← Back to Home

Right to Delete

Right to Delete Illustration

What is the Right to Delete?

The California Consumer Privacy Act (CCPA) gives consumers the right to request that a business delete any personal information about the consumer that the business has collected from the consumer.

Scope of Deletion

When a business receives a verifiable request to delete personal information, it must delete the consumer's personal information from its records and direct any service providers to delete the consumer's personal information from their records.

Exceptions to the Right to Delete

A business or a service provider is not required to comply with a consumer's deletion request if the personal information is necessary to:

  • Complete the transaction for which the personal information was collected
  • Provide a good or service requested by the consumer
  • Perform a contract between the business and the consumer
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity
  • Debug to identify and repair errors
  • Exercise free speech or ensure another consumer's right to exercise free speech
  • Comply with the California Electronic Communications Privacy Act
  • Engage in public or peer-reviewed scientific, historical, or statistical research
  • Enable solely internal uses that are reasonably aligned with consumer expectations
  • Comply with a legal obligation
  • Otherwise use the consumer's personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information

How to Submit a Deletion Request

Businesses must provide at least two methods for consumers to submit requests for deletion, including, at minimum, a toll-free telephone number and a website address (if the business has a website).

Verification Process

Businesses must verify the identity of the consumer making the deletion request to a reasonable degree of certainty. The level of verification should be proportional to the sensitivity of the information requested for deletion.

Business Response

Businesses must respond to verifiable consumer deletion requests within 45 days of receipt. The response period may be extended once by an additional 45 days when reasonably necessary, provided the consumer is given notice of the extension within the first 45-day period.