or up to $3,000 if the violation was willful, intentional, or reckless, plus attorney's fees. For non-willful violations there is a complete defense if you provide the correct information within 90 days of learning you got it wrong.

That fee-shifting provision is the business model. One request is cheap. Hundreds of identical requests, each with its own clock and its own fee exposure, are not.

What the business was missing

Shine the Light letters land hardest on companies that can't answer three questions quickly:

• Who do we actually share customer data with? The modern ecommerce stack sends customer data to email platforms, review apps, ad networks, affiliate tools, and audience-matching services. Some of those are service providers working on your behalf, which the statute carves out. Others use the data for their own marketing. Most teams have never sorted their vendors into those two buckets.
• Where do these requests go? If your site has no designated Shine the Light address and no "Your Privacy Rights" disclosure, you lose the clearest procedural protection the statute offers.
• Who owns the deadline? A letter like this one usually lands in a general inbox or the mailroom. By the time it reaches someone who knows what § 1798.83 is, a third of the 30 days may be gone.

None of those are legal problems. They are inventory and workflow problems that become legal problems when a lawyer asks.

How PieEye closes the gap

A current list of recipients. PieEye's data mapping discovers personal data flows across your stack, with integrations for more than 500 ecommerce tools. When a request asks which third parties received customer data last year, you start from a maintained map instead of a spreadsheet someone built in 2023.

One intake and one clock for privacy requests. PieEye's privacy request workflows give access and deletion requests a single queue with deadlines attached, so a Shine the Light letter can be logged, routed, and tracked alongside CCPA requests instead of sitting in a shared inbox.

Disclosures that point requests to the right place. Your privacy notice should tell California customers how to make a Shine the Light request and where to send it. Getting that language in place is what starts the statute's 30-day clock on your terms.

If one of these lands on your desk

• Calendar the date it arrived, and note whether it came to a designated address.
• Do not send customer-level data, and do not mail back the attached ID. Verify the customer through your normal process.
• Pull your vendor list and separate service providers from third parties that market on their own behalf.
• Talk to counsel about whether the § 1798.83(c)(2) privacy-policy alternative applies to you, and about whether the response should come from them.

A complete, accurate, on-time answer takes most of the value out of a letter like this. The businesses that end up paying are the ones that can't produce one.

This post is for general information and is not legal advice. Talk to counsel about any letter you receive.