# Privacy, consent and data subject requests

*B2C Solution Architect Study Guide · Data Models and Management · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/b2c-solution-architect/data-models-and-management/privacy-consent-and-data-subject-requests*

Which out-of-the-box privacy tools B2C Commerce, Data 360, the service org, Marketing Cloud Engagement and Marketing Cloud Personalization provide for deletion, restriction, portability, tracking and consent, and where a request still needs custom work in each product.

- Certification: Salesforce B2C Solution Architect
- Exam section: Data Models and Management
- Study guide: https://www.certifyforce.com/study-guide/b2c-solution-architect

**Official exam objective:**

> Given a set of customer requirements, articulate the privacy management features across multiple products, when to consider a custom solution vs. using out-of-the-box (OOTB) features.

## What the exam expects

- Map a shopper's deletion, restriction, portability or do-not-sell request to the tool each product provides, and name the steps that stay manual or custom.
- Distinguish B2C Commerce tracking controls: the Privacy site default, the per-session value set in custom code and the clickstream DNT option.
- Choose the right Data 360 Consent API action and identifiers, and predict what a deletion removes.
- Store service-org consent at the right level of the Salesforce Consent Data Model, and describe Engagement Contact Delete and Personalization deletion scope.

Key terms: **data privacy record** (a record based on the Individual object that holds global privacy preferences); **Consent API** (the REST resource that reads and writes consent, including Data 360 actions); **Contact Delete** (the Contact Builder process that removes a contact from Engagement); **DNT** (do not track, the shopper's tracking opt-out).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Customer deletion | Leaves orders, gift certificates and coupon emails | [Data Deletion](https://help.salesforce.com/s/articleView?id=cc.b2c_data_deletion.htm&type=5&language=en_US) |
| Restriction blocker | No deletion while open orders exist | [Restriction of Processing](https://help.salesforce.com/s/articleView?id=cc.b2c_restrict_processing.htm&type=5&language=en_US) |
| Snapshot time | Up to nine days | [Customer Data Snapshots](https://help.salesforce.com/s/articleView?id=cc.b2c_customer_snapshots.htm&type=5&language=en_US) |
| Privacy site preference | Sets only the default for new sessions | [Set Privacy Preferences](https://help.salesforce.com/s/articleView?id=cc.b2c_setting_privacy_preferences.htm&type=5&language=en_US) |
| Data 360 reprocessing | After 30, 60 and 90 days | [Data Deletion Request](https://help.salesforce.com/s/articleView?id=data.c360_a_data_deletion_request.htm&type=5&language=en_US) |
| Consent API permission | ModifyAllData or ConsentApiUpdate | [Consent API with Data 360](https://developer.salesforce.com/docs/platform/api-rest/guide/resources-consent-cdp-params.html) |
| Contact Delete suppression | 2 days by default, adjustable | [Contact Deletion](https://help.salesforce.com/s/articleView?id=mktg.mc_cab_contact_deletion.htm&type=5&language=en_US) |
| Retroactive retention | Not on extensions over 100 million records | [Contact Delete Best Practices](https://help.salesforce.com/s/articleView?id=mktg.mc_cab_best_practices.htm&type=5&language=en_US) |
| Personalization deletion | Up to 30,000 users per request | [User Look-Up and Deletion API](https://developer.salesforce.com/docs/marketing/personalization/guide/user-look-up-deletion-api.html) |

## Check yourself

- When should a merchandiser delete customers through Import & Export rather than the Customers page?
- Why must you PATCH consent for a new Data 360 profile before your first Consent API GET?
- Which user permissions allow Consent API calls that use the Data 360 parameters?
- How many users can one Personalization deletion request include?

## Sources

- [Data Deletion: Delete Personal Data in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_data_deletion.htm&type=5&language=en_US)
- [Delete Customers in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_deleting_customers.htm&type=5&language=en_US)
- [Restriction of Processing in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_restrict_processing.htm&type=5&language=en_US)
- [Customer Data Snapshots in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_customer_snapshots.htm&type=5&language=en_US)
- [Data Portability in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_data_portability.htm&type=5&language=en_US)
- [Set Privacy Preferences for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_setting_privacy_preferences.htm&type=5&language=en_US)
- [Manage Shopper Tracking Preferences](https://developer.salesforce.com/docs/commerce/commerce-api/guide/slas-tracking-preferences.html)
- [B2C Commerce API Release Notes](https://developer.salesforce.com/docs/commerce/commerce-api/references/about-commerce-api/about.html)
- [Data Subject Rights Request (Data 360)](https://help.salesforce.com/s/articleView?id=data.c360_a_data_subject_rights_request.htm&type=5&language=en_US)
- [Requesting Data Deletion or Right to Be Forgotten](https://help.salesforce.com/s/articleView?id=data.c360_a_data_deletion_request.htm&type=5&language=en_US)
- [Use the Consent API with Data 360](https://developer.salesforce.com/docs/platform/api-rest/guide/resources-consent-cdp-params.html)
- [Understand the Salesforce Consent Data Model](https://help.salesforce.com/s/articleView?id=xcloud.consent_data_model_mc_about.htm&type=5&language=en_US)
- [Consent Data Model Workflow](https://help.salesforce.com/s/articleView?id=xcloud.consent_data_model_mc_workflow.htm&type=5&language=en_US)
- [Best Practices for Tracking Data Privacy](https://help.salesforce.com/s/articleView?id=platform.individuals_things_to_know_privacy_records.htm&type=5&language=en_US)
- [Track Data Privacy Preferences for Existing Leads and Contacts](https://help.salesforce.com/s/articleView?id=platform.individuals_data_privacy_for_existing_records.htm&type=5&language=en_US)
- [Contact Deletion in Contact Builder](https://help.salesforce.com/s/articleView?id=mktg.mc_cab_contact_deletion.htm&type=5&language=en_US)
- [Contact Delete Best Practices in Contact Builder](https://help.salesforce.com/s/articleView?id=mktg.mc_cab_best_practices.htm&type=5&language=en_US)
- [User Look-Up and Deletion API (Personalization)](https://developer.salesforce.com/docs/marketing/personalization/guide/user-look-up-deletion-api.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the B2C Solution Architect pack (USD $19): https://www.certifyforce.com/practice-exams