Can I tell a business to delete my personal information under CCPA?

What the Law Says

The California Consumer Privacy Act (CCPA) gives California residents the right to request deletion of their personal information collected by businesses.

Businesses subject to the CCPA must delete your personal information upon receiving a verifiable consumer request, unless an exception applies. The law defines a 'verifiable consumer request' as one that reasonably enables the business to confirm the requester is the consumer about whom the business collected personal information.

Businesses must respond to deletion requests within 45 days, with a possible one-time 45-day extension if reasonably necessary. They must also notify you whether they complied, partially complied, or denied your request—and if denied, explain why.

The CCPA applies to for-profit businesses that do business in California and meet at least one of these thresholds: (1) annual gross revenues over $25 million; (2) buy, receive, sell, or share the personal information of 100,000 or more consumers or households annually; or (3) derive 50% or more of annual revenue from selling consumers’ personal information.

Statutory Text

A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.

— Cal. Civ. Code § 1798.105(a) — Right to deletion

Statutory Text

A business that receives a verifiable consumer request … shall delete the consumer's personal information … and direct its service providers to do the same.

— Cal. Civ. Code § 1798.105(c) — Obligation to delete

Statutory Text

A business shall respond to a request … within 45 days … and may take up to an additional 45 days … if reasonably necessary.

— Cal. Civ. Code § 1798.100(g)(1) — Response timeline

What to Do

Sources