How to send a CCPA delete request, and what to do when a company ignores it

Breach / exposure. Updated 2026-09-13. About 6 minutes to read.

Send a written deletion request through the company's designated method, diary the 10 business day and 45 day deadlines, and complain to CalPrivacy if it misses them.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents the right to ask a business to delete personal information it collected from them. The business must confirm your request within 10 business days and respond within 45 calendar days.

This guide gives you a request template as numbered steps, explains what a lawful response looks like and which exceptions a company can use, and covers what to do when a company misses its deadline.

If your goal is to clear your details from data brokers, use California's DROP platform instead. One DROP request reaches every registered broker, and it is covered at the end.

Who can use it and which companies must comply

You must be a California resident. The law applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above 26,625,000 dollars, as adjusted for inflation from January 2025; buying, selling or sharing personal information of 100,000 or more California consumers or households; or earning at least half of annual revenue from selling or sharing personal information.

Most large retailers, apps, social platforms and data companies qualify. Small local businesses usually do not. Since 2023 the law has also covered employee and business contact data.

Find the right place to send it

  1. Open the company's privacy policy and look for a section on California privacy rights, or a link named Your Privacy Choices or Do Not Sell or Share My Personal Information.
  2. Use the company's designated method. Businesses must offer at least two, and one must be a toll free number, unless the business operates only online and has a direct relationship with you, in which case an email address is enough.
  3. Prefer a web form or email so you have a written record. If you use the phone, note the date, time and name of the person you spoke to.
  4. If you want someone else to handle it, such as a paid removal service, you can appoint an authorized agent with your signed permission. The business may still ask you to verify your identity directly.

Send the request: template as steps

  1. Subject line: Request to delete personal information under the California Consumer Privacy Act.
  2. Opening line: state that you are a California resident and are requesting deletion of all personal information the business has collected about you under Civil Code section 1798.105.
  3. Identify yourself using only details the business already has: your full name, the email address and phone number on your account, and your account or customer number if you have one.
  4. Add that you also opt out of the sale and sharing of your personal information and ask the business to limit use of any sensitive personal information.
  5. Ask the business to direct its service providers and contractors to delete your information, and to notify third parties it sold or shared your information with.
  6. Ask for written confirmation of what was deleted and, if anything is kept, which specific exception the business relies on.
  7. Close with the date and a note that you expect confirmation of receipt within 10 business days and a response within 45 calendar days.
  8. Save a copy of the request and any confirmation number.

Do not send a copy of your driver licence unless the business specifically needs it to match you. A business cannot require you to create an account to make a request, and should verify you using information it already holds.

Deadlines and what a lawful response looks like

  • Confirmation of receipt within 10 business days, explaining how the business will process the request.
  • A substantive response within 45 calendar days of receiving the request.
  • One extension of up to another 45 days, 90 days in total, only if the business tells you within the first 45 days and explains why.
  • If the business refuses, it must tell you why, including which exception applies, and still delete anything the exception does not cover.
  • No retaliation. The business cannot deny service, charge a different price or provide worse service because you used your rights, although loyalty programs can differ if the rules are followed.

The exceptions companies are allowed to use

Exceptions are specific. A company that says it keeps everything for business purposes has not given you a valid reason.

  • Completing a transaction you asked for, providing a product or service you requested, or performing a contract with you.
  • Detecting security incidents and protecting against fraud or illegal activity.
  • Debugging to fix errors in existing functionality.
  • Complying with a legal obligation, such as tax or financial record keeping.
  • Exercising free speech, or research in the public interest where deletion would seriously impair it.
  • Internal uses that are reasonably aligned with your expectations based on your relationship with the business.

When a company ignores you

  1. After 45 days with no response or extension notice, send a short follow up quoting your original request date and the deadline that passed.
  2. If there is still no answer after about two weeks, file a complaint with the California Privacy Protection Agency at cppa.ca.gov/webapplications/complaint. Attach your request, dates and any replies.
  3. You can also report the business to the California Attorney General through the consumer complaint form at oag.ca.gov.
  4. Keep records. Regulators can fine businesses up to 2,663 dollars per violation, or 7,988 dollars per intentional violation or violation involving consumers under 16, as adjusted in 2025.

You cannot sue a business yourself for ignoring a deletion request. The CCPA only gives consumers a private right of action for certain data breaches. Enforcement of deletion rights is through CalPrivacy and the Attorney General.

Data brokers: use DROP instead of dozens of requests

Under California's Delete Act, residents can submit one deletion request through the Delete Request and Opt-out Platform at privacy.ca.gov/drop. It opened to consumers on 1 January 2026. Since 1 August 2026, registered data brokers must check it at least every 45 days and delete matching records. Use DROP for brokers, and CCPA requests for the companies you actually deal with.

Frequently asked questions

Can I use the CCPA if I live outside California?

No. The right belongs to California residents. Some companies apply the same process to everyone, so asking still sometimes works, and residents of about 20 other states with privacy laws have similar deletion rights under their own laws.

How do I prove I am a California resident without sending my ID?

Most businesses verify you by matching information they already hold, such as your account email and phone number, rather than checking residency documents. Provide those first. Only supply an ID document if the business explains why it is needed to match you.

Does a CCPA request delete my data from data brokers too?

Only from the business you send it to, plus its service providers and contractors. It does not reach brokers the business already sold data to, beyond requiring notice to them. For registered brokers, use DROP.

Can a business charge me or cut off service for making a request?

No. Requests are free, and the CCPA prohibits discrimination against you for using your rights. A business may need to close an account if the data is essential to providing it, and should explain that.

What is the difference between the CCPA and the Delete Act?

The CCPA gives you rights against businesses that collect your data, one request at a time. The Delete Act regulates data brokers specifically and created DROP, a single deletion request that all registered brokers must process.

Tools that help

Related guides

Sources