Which is extra annoying, because they shouldn't, but it's somewhat vague.
CCPA says: "Businesses also should not require you to verify your identity, though they can ask you basic questions to identify which personal information is associated with you."[0]
The worst is that some of the bigger services (intelius, who provides data for many of these sites) have begun to require opt-outs come from an email address that they already have on file for you. Really need to legislate these companies out of existence.
For those I usually just upload a picture generated by thispersondoesntexist, they don't actually check them. It's just friction to discourage users from completing the flow.
CCPA says: "Businesses also should not require you to verify your identity, though they can ask you basic questions to identify which personal information is associated with you."[0]
The worst is that some of the bigger services (intelius, who provides data for many of these sites) have begun to require opt-outs come from an email address that they already have on file for you. Really need to legislate these companies out of existence.
0: https://www.oag.ca.gov/privacy/ccpa#sectionb