How to Delete Your Data in California Under CCPA

If you live in California, you can ask companies covered by the CCPA that hold your personal information to delete it. This is called the right to delete, and it comes from the California Consumer Privacy Act. Here's how to actually use it: who it covers, what to send, how long a company has to respond, when it can say no, and what to do if it ignores you.

Who qualifies for a CCPA deletion right?

The right to delete belongs to California residents. The California Attorney General's office defines that broadly: "Only California residents have rights under the CCPA. A California resident is a natural person (as opposed to a corporation or other business entity) who resides in California, even if the person is temporarily outside of the state," according to the Attorney General's CCPA page. The California Privacy Protection Agency's FAQ adds that this includes "California residents that are employees or job applicants, and contacts for business customers, vendors, or independent contractors," per the CPPA's FAQ page.

The statute itself, Civil Code Section 1798.105, states the right plainly: "A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer," according to the CCPA statute text. Businesses that collect personal information are required to disclose this deletion right to consumers.

You don't have to do this yourself. The Attorney General's office notes "you may authorize another person to submit a CCPA request on your behalf," including "a business entity registered with the California Secretary of State," though businesses "may require more information from either the authorized agent or from you to verify that you are the person directing the agent," per the Attorney General's CCPA page.

How do I submit a deletion request to a company?

Start by finding the company's designated request channels. Under the rules the CPPA describes, "Businesses must generally designate at least two methods for you to submit your requests to delete, correct, or know your personal information — for example, an email address, website form, or hard copy form." If the business operates only online, "it only needs to provide an email address for submitting requests," according to the CPPA's FAQ page. Look for this information in a company's privacy policy, usually linked at the bottom of its website.

When you submit the request, be specific: say you are a California resident invoking your right to delete under the CCPA, and include enough identifying information (name, email address tied to the account, account number if relevant) for the company to locate your records and verify it's really you. Companies are allowed to ask for verification before acting, since they're handing over a request to erase your data and don't want to delete the wrong person's file or let an imposter delete someone else's.

If what you actually want first is a copy of what a company has on you, that's a separate right, and this site has a guide to requesting access to your data first before deciding whether to delete it.

How long do companies have to delete my data?

Once you submit a verifiable request, the clock starts. The CPPA's FAQ lays out the timeline: "Businesses must confirm receipt of your request within 10 business days and must substantively respond to your request to delete, correct, or know your personal information within 45 calendar days. They can extend the deadline by another 45 days (90 days total) if they notify you," according to the CPPA's FAQ page.

That means you should get an acknowledgment within about a week and a half, and a real answer — deletion confirmed, request denied with a reason, or a notice of extension — within 45 days, or up to 90 if they tell you they need more time.

When a request is valid, the statute requires more than just wiping the company's own database. Under Section 1798.105, a business that receives a verifiable deletion request "shall delete the consumer's personal information from its records, notify any service providers or contractors to delete the consumer's personal information from their records, and notify all third parties to whom the business has sold or shared the personal information to delete the consumer's personal information unless this proves impossible or involves disproportionate effort," per the CCPA statute text. Service providers and contractors working for that business are required to cooperate and to pass the deletion instruction further down their own chain of vendors, per the same statute.

What are the exemptions companies can claim?

Companies don't have to delete everything you ask them to. Section 1798.105 lists specific exemptions a business can invoke to keep data despite a deletion request. One covers finishing what you asked for: a business can retain data needed to "complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business' ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer," according to the CCPA statute text.

Other exemptions in the statute cover things like security and debugging, free speech, compliance with California's electronic communications privacy law, research conducted with consent, and complying with a legal obligation. There's also a broader internal-use carve-out in the same statute: a business can keep data "To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with the business and compatible with the context in which the consumer provided the information," per the CCPA statute text. In practice, this is why a bank might keep transaction records tied to an account you closed, or why a retailer might keep records needed for a product recall, even after you've asked them to delete your data.

If a company denies your deletion request, read the explanation it gives carefully. If that explanation doesn't match what you actually asked for deleted, that's worth pushing back on or escalating.

What should I do if a company ignores my deletion request?

If a company blows past the 45- or 90-day deadline, doesn't respond at all, or gives you an answer that doesn't hold up, you have somewhere to take it. Consumers generally can't sue over most CCPA violations directly. As the Attorney General's office explains, "For all other violations of the CCPA, only the Attorney General or the California Privacy Protection Agency may take legal action against non-compliant entities," and "starting on July 1, 2023, you also will be able to file complaints with the California Privacy Protection Agency for violations of the CCPA, as amended, occurring on or after that date," per the Attorney General's CCPA page.

You can file directly with the CPPA using the agency's online complaint form. The form warns that "any personal information that you provide may be used and disclosed to enforce the CCPA, including in an administrative or judicial proceeding," so expect to include real details about the company and the request you sent. The agency is upfront that it won't act as your personal lawyer: "The Agency does not represent individual consumers and cannot act as your attorney," per the CPPA's complaint form page. But complaints aren't pointless — the CPPA's FAQ says "every complaint we receive provides insights into privacy problems that people are experiencing in California and helps us identify trends," and that this information feeds "inquiries, sweeps, and investigations" the agency pursues, per the CPPA's FAQ page.

Is DROP easier than asking companies directly?

For one specific category of company — data brokers — California built a shortcut. The CPPA runs a Data Broker Registry and a tool called DROP, the Delete Request and Opt-out Platform, described as letting consumers "send one request to over 600 registered data brokers," according to the CPPA's DROP page. Instead of tracking down contact methods for each broker individually, you submit one request through DROP and it goes out to all registered brokers at once.

To use it, you need to be a California resident, verified "through the California Identity Gateway, the State of California's secure digital platform," per the same page. You can also submit a request on behalf of someone else, such as a child or an elderly relative. The timeline is slower than a direct company request: DROP launched January 1, 2026, but "data brokers begin processing requests" on August 1, 2026, and "it could take up to 90 days for consumers to see status updates in DROP." By November 2026, "all data brokers in DROP should have completed their initial download and upload cycle," after which brokers must delete matching data every 45 days, according to the CPPA's DROP page.

DROP only reaches brokers registered with the state — it won't touch a retailer, an app, or your bank. For those, you still need to send a direct CCPA deletion request as described above. This site has a separate guide on deleting from data brokers specifically, and if your main concern is sites that publish your home address and phone number, there's also a guide to removing yourself from people-search sites, which often operate as data brokers covered by DROP.