Under the California Consumer Privacy Act, the right to deletion lets any California resident ask a covered business to erase the personal information it has collected about them, and the business generally has 45 calendar days to comply or explain why it can’t.1California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information The right reaches past the company you contact: it also obligates the business to tell its service providers, contractors, and the third parties it sold or shared your data with to delete their copies too.
Is the Business Even Covered
Before you draft a request, check whether the company has to listen. The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds: annual gross revenue above roughly $26.6 million (adjusted yearly for inflation), buying or selling the personal information of 100,000 or more consumers or households, or earning 50 percent or more of annual revenue from selling or sharing personal information.2California Privacy Protection Agency. Updated Monetary Thresholds in CCPA A business that falls below all three isn’t required to honor deletion requests, though some choose to anyway.
What You Can Ask to Be Deleted
“Personal information” under the CCPA is defined broadly: any information that identifies, relates to, or could reasonably be linked to a particular consumer or household. That sweeps in obvious identifiers like your name, address, email, Social Security number, driver’s license number, and IP address, along with purchase records, browsing and search history, precise geolocation, biometric data, professional and education records, and inferences a company has drawn about your preferences or behavior from any of the above.3California Legislative Information. California Civil Code 1798.140 – Definitions
Two things sit outside the right to delete. Publicly available information and data that has been properly de-identified or aggregated don’t count as personal information in the first place.3California Legislative Information. California Civil Code 1798.140 – Definitions Sensitive personal information — Social Security numbers, precise geolocation, biometrics, and similar high-risk categories — is covered by deletion, but it also carries its own separate right to limit how the business uses it, which you can exercise without demanding full deletion.4Legal Information Institute (Cornell Law School). California Code of Regulations Title 11 7014 – Notice of Right to Limit and the Limit the Use of My Sensitive Personal Information Link
How to Submit a Deletion Request
Every covered business must offer at least two intake methods. These typically include a toll-free phone number, an email address, a web form, or a mailing address. A business that operates only online can get by with an email address alone.5State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Most companies post a “Delete My Personal Information” link in the footer of their website or inside the privacy policy. You cannot be forced to open an account just to make the request, but if you already have one, the business can require you to submit through it.6California Legislative Information. California Civil Code 1798.130 – Notice, Disclosure, Correction, and Deletion Requirements
Expect to prove you’re you. Provide your full name, your email, and any identifiers tied to your account with the company. The law requires the business to verify your identity before deleting anything, which is what keeps strangers from wiping your records without permission. For more sensitive data, the company may ask for extra verification, such as a code sent to your phone or a response to a follow-up email.
You can authorize someone else to make the request for you. The business may require signed written permission or a power of attorney as proof.5State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) State in the request whether you want all your personal information deleted or only specific categories, like browsing history or purchase records. Precise information helps the company find your records faster.
The Two-Step Confirmation for Online Requests
Requests submitted online are subject to a procedural safeguard: the business must use a two-step process in which you first submit the request and then separately confirm you really want the data deleted. In practice that usually means a follow-up email with a confirmation link, or a second prompt inside the company’s portal. The two-step rule is meant to stop accidental clicks or bots from wiping accounts. It doesn’t apply to requests sent by phone or mail.
What Happens After You Send the Request
From the moment the business has your verified request, the clock runs 45 calendar days. Within that window, the company must delete the qualifying data and tell you what it did. If your request is unusually complex, or the business is drowning in requests, it can extend the deadline by another 45 days — but only if it notifies you of the extension and the reason inside the original 45-day window.6California Legislative Information. California Civil Code 1798.130 – Notice, Disclosure, Correction, and Deletion Requirements
The response has to tell you whether the business complied. If any data was held back under a legal exception, the notice must identify which exception applies, and the business still has to delete everything that falls outside the scope of that exception. It cannot use the retained data for any purpose beyond what the exception permits.7Legal Information Institute (Cornell Law School). California Code of Regulations Title 11 7022 – Requests to Delete Save the confirmation. If a dispute comes up later, that notice is your clearest evidence of what the company said it did.
If the business refuses to act on the request at all, it must tell you why within the response period and inform you of any appeal rights.6California Legislative Information. California Civil Code 1798.130 – Notice, Disclosure, Correction, and Deletion Requirements
When a Business Can Legally Refuse
The right to delete has exceptions, and this is where most of the back-and-forth happens. A business can keep information when retention is reasonably necessary to:1California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information
- Complete a transaction you’re part of, including an active order, subscription, warranty, or product recall.
- Detect security incidents or protect against fraud, malicious activity, or deception.
- Debug and repair errors that impair existing functionality.
- Exercise the business’s free speech rights or protect another consumer’s.
- Comply with the California Electronic Communications Privacy Act, such as preserving records under a valid warrant or court order.
- Conduct scientific, historical, or statistical research in the public interest, if deletion would make the research impossible or seriously impair it and you originally consented to that use.
- Use the data internally in ways that are reasonably consistent with your relationship with the business.
- Comply with another federal or state legal obligation.
“Reasonably necessary” is the operative phrase. A company can’t claim an exception as a blanket cover for keeping everything. It has to point to the specific exception, explain why it applies, and delete whatever falls outside its scope.7Legal Information Institute (Cornell Law School). California Code of Regulations Title 11 7022 – Requests to Delete
What Deletion Actually Looks Like
When no exception applies, the business has three permitted ways to carry out the deletion: permanently erase the data from its active systems, de-identify it so it can no longer be linked back to any individual, or aggregate it into larger datasets that obscure individual identities. Data sitting on archived or backup systems is treated differently: deletion of those copies can wait until the backup is restored to active use or next accessed for a commercial purpose.7Legal Information Institute (Cornell Law School). California Code of Regulations Title 11 7022 – Requests to Delete
Deletion doesn’t stop at the business’s own servers. The company must direct its service providers and contractors to delete the data from their records, and it must also notify the third parties it sold or shared your data with to delete it, unless doing so would be impossible or involve disproportionate effort.1California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information If the business claims notifying third parties would be disproportionately burdensome, the regulations require it to explain the obstacle in enough detail to give you a meaningful understanding; a vague “it’s too hard” doesn’t satisfy the rule.7Legal Information Institute (Cornell Law School). California Code of Regulations Title 11 7022 – Requests to Delete
After deleting your data, the business is allowed to keep a confidential record of the deletion request itself. That record exists so the company can keep your information from being re-collected or sold in the future and prove compliance if it is audited.1California Legislative Information. California Civil Code 1798.105 – Consumers Right to Delete Personal Information
No Retaliation for Asking
A business cannot punish you for exercising your deletion right. It cannot deny you goods or services, charge you a higher price, give you a lower quality of service, or suggest that any of those consequences will follow if you make the request. The same protection extends to employees and independent contractors who exercise their CCPA rights. One practical wrinkle: if you ask a loyalty program to delete the data that fuels it, the program may no longer be able to operate for you. That isn’t retaliation; the law allows businesses to offer financial incentives tied to data collection as long as the value exchange is reasonable.8California Legislative Information. California Civil Code 1798.125 – Consumers Right of No Retaliation Following Opt Out or Exercise of Other Rights
If the Business Ignores You
The CCPA’s deletion right is enforced by the government, not by private lawsuits. The California Attorney General and the California Privacy Protection Agency can bring civil actions against businesses that violate the Act, with statutory penalties up to $2,500 per violation and up to $7,500 per intentional violation or per violation involving a minor’s data (both figures adjusted annually for inflation).9California Legislative Information. California Civil Code 1798.199.9010California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties A business that simply ignores a verified deletion request falls into this track; you can submit a complaint to the Attorney General or the CPPA.
The CCPA’s private right of action is narrow and separate. It lets consumers sue only when a business’s failure to maintain reasonable security practices exposes their unencrypted personal information in a data breach, with statutory damages of $100 to $750 per consumer per incident or actual damages, whichever is greater, after 30 days’ written notice to the business.11California Legislative Information. California Civil Code 1798.150 – Personal Information Security Breaches A missed deletion request, on its own, does not open the door to this lawsuit.
Related Tools That Are Not the Same Thing
Two other mechanisms often get mixed up with the right to delete, and it helps to keep them separate.
The Global Privacy Control is a browser-level signal that tells every site you visit to stop selling or sharing your data. California requires covered businesses to honor it.12State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC) GPC is an opt-out, not a deletion request. It stops new data from being sold or shared going forward; it does not erase what a company already holds. If you want existing records gone, you still have to submit the deletion request described above.
The California Delete Act, with obligations starting August 1, 2026, adds a centralized deletion mechanism aimed specifically at data brokers. The California Privacy Protection Agency will operate a single portal where consumers can submit one request that applies to all registered data brokers, and brokers will have to check the system at least every 45 days.13California Privacy Protection Agency. California Approves Delete Act Regulations The Delete Act supplements the CCPA for the data broker industry; it does not replace the CCPA deletion rights you can already use against any covered business today.