Privacy laws and your data rights
Where you live decides what a company has to do when you ask it to delete your data, and how fast. Each page explains one law in plain words, shows how to use it, and links the data brokers it applies to.
Laws
United States
- California California Delete Act: how to use DROP to delete your data from data brokers If you live in California, DROP (the Delete Request and Opt-out Platform) lets you send one free deletion request to every registered data broker at once. The state launched it on January 1, 2026, and brokers have had to process DROP requests since August 1, 2026. You sign up at consumer.drop.privacy.ca.gov, confirm you live in California, and enter your name, date of birth and ZIP code.
- California CCPA: how to delete, see and stop the sale of your data in California The California Consumer Privacy Act (CCPA) lets California residents ask a covered business to show them the personal information it holds, delete it, correct it, and stop selling or sharing it. You send the request through one of the methods in the company's privacy policy, and the company has 45 calendar days to answer, or 90 if it tells you it needs an extension. It's free, and the company can't treat you worse for asking.
- Colorado Colorado Privacy Act (CPA): your rights, Global Privacy Control and how to complain If you live in Colorado, the Colorado Privacy Act lets you see the personal data a covered company holds about you, correct it or have it deleted, and opt out of targeted ads, sales or certain profiling. The quickest opt-out is Global Privacy Control: since July 1, 2024 covered companies must honor it. For deletion and the other rights, send a request through the company's privacy notice; it has 45 days to answer, and if it refuses you can appeal and then complain to the Colorado Attorney General.
- Connecticut Connecticut Data Privacy Act (CTDPA): deleting people-search profiles and your other rights Since October 1, 2026, Connecticut's data privacy law lets you ask a covered company to delete public information it has compiled into a profile about you, on a website such as a people-search site or offered for sale, along with the inferences it drew from it. You can also see, correct and delete your other personal data, and opt out of sales and targeted ads, including with Global Privacy Control. A data broker registry starts on January 1, 2027, and a state tool to send one deletion request to every registered broker is due by July 1, 2028: it isn't live yet, so for now you contact each company, which has 45 days to answer.
- Delaware Delaware Personal Data Privacy Act (DPDPA): your rights and how to use them If you live in Delaware, the Delaware Personal Data Privacy Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method in the company's privacy notice: it has 45 days to answer, and one response a year is free. If the company refuses, appeal to it first, then complain to the Delaware Department of Justice.
- Indiana Indiana Consumer Data Protection Act: your rights since January 1, 2026 Since January 1, 2026, Indiana's Consumer Data Protection Act lets you ask a covered company to show you, correct or delete your personal data, including data it got about you from other sources, and to stop selling it, using it for targeted ads or profiling you. The company has 45 days to answer and your first request each year is free. If it refuses, appeal to the company, then complain to the Indiana Attorney General.
- Iowa Iowa Consumer Data Protection Act (ICDPA): your rights and the 90-day clock Iowa's Consumer Data Protection Act, in force since January 1, 2025, lets you see the personal data a covered company holds about you, get a copy, delete data you gave it and opt out of its sale. It's narrower than Virginia's or Colorado's law: there's no right to correct, deletion doesn't expressly reach data the company got from someone else, and companies get 90 days to answer, plus a possible 45-day extension. If a company refuses, appeal to it first, then complain to the Iowa Attorney General.
- Kentucky Kentucky Consumer Data Protection Act (KCDPA): your rights and how to use them If you live in Kentucky, the Kentucky Consumer Data Protection Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Kentucky Attorney General.
- Maryland Maryland Online Data Privacy Act (MODPA): your rights and how to use them If you live in Maryland, the Maryland Online Data Privacy Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method the business offers: it has 45 days to answer, and one response a year is free. If the company refuses, appeal to it first, then complain to the Attorney General's Consumer Protection Division.
- Minnesota Minnesota Consumer Data Privacy Act (MCDPA): your rights and how to use them If you live in Minnesota, the Minnesota Consumer Data Privacy Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, to stop selling it or using it for targeted ads, and to name the specific companies it shared your data with. Send your request through one of the methods the business offers: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Minnesota Attorney General.
- Montana Montana Consumer Data Privacy Act (MCDPA): rights, opt-out signals and the 2025 changes Montana's Consumer Data Privacy Act lets you ask a covered company to show you, correct or delete personal data about you, including data it got from other sources, and to stop selling it or using it for targeted ads or significant automated decisions. Since January 1, 2025 companies must honor opt-out signals such as Global Privacy Control, and after 2025 amendments the law reaches businesses with data on as few as 25,000 Montanans. A company has 45 days to answer; if it refuses, appeal first, then complain to the Montana Attorney General.
- Nebraska Nebraska Data Privacy Act (NDPA): your rights and how to use them If you live in Nebraska, the Nebraska Data Privacy Act lets you ask a business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. According to the Nebraska Attorney General, the business has 45 days to answer and two responses a year are free. If it refuses, appeal to the business first, then file a Data Privacy Complaint with the Attorney General.
- Oregon Oregon Consumer Privacy Act (OCPA): your rights and how to use them If you live in Oregon, the Oregon Consumer Privacy Act lets you see, correct and delete the personal data a covered business holds about you, get a list of the specific companies it gave your data to, and opt out of sales and targeted ads. Use the request method in the business's privacy notice. According to the Oregon Department of Justice, the business has 45 days to answer, and if it says no you can appeal and then complain to the DOJ.
- Tennessee Tennessee Information Protection Act (TIPA): your rights since July 2025 According to the Tennessee Attorney General, the Tennessee Information Protection Act, in force since July 1, 2025, lets you ask a covered company to show you, correct or delete your personal information, give you a portable copy, and stop using it for targeted ads, profiling or sale. It only reaches large businesses: more than $25 million in annual revenue plus a lot of Tennesseans' data. A company must answer within 45 days, and if it refuses you can appeal and then complain to the Attorney General's Division of Consumer Affairs.
- Texas Texas Data Privacy and Security Act (TDPSA): your rights and how to use them If you live in Texas, the Texas Data Privacy and Security Act lets you ask a covered company to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send the request through one of the methods in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Texas Attorney General.
- Utah Utah Consumer Privacy Act (UCPA): what you can and can't make companies do Utah's Consumer Privacy Act gives you less than Colorado's or Virginia's law if your goal is deletion. It covers only companies with at least $25 million in annual revenue that also handle a lot of personal data, and its deletion right reaches only data you gave the company yourself, not data it bought about you. You can still ask for access, a copy, a correction or deletion, and opt out of sales and targeted ads; the company has 45 days to act, and complaints go to the Utah Division of Consumer Protection.
- Vermont Vermont privacy law: the data broker registry now, deletion rights from 2028 Vermont doesn't give you a general right to make businesses delete your data yet. That starts on January 1, 2028, when the Vermont Data Privacy and Online Surveillance Act (Act 145) takes effect, with rights to access, correct and delete your data and to opt out of its sale. Until then, your tool is the data broker registry: registered brokers must say whether and how you can opt out, and you use each broker's own opt-out.
- Virginia Virginia Consumer Data Protection Act (VCDPA): your rights and how to use them If you live in Virginia, the Consumer Data Protection Act lets you ask a covered company to show you, correct or delete your personal data, including data it bought or got from someone else, and to stop selling it or using it for targeted ads. Send the request through the method in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Virginia Attorney General.
Remove your data where you live
- Australia (Commonwealth) How to remove your personal information in Australia Australia's Privacy Act has no standalone right to erasure, so start by asking organisations what they hold, then ask them to correct or delete it and to stop direct marketing. All of that is free. For public records, the main tools are silent elector status on the electoral roll and suppression of your address on the ASIC companies register, and both require a risk to your safety.
- California How to remove your personal information in California Start with DROP, California's free tool that sends one deletion request to every registered data broker at once. Then use the CCPA to ask companies that aren't brokers, like stores, apps and services you've used, to delete what they hold. After that, check what Google still shows and deal with people-search sites outside the state registry one by one.
- Canada (federal; Quebec enterprise register noted) How to remove your personal information in Canada Canada has no standalone right to be forgotten, so start by asking each company in writing what it holds under PIPEDA, then withdraw your consent and ask it to destroy what it no longer needs. Separately, you can write to Elections Canada to leave the National Register of Electors without losing your vote, and join the free National Do Not Call List. Company directors can switch to an address for service, but old corporate filings stay public.
- Texas, United States How to remove your personal information in Texas Texas has no one-stop deletion tool like California's DROP, so you send a request to each company under the Texas Data Privacy and Security Act (TDPSA). It's free up to twice a year, companies have 45 days to answer, and you can appeal a refusal and then complain to the Attorney General. Find data brokers in the Secretary of State's registry, and if you're a survivor of violence or work in a protected job, you can also hide your address in some public records.
- United Kingdom How to remove your personal information in the UK Start with the free steps: opt out of the open electoral register, which anyone can buy a copy of, and register your numbers with the Telephone Preference Service. Then send UK GDPR erasure requests and marketing objections to the people-search sites and companies that hold your data; they normally have one month to reply. If your home address sits in Companies House filings, removing it costs £34 per document.
- United States, UK, EU, Canada and Australia What to do when a company won't delete your account Make a formal deletion request in writing under the privacy law that covers you, through the company's official privacy channel, and keep proof. A support agent saying no, or a missing delete button, doesn't end your rights. If the company refuses or goes quiet, appeal where your law allows it (Texas and Oregon), then complain to your regulator. Bring copies of everything.
Request letter templates
- Australia (Commonwealth) Australian Privacy Act access request template (APP 12) Copy the letter below, fill in the [brackets] and send it to the organisation or agency that holds your information. Under APP 12 of the Privacy Act you can ask for access to your personal information, including health information. Making the request is free, organisations should respond within about 30 days, and agencies must respond within 30 days and can't charge.
- California, United States CCPA Do Not Sell or Share request template for California Use the company's Do Not Sell or Share My Personal Information link if it has one; if not, copy the letter below and send it through a method in its privacy policy. You don't have to prove who you are or create an account to opt out, and the business must stop selling or sharing your data within 15 business days. Turning on Global Privacy Control in your browser counts as an opt-out request at covered sites you visit.
- California, United States CCPA request to delete template: a letter for California residents Copy the letter below, fill in the [brackets] and send it through one of the request methods listed in the company's privacy policy. It asks the business to delete the personal information it collected about you under Civil Code § 1798.105. The business must confirm receipt within 10 business days and answer within 45 calendar days, and it can't charge you for verifying who you are.
- European Union / EEA GDPR erasure request template: a right to be forgotten letter Copy the letter below, fill in the [brackets], tick the Article 17 ground that fits and send it to the company or its Data Protection Officer. The company must reply within one month, free of charge, and if it won't erase your data it has to say why and tell you about your right to complain. The right isn't absolute, so the letter also asks it to delete whatever an exception doesn't cover.
- European Union GDPR subject access request template: a letter you can copy Copy the letter below, fill in the [brackets] and send it to the company's privacy contact or Data Protection Officer. You don't need an official form or a reason: the EDPB says it's enough to say you want to know what personal data the company processes about you. The company must reply free of charge within one month.
- Canada (federal private sector) PIPEDA access request template: a letter for Canadians Copy the letter below, fill in the [brackets] and send it in writing to the organization's privacy officer. PIPEDA lets you find out whether a business holds your personal information, get access to it, and learn how it was used and who it was given to. The organization has 30 days to respond, at minimal or no cost to you, and silence counts as a refusal you can complain about.
- United Kingdom UK GDPR erasure request template, with a marketing objection Copy the letter below, fill in the [brackets] and send it to the organisation in writing. It asks for your data to be deleted under Article 17 of the UK GDPR and objects to direct marketing under Article 21, which the organisation can't refuse. It normally has one calendar month to reply, and it's free.
- United Kingdom UK subject access request template: a SAR letter you can copy Copy the letter below, fill in the [brackets] and send it to the organisation by email or post. Anyone can make a subject access request (SAR) without a solicitor, it's normally free, and the organisation usually has one month to reply. If you'd rather not write it yourself, the ICO's free SAR service creates and sends the email for you.
General information, not legal advice.
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.