Laws
CCPA: how to delete, see and stop the sale of your data in California
Quick answer
The California Consumer Privacy Act (CCPA) lets California residents ask a covered business to show them the personal information it holds, delete it, correct it, and stop selling or sharing it. You send the request through one of the methods in the company's privacy policy, and the company has 45 calendar days to answer, or 90 if it tells you it needs an extension. It's free, and the company can't treat you worse for asking.
All privacy laws“A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.”
- Applies in
- California
- In force since
- Companies must answer within
- 45 calendar days from receiving a verifiable request. A business can extend once by another 45 days (90 in total) when reasonably necessary, if it tells you within the first 45 days (Civ. Code § 1798.130).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: cppa.ca.gov, oag.ca.gov, privacy.ca.gov
Last verified against the official page:
California residents. The law applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue over $25,000,000 as adjusted ($26,625,000 from January 1, 2025, according to CalPrivacy); buying, selling or sharing the personal information of 100,000 or more consumers or households; or earning 50% or more of annual revenue from selling or sharing consumers' personal information. It generally doesn't apply to nonprofits or government agencies.
Your rights
-
Right to know and access
Ask a business which categories of your personal information it collected, where it got them, why it collected, sold or shared them, and for the specific pieces of information it holds (Civ. Code §§ 1798.110, 1798.115).
-
Right to delete
Ask a business to delete the personal information it collected from you. It must also pass the request on to the service providers, contractors and third parties it sold or shared the data with, subject to exceptions (Civ. Code § 1798.105).
-
Right to correct
Ask a business to fix personal information about you that's wrong. It must use commercially reasonable efforts to correct it (Civ. Code § 1798.106).
-
Right to opt out of sale or sharing
Tell a business that sells or shares your personal information to stop, at any time. Selling the data of consumers under 16 needs their opt-in consent instead (Civ. Code § 1798.120).
-
Right to limit use of sensitive personal information
Direct a business to use your sensitive personal information only for what's needed to provide the goods or services you'd expect from it (Civ. Code § 1798.121).
-
Right to non-discrimination
A business can't deny you goods or services, charge you a different price or give you worse service because you used your rights (Civ. Code § 1798.125).
General information, not legal advice.
How to use it
- 1
Find the company's request methods
Open the company's privacy policy and look for how to submit privacy requests. Businesses must offer at least two methods, including a toll-free phone number. A business that operates only online and has a direct relationship with you may offer just an email address.
- 2
Send your request
Say which right you're using: know, delete, correct, opt out or limit. For opt-outs you can also use the company's Do Not Sell or Share link, or turn on Global Privacy Control (GPC) in your browser. Covered businesses must honor the GPC signal as a valid request to stop selling or sharing your information.
- 3
Verify your identity
For requests to know, delete or correct, the business must confirm the request really comes from you. It has to start that check promptly, and the check doesn't extend its 45-day deadline.
- 4
Use an authorized agent if you want
You can authorize another person to send a CCPA request for you. The business may ask for proof that you gave permission.
- 5
Wait up to 45 days
The business must answer within 45 calendar days, or 90 if it tells you within the first 45 that it needs an extension. Note the date you sent the request.
- 6
Follow up, then complain
If you hear nothing, check that you used one of the methods the company lists, then follow up in writing. If the business still doesn't comply, file a complaint with CalPrivacy or the California Attorney General.
No answer in time? Complain to California Privacy Protection Agency (CalPrivacy); California Attorney General .
Who the CCPA covers
The CCPA protects California residents. It took effect on January 1, 2020, and the California Privacy Rights Act (Proposition 24, approved in November 2020) added more rights from January 1, 2023.
It only binds bigger or data-heavy companies. A for-profit business that does business in California is covered if it meets one of three tests: revenue over $25,000,000 a year as adjusted (CalPrivacy lists $26,625,000 from January 1, 2025, while the Attorney General's FAQ still says $25 million), handling the personal information of 100,000 or more consumers or households, or making half its revenue or more from selling or sharing personal information. Nonprofits and government agencies generally fall outside it.
Why a company can say no
The right to delete has exceptions. A business can keep information it reasonably needs for purposes the law lists, such as completing a transaction you asked for or keeping its systems secure (Civil Code 1798.105(d)), and some data is exempt from the CCPA altogether (Civil Code 1798.145). Two big ones:
- Credit reports. Information handled by consumer reporting agencies and the companies that furnish or use their reports is exempt to the extent the federal Fair Credit Reporting Act (FCRA) regulates it.
- Financial data. Personal information collected under the federal Gramm-Leach-Bliley Act (GLBA), which covers banks and other financial institutions, or California's Financial Information Privacy Act.
The right to delete also only covers data the business collected from you. Data brokers that bought your information elsewhere are better handled through DROP under the Delete Act, and the right to opt out of sale or sharing applies to any covered business that sells or shares data about you.
If a company ignores you or says no
First make sure you used a method the company designates, and follow up in writing with the date of your original request. If the business still doesn't comply, you have two places to complain:
- CalPrivacy: file online through its complaint form. CalPrivacy also accepts paper complaint forms by mail.
- The Attorney General: use the consumer complaint form.
The Attorney General doesn't act as your lawyer and doesn't give legal advice on individual complaints.
CCPA requests and DROP
A CCPA request goes to one business at a time. DROP, the free tool created by the separate Delete Act, sends one deletion request to all registered data brokers at once. Use DROP for brokers and the CCPA for companies you deal with directly. Sending CCPA requests to dozens of companies, then tracking 45-day deadlines and chasing the ones that go quiet, is the slow part. Serus does that work for you on the data broker side: it finds the brokers and people-search sites that list you where you live, sends the removal requests and follows up.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
How long does a business have to answer a CCPA request?
45 calendar days. It can extend once by another 45 days, for 90 in total, if it tells you within the first 45 days.
Can someone submit a CCPA request for me?
Yes. You can authorize another person to submit a request on your behalf. The business may ask for proof that you gave them permission.
Does the CCPA apply to every company?
No. It covers for-profit businesses that do business in California and have more than $26,625,000 in annual revenue (the adjusted figure CalPrivacy lists), handle data on 100,000 or more consumers or households, or earn half their revenue or more from selling or sharing personal information. It generally doesn't apply to nonprofits or government agencies.
Do I have to pay to make a CCPA request?
No. A business must disclose your information, correct it or delete it free of charge.
Where do I complain about a CCPA violation?
File online with CalPrivacy at cppa.ca.gov/webapplications/complaint, by mail on CalPrivacy's paper form, or with the California Attorney General's consumer complaint form. The Attorney General doesn't represent individual consumers.
How is a CCPA request different from DROP?
A CCPA request goes to one business at a time. DROP, created by the separate Delete Act, sends one deletion request to all registered data brokers at once, for free.
Sources
- cppa.ca.gov/regulations/pdf/cppa_act.pdf
- oag.ca.gov/privacy/ccpa
- oag.ca.gov/contact/consumer-complaint-against-business-or-company
- privacy.ca.gov/laws-and-regulations/monetary-thresholds-in-the-ccpa/
- cppa.ca.gov/webapplications/complaint
- privacy.ca.gov/submit-a-complaint/ccpa-complaints/
- privacy.ca.gov/drop/
Something wrong or out of date? Tell us and we'll re-check it.