Quick answer
If you live in a state with a comprehensive privacy law, you can ask covered companies to delete the personal information they hold about you, and they generally must respond within 45 days. California, Maryland, Oregon, Colorado, Connecticut, and Minnesota have some of the strongest laws.
The strongest state privacy laws
| State | Law | In effect since | What stands out |
|---|---|---|---|
| California | CCPA/CPRA | 2020, expanded in 2023 | A dedicated privacy agency, and a specific right to sue over certain data breaches |
| Maryland | MODPA | October 2025 | Limits what companies can collect in the first place, and bans selling sensitive data |
| Oregon | OCPA | July 2024 | You can get the names of the specific companies your data was shared with |
| Colorado | CPA | July 2023 | Companies must honor recognized universal opt-out signals, like Global Privacy Control |
| Connecticut | CTDPA | July 2023, expanded July 2026 | Expanded in July 2026 to cover far more companies and add new rights |
| Minnesota | MCDPA | July 31, 2025 | You can question automated decisions and learn the names of companies that got your data |
- CaliforniaA dedicated privacy agency, and a specific right to sue over certain data breaches.
- MarylandLimits what companies can collect in the first place, and bans selling sensitive data.
- OregonYou can get the names of the specific companies your data was shared with.
- ColoradoCompanies must honor recognized universal opt-out signals, like Global Privacy Control.
- ConnecticutExpanded in July 2026 to cover far more companies and add new rights.
- MinnesotaYou can question automated decisions and learn the names of companies that got your data.
What all of these laws have in common
- You can ask covered companies what personal information they hold about you, and have it deleted.
- Companies generally have 45 days to respond, with one 45-day extension if they tell you why.
- Most apply only to companies above certain size limits, so not every small business is covered. Some states, like Connecticut, also cover smaller companies that handle sensitive data or sell personal data.
- Companies can't charge you more or treat you worse for using your rights.
What if my state isn't listed?
Many other states, including Texas, Virginia, Utah, New Jersey, and others, also have privacy laws that give residents the right to delete their data, though their protections vary. And even where no state law applies, many large companies honor deletion requests from all their US customers, because one policy is simpler than many.
Know your rights. Then use them.
DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the law where you live, and tracks each company's deadline. You review each request and send it from your own email.
Join the waitlistThis page is general information, not legal advice. State privacy laws change often; check each state's official sources for the current text.