CCPA Deletion Request: How to Send One and What to Expect

California law gives residents a right to ask for deletion. It comes with limits, deadlines and a few steps that decide whether a request works.

By Siddharth ShankarUpdated October 11, 2026

Many people have heard that California residents can "delete their data". It is true, but only partly. A deletion request is a legal tool with scope, deadlines and exceptions. Knowing them makes the request much more likely to work.

Who can use it and who must respond

According to the California Attorney General, the CCPA gives California residents rights to know what is collected, to delete, to opt out of sale or sharing, to correct, to limit use of sensitive information and not to be discriminated against for exercising rights.

The law applies to for-profit businesses that do business in California and meet at least one test:

• Annual gross revenue over $25 million
• Buy, sell or share information of 100,000 or more California residents or households
• Get 50 percent or more of revenue from selling consumers' information

Small local firms may fall outside the law. Data brokers are often covered because of the volume of data they hold.

What businesses must provide

A covered business must offer at least two ways to submit a request, including a toll-free phone number. A business with a website must offer a web method. A business that operates only online may offer an email address instead of a phone number. It cannot force you to create an account just to make a request.

The business has to verify that you are the person whose data is involved. Expect to be asked to confirm details it already holds.

Deadlines

The attorney general's guidance gives these timing rules:

• Respond to deletion requests within 45 calendar days
• Extend by another 45 days where needed, with notice
• Process opt-out requests within 15 business days

What deletion does not cover

Deletion has exceptions. A business can refuse or limit deletion where the information is:

• Exempt, for example publicly available data such as an address in public property records, certain medical information or credit reporting data
• Needed to complete a transaction you requested
• Needed for security purposes
• Required to meet a legal obligation
• Impossible to link to you because it cannot be verified

If your request is partly refused, the business should explain why. Public-record data a company copied from a county source is a typical example of what stays, which matters for removing your address from the internet.

How to send a deletion request

If you are ignored

The attorney general's guidance suggests several escalation steps. Confirm you used the designated method, send a written notice or use another method, ask for a status, and then file a complaint. You can complain to the California Attorney General or to the California Privacy Protection Agency using its online complaint form. The attorney general does not represent individuals in disputes.

Requests to data brokers

If you want to reach hundreds of brokers at once, California has a separate tool. Read the California Delete Act and DROP. For manual opt-outs and brokers outside California's scope, see how to opt out of data brokers yourself.