What visitors can do on your Privacy Center

Exercise a right on your hub opens Submit a privacy request, at /privacy/request on your address. The visitor answers:

• What are you asking for?: Access, Erasure, Rectification, Portability, Objection, Restrict processing, Opt-out of sale or Opt-out of targeted ads.
• Under which law?: the law they rely on, which sets the response window.
• About you: an optional full name, their email, and their country and relationship to you, either of which they can decline to give.
• Your request: a one-line summary and the details.

If you've turned on Require phone verification under Compliance › Privacy › Settings, they also prove a mobile number with a code sent by text before they can select Submit request.

The visitor then sees a reference and receives two emails: a receipt with the request, the day it was received, the date the answer is due and the reference, and a link to confirm their email address. The request arrives in your Privacy register's Requests. Your workspace is notified, and your primary contact is emailed unless they've turned off Email me when EU Presence files something under Account › Profile. The same filing sent again within ten minutes isn't filed twice: the visitor gets the first reference back.

Report illegal content opens a form at /privacy/report built around Article 16 of the Digital Services Act, the notice-and-action mechanism. The visitor picks what they're reporting, gives the Links to the content, one URL per line, and explains why they believe it's illegal in at least 20 characters. Under About you they give their role, name, email and the language they're writing in. They then confirm they're acting in good faith and select Submit notice.

A notice of child sexual abuse material is filed anonymously: no name or email is collected, and nobody writes back. Anyone else receives a confirmation that the notice arrived, and later an email with your decision, why you made it and how to challenge it. The notice arrives in your Content Safety register's Reports.

Check request status, at /privacy/status, asks for the email address the visitor used. Selecting Send me the link emails them a link that works for thirty minutes. There's no account or password, and a new link replaces the last. The email sent when a privacy request has been answered carries a link of its own, which lasts seven days.

The link opens Your requests: every privacy request and content report filed from that address, newest first. From a record, the visitor can:

• follow What has happened, every step recorded on it, in order;
• download the files you sent with your answer;
• upload an identity document when you've asked for one, marked ID document needed;
• take back something still open, with Withdraw this request or Withdraw this report.

When your team asks a data subject to confirm their identity, they're emailed a link that works once and expires after seven days. It opens Confirm your identity, where they choose a Document type (Passport, National ID card, Driving licence or Other document), attach a PDF, JPG, PNG or WebP file under 10 MB and select Upload document. If the link has expired or been used, the page asks them to request a new one from you.

The confirmation email sent after a privacy request links to Confirm your email address. Selecting Confirm my email address tells you the request came from the owner of that address. The link works once and expires after seven days. Someone who didn't file the request does nothing, and the address stays unconfirmed, which your team can see on the request.

The two forms and the status page are served only while at least one of your hubs is published and the register behind them is open. Otherwise the page isn't found and your hub hides its button. Links already emailed to someone keep working. See What decides each part appears.