Request letter templates

CCPA request to delete template: a letter for California residents

Quick answer

Copy the letter below, fill in the [brackets] and send it through one of the request methods listed in the company's privacy policy. It asks the business to delete the personal information it collected about you under Civil Code § 1798.105. The business must confirm receipt within 10 business days and answer within 45 calendar days, and it can't charge you for verifying who you are.

“In responding to a request to delete, a business shall inform the consumer whether it has complied with the consumer’s request.”

All privacy laws
Applies in
California, United States
Companies must answer within
Confirm receipt within 10 business days (11 CCR § 7021(a)). Respond within 45 calendar days of receipt, however long verification takes, extendable by another 45 days (90 in total) with notice and an explanation (11 CCR § 7021(b); Civ. Code § 1798.130).
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: privacy.ca.gov, cppa.ca.gov, oag.ca.gov

Last verified against the official page:

How we research this Report an error

California residents. The CCPA applies to for-profit businesses that meet a threshold: more than $26,625,000 in adjusted annual revenue, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing it.

Your rights

  • Right to delete

    Ask a business to delete personal information it collected from you, subject to exceptions such as completing a transaction, security or a legal obligation (Civ. Code § 1798.105).

  • A reasoned answer if refused

    A business that denies a request must explain the basis in detail, delete what the exception doesn't cover, and use what it keeps only for that exception (11 CCR § 7022(f)).

  • Notice down the chain

    The business must tell its service providers and contractors to delete your information, and notify third parties it sold or shared it with unless that's impossible or takes disproportionate effort, which it then has to explain (11 CCR § 7022(b)).

  • Right to opt out of sale or sharing

    If a business that sells or shares data denies deletion, and you haven't already opted out, it has to ask whether you want to opt out of the sale or sharing of your information (11 CCR § 7022(g)).

General information, not legal advice.

How to use it

  1. 1

    Find the designated request method

    Look in the company's privacy policy, often linked as Privacy or California Privacy Rights. Businesses must offer at least two methods, including a toll-free number; a business that operates only online may offer just an email address. The designated method can be different from normal customer service. If you already have an account, the business may ask you to submit through it, but it can't make you create one.

  2. 2

    Send the request and keep proof

    Paste the letter into the web form or email, and save a screenshot or the sent email. If you use a channel that isn't designated, or the request is missing something, the business must either treat it as valid or tell you how to fix it (11 CCR § 7020(f)). If a designated method doesn't work, tell the business in writing and try another one.

  3. 3

    Expect a receipt within 10 business days

    The confirmation should describe how the business will verify you and when you can expect an answer. The 45-day clock runs from when it received your request.

  4. 4

    Complete verification

    Ideally the business matches the details you gave against what it already holds. Deletion can need a reasonable or reasonably high degree of certainty, depending on how sensitive the data is, and account holders may be asked to log in again. Verification is free: a business that wants a notarized affidavit has to pay for it.

  5. 5

    Follow up, then complain

    If the deadline passes, check you used a designated method and follow up in writing. Then file a complaint with CalPrivacy or the Attorney General. Our CCPA page explains what each one handles.

No answer in time? Complain to California Privacy Protection Agency (CalPrivacy) and the California Attorney General .

The letter

Fill in the parts in [brackets] before you send it.

Subject: Request to delete my personal information under the CCPA

[Your full name]
[Your email address and phone number]
[Your mailing address, if the business has it]
[Date]

To: [Business name], privacy team
[The designated request method from the privacy policy: web form, email address or mailing address]

Dear [Business name] privacy team,

I am a California resident. Under the California Consumer Privacy Act (Civil Code section 1798.105), I am asking you to delete the personal information you have collected about me.

To help you find my records, these are details you already hold:
- Name(s) I have used with you: [current and any previous names]
- Email address(es) and phone number(s): [list]
- Account, customer or order number: [number, if any]

Please also:
1. tell your service providers and contractors to delete my personal information, and notify any third parties to whom you sold or shared it;
2. confirm in writing whether you have complied with this request.

If you deny any part of this request, please explain in detail the basis for the denial, delete the personal information that is not covered by the exception, and do not use the information you keep for any other purpose.

[Optional, delete if you don't want it: In addition, and in particular if any part of this deletion request is denied, I ask you not to sell or share my personal information (Civil Code section 1798.120).]

Please confirm receipt within 10 business days and respond within 45 calendar days, as the CCPA regulations require. If you need to verify my identity, please do so by matching the details above to the records you already hold.

[If an authorized agent is sending this: This request is sent on my behalf by [agent name], my authorized agent. My signed permission is attached.]

Sincerely,

[Your name]

What the letter asks for, and why

The identifying details are there so the business can match you to records it already has. The CCPA regulations push businesses to verify that way where they can, and to avoid collecting extra sensitive data such as ID numbers unless it's really needed. Give only what helps it find you. Don't attach a driver license unless the business asks for it.

The paragraph on service providers and third parties matters because your data may have been passed on. The regulations require the business to pass your request down the chain, and to explain itself if it says notifying a third party is impossible.

The refusal paragraph asks for what the business already owes you if it says no: a detailed reason, deletion of everything the exception doesn't cover, and no other use of what it keeps. Putting it in writing makes a vague refusal easier to challenge.

The opt-out line is optional. Keep it if you want a fallback in case the deletion is denied.

Data brokers: use DROP instead

For data brokers, you don't need a letter per company. California's free DROP tool sends one deletion request to every registered data broker. Our Delete Act and DROP guide walks through it. Use this letter for the businesses you deal with directly, like stores, apps and services. If you only want a company to stop selling your data, the Do Not Sell or Share template is shorter and needs no verification.

Where Serus fits

This letter is the right tool for one company you've used. DROP covers registered brokers. What's left is the people-search sites outside the registry and the listings that come back months later. Serus finds the ones that list you where you live, sends the removal requests, follows up and checks for relistings. Run a free scan to see where you're listed.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Frequently asked

Why might a business refuse to delete my data?

Common reasons: it can't verify you, it needs the data to complete a transaction or provide a service, for security, or to meet a legal obligation, or the data is exempt, such as publicly available information, certain medical information or credit reporting data.

Can a business make me get a notarized affidavit?

Not at your expense. If it requires one, it has to pay for or reimburse the notarization.

Can it offer to delete only some of my data?

It can offer choices, but it must also offer a single option to delete all of your personal information.

What if a service provider says it can't act on my request?

Send the request to the business itself. Service providers can deny requests sent directly to them.

Does the CCPA apply to every company?

No. Only for-profit businesses that meet a threshold: more than $26,625,000 in adjusted annual revenue, 100,000 or more consumers or households, or 50% or more of revenue from selling or sharing personal information.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.