Request letter templates
CCPA request to delete template: a letter for California residents
Quick answer
Copy the letter below, fill in the [brackets] and send it through one of the request methods listed in the company's privacy policy. It asks the business to delete the personal information it collected about you under Civil Code § 1798.105. The business must confirm receipt within 10 business days and answer within 45 calendar days, and it can't charge you for verifying who you are.
All privacy laws“In responding to a request to delete, a business shall inform the consumer whether it has complied with the consumer’s request.”
- Applies in
- California, United States
- Companies must answer within
- Confirm receipt within 10 business days (11 CCR § 7021(a)). Respond within 45 calendar days of receipt, however long verification takes, extendable by another 45 days (90 in total) with notice and an explanation (11 CCR § 7021(b); Civ. Code § 1798.130).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: privacy.ca.gov, cppa.ca.gov, oag.ca.gov
Last verified against the official page:
California residents. The CCPA applies to for-profit businesses that meet a threshold: more than $26,625,000 in adjusted annual revenue, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing it.
Your rights
-
Right to delete
Ask a business to delete personal information it collected from you, subject to exceptions such as completing a transaction, security or a legal obligation (Civ. Code § 1798.105).
-
A reasoned answer if refused
A business that denies a request must explain the basis in detail, delete what the exception doesn't cover, and use what it keeps only for that exception (11 CCR § 7022(f)).
-
Notice down the chain
The business must tell its service providers and contractors to delete your information, and notify third parties it sold or shared it with unless that's impossible or takes disproportionate effort, which it then has to explain (11 CCR § 7022(b)).
-
Right to opt out of sale or sharing
If a business that sells or shares data denies deletion, and you haven't already opted out, it has to ask whether you want to opt out of the sale or sharing of your information (11 CCR § 7022(g)).
General information, not legal advice.
How to use it
- 1
Find the designated request method
Look in the company's privacy policy, often linked as Privacy or California Privacy Rights. Businesses must offer at least two methods, including a toll-free number; a business that operates only online may offer just an email address. The designated method can be different from normal customer service. If you already have an account, the business may ask you to submit through it, but it can't make you create one.
- 2
Send the request and keep proof
Paste the letter into the web form or email, and save a screenshot or the sent email. If you use a channel that isn't designated, or the request is missing something, the business must either treat it as valid or tell you how to fix it (11 CCR § 7020(f)). If a designated method doesn't work, tell the business in writing and try another one.
- 3
Expect a receipt within 10 business days
The confirmation should describe how the business will verify you and when you can expect an answer. The 45-day clock runs from when it received your request.
- 4
Complete verification
Ideally the business matches the details you gave against what it already holds. Deletion can need a reasonable or reasonably high degree of certainty, depending on how sensitive the data is, and account holders may be asked to log in again. Verification is free: a business that wants a notarized affidavit has to pay for it.
- 5
Follow up, then complain
If the deadline passes, check you used a designated method and follow up in writing. Then file a complaint with CalPrivacy or the Attorney General. Our CCPA page explains what each one handles.
No answer in time? Complain to California Privacy Protection Agency (CalPrivacy) and the California Attorney General .
The letter
Fill in the parts in [brackets] before you send it.
Subject: Request to delete my personal information under the CCPA [Your full name] [Your email address and phone number] [Your mailing address, if the business has it] [Date] To: [Business name], privacy team [The designated request method from the privacy policy: web form, email address or mailing address] Dear [Business name] privacy team, I am a California resident. Under the California Consumer Privacy Act (Civil Code section 1798.105), I am asking you to delete the personal information you have collected about me. To help you find my records, these are details you already hold: - Name(s) I have used with you: [current and any previous names] - Email address(es) and phone number(s): [list] - Account, customer or order number: [number, if any] Please also: 1. tell your service providers and contractors to delete my personal information, and notify any third parties to whom you sold or shared it; 2. confirm in writing whether you have complied with this request. If you deny any part of this request, please explain in detail the basis for the denial, delete the personal information that is not covered by the exception, and do not use the information you keep for any other purpose. [Optional, delete if you don't want it: In addition, and in particular if any part of this deletion request is denied, I ask you not to sell or share my personal information (Civil Code section 1798.120).] Please confirm receipt within 10 business days and respond within 45 calendar days, as the CCPA regulations require. If you need to verify my identity, please do so by matching the details above to the records you already hold. [If an authorized agent is sending this: This request is sent on my behalf by [agent name], my authorized agent. My signed permission is attached.] Sincerely, [Your name]
What the letter asks for, and why
The identifying details are there so the business can match you to records it already has. The CCPA regulations push businesses to verify that way where they can, and to avoid collecting extra sensitive data such as ID numbers unless it's really needed. Give only what helps it find you. Don't attach a driver license unless the business asks for it.
The paragraph on service providers and third parties matters because your data may have been passed on. The regulations require the business to pass your request down the chain, and to explain itself if it says notifying a third party is impossible.
The refusal paragraph asks for what the business already owes you if it says no: a detailed reason, deletion of everything the exception doesn't cover, and no other use of what it keeps. Putting it in writing makes a vague refusal easier to challenge.
The opt-out line is optional. Keep it if you want a fallback in case the deletion is denied.
Data brokers: use DROP instead
For data brokers, you don't need a letter per company. California's free DROP tool sends one deletion request to every registered data broker. Our Delete Act and DROP guide walks through it. Use this letter for the businesses you deal with directly, like stores, apps and services. If you only want a company to stop selling your data, the Do Not Sell or Share template is shorter and needs no verification.
Where Serus fits
This letter is the right tool for one company you've used. DROP covers registered brokers. What's left is the people-search sites outside the registry and the listings that come back months later. Serus finds the ones that list you where you live, sends the removal requests, follows up and checks for relistings. Run a free scan to see where you're listed.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Why might a business refuse to delete my data?
Common reasons: it can't verify you, it needs the data to complete a transaction or provide a service, for security, or to meet a legal obligation, or the data is exempt, such as publicly available information, certain medical information or credit reporting data.
Can a business make me get a notarized affidavit?
Not at your expense. If it requires one, it has to pay for or reimburse the notarization.
Can it offer to delete only some of my data?
It can offer choices, but it must also offer a single option to delete all of your personal information.
What if a service provider says it can't act on my request?
Send the request to the business itself. Service providers can deny requests sent directly to them.
Does the CCPA apply to every company?
No. Only for-profit businesses that meet a threshold: more than $26,625,000 in adjusted annual revenue, 100,000 or more consumers or households, or 50% or more of revenue from selling or sharing personal information.
Sources
- privacy.ca.gov/wp-content/uploads/sites/357/2026/03/ccpa_regulations_eff_20260101-1.pdf
- cppa.ca.gov/regulations/pdf/cppa_act.pdf
- oag.ca.gov/privacy/ccpa
- privacy.ca.gov/laws-and-regulations/monetary-thresholds-in-the-ccpa/
- oag.ca.gov/contact/consumer-complaint-against-business-or-company
- cppa.ca.gov/webapplications/complaint
- privacy.ca.gov/submit-a-complaint/ccpa-complaints/
- privacy.ca.gov/drop/
Something wrong or out of date? Tell us and we'll re-check it.