Quick answer
If you live in California, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.
Your rights under the CCPA/CPRA
The California Consumer Privacy Act (CCPA), as amended by the CPRA gives California residents the right to:
- Find out what personal information a company has about you
- Have it deleted
- Correct information that's wrong
- Stop a company from selling or sharing your information
- Limit how a company uses sensitive information, like your precise location or financial details
- Use these rights without being charged more or treated worse
What makes California's law stand out
California's law was the first comprehensive state consumer privacy law in the United States and has since been substantially expanded. California is also the only state with a government agency dedicated to enforcing its privacy law. It also gives residents a specific right to sue a company when their information is exposed in certain data breaches caused by inadequate security.
California residents also have a second tool: DROP, a free state platform that lets you make a single deletion request to the registered data brokers that are required to check it. DROP doesn't reach the companies you've actually done business with, so you still need to contact those yourself.
Which companies have to comply
Companies doing business in California that have more than $26.625 million in annual revenue (a figure adjusted for inflation every other year), or that buy, sell, or share the personal information of 100,000 or more California residents or households, or that make at least half their revenue from selling or sharing personal information.
That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.
How to ask a company to delete your data
- Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
- Ask the company to delete your personal information, and say that you're a California resident making the request under the CCPA/CPRA.
- Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
- Write down the date you sent the request. You'll need it if the company misses its deadline.
How long companies have to respond
Companies must confirm they received your deletion request within 10 business days and respond within 45 days. They can take up to 45 more days if they tell you why.
If a company ignores or refuses your request
California doesn't require companies to offer a formal appeal. If a company ignores your request or refuses without a good reason, you can file a complaint with CalPrivacy at cppa.ca.gov or with the California Attorney General.
Make your requests in minutes, not evenings
The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the CCPA/CPRA, and tracks the 45-day deadline for you. You review each one and send it from your own email.
Join the waitlistEnforced by CalPrivacy (the California Privacy Protection Agency) and the Attorney General. This page is general information, not legal advice, and laws change. For the official text, see California's state legislature or Attorney General website.