Right to Delete
The CCPA gives consumers the right to request that a business delete any personal information about the consumer that the business has collected.
What is the Right to Delete?
The California Consumer Privacy Act (CCPA) gives consumers the right to request that a business delete any personal information about the consumer that the business has collected from the consumer.
Scope of Deletion
When a business receives a verifiable request to delete personal information, it must:
- Delete the consumer's personal information from its records
- Direct any service providers to delete the consumer's personal information from their records
Exceptions to the Right to Delete
A business or a service provider is not required to comply with a consumer's deletion request if the personal information is necessary to:
Complete Transactions
Complete the transaction for which the personal information was collected
Provide Services
Provide a good or service requested by the consumer
Perform Contracts
Perform a contract between the business and the consumer
Security Purposes
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity
Debug Issues
Debug to identify and repair errors
Free Speech
Exercise free speech or ensure another consumer's right to exercise free speech
Note: There are additional exceptions related to legal compliance, research, and internal uses that are reasonably aligned with consumer expectations.
How to Submit a Deletion Request
Businesses must provide at least two methods for consumers to submit requests for deletion, including, at minimum:
Toll-Free Telephone Number
Website Address
(if the business has a website)
Verification Process
Businesses must verify the identity of the consumer making the deletion request to a reasonable degree of certainty. The level of verification should be proportional to the sensitivity of the information requested for deletion.
Business Response
| Requirement | Details |
|---|---|
| Response Time | 45 days from receipt of request |
| Extension | Additional 45 days when reasonably necessary |
| Extension Notification | Must notify consumer within first 45-day period |