Remove your data where you live

What to do when a company won't delete your account

Quick answer

Make a formal deletion request in writing under the privacy law that covers you, through the company's official privacy channel, and keep proof. A support agent saying no, or a missing delete button, doesn't end your rights. If the company refuses or goes quiet, appeal where your law allows it (Texas and Oregon), then complain to your regulator. Bring copies of everything.

“You have joined a social networking site. After a while, you decide to leave the networking site. You have the right to ask the company to delete the personal data belonging to you.”

All privacy laws
Applies in
United States, UK, EU, Canada and Australia
Companies must answer within
California (CCPA): confirm within 10 business days and respond within 45 days, plus 45 with notice. Texas: 45 days, plus 45, and appeals answered within 60 days. Oregon: appeals answered within 45 days. UK and EU: one month, plus two with notice. Canada (PIPEDA access): 30 days, plus 30. Australia: a reasonable period, which the OAIC considers to be 30 days.
Regulator
Depends on where you live: CalPrivacy or the California Attorney General; the Texas Attorney General; the Oregon Department of Justice; the ICO (UK); your national data protection authority (EU); the OPC (Canada); the OAIC (Australia)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: privacy.ca.gov, cppa.ca.gov, oag.ca.gov

Last verified against the official page:

How we research this Report an error

Residents of California, Texas and Oregon, and people in the UK, the EU, Canada and Australia. In US states without a consumer privacy law, there may be no general legal right to deletion, so the company's own policy is what you have.

How to use it

  1. 1

    Use the account's own deletion option, and record it

    Try the delete option in the app or on the website first. Screenshot every form before you submit it. Keep the emails. If it works, you're done. If it fails, or support tells you accounts can't be deleted, you have a paper trail for the next step.

  2. 2

    Send a formal written deletion request

    Use the request method in the company's privacy policy, not the general support chat, and name the law and the right you're using. Copy-ready letters:

    If you're not sure what the company holds, an access request comes first: the UK SAR template or the GDPR SAR template.

  3. 3

    California: push back on friction

    Under the CCPA, businesses must offer at least two request methods, including a toll-free number (or just an email address if they operate only online), and the methods have to be easy to use and tested to work. If you sent your request through the wrong channel or it was incomplete, the business must treat it as valid or tell you how to fix it (11 CCR § 7020(f)).

    Broken links the business knows about and doesn't fix, request inboxes nobody reads, needless waiting and duplicate forms may be unlawful dark patterns under 11 CCR § 7004. A business can't make you create an account to delete your data, though if you already have one it may ask you to use it. If a method doesn't work, tell the business in writing and use another designated method.

  4. 4

    California: if refused, ask for the reasons and an opt-out

    A refusal must explain the basis in detail. The business must still delete everything the exception doesn't cover, use what it keeps only for that exception, and, if it sells or shares data, ask whether you want to opt out of that instead (11 CCR § 7022(f)-(g)). Reply in writing and ask for anything it left out.

  5. 5

    Texas or Oregon: file an appeal

    Both states give you a formal appeal before you go to the Attorney General. In Texas, the company must answer your appeal in writing within 60 days and, if it denies it, tell you how to complain to the Attorney General. In Oregon, the business must respond within 45 days of receiving your appeal, according to the Oregon Department of Justice. Use the appeal process the company describes in its privacy notice.

  6. 6

    UK and EU: rely on Article 17

    Leaving a social network is the European Commission's own example of when you can ask for deletion. If the company won't act, it must tell you why within one month and tell you about your right to complain and to go to court (Article 12(4)). In the UK, make a data protection complaint to the organisation first; it must acknowledge it within 30 days. Our UK GDPR and GDPR pages cover both.

  7. 7

    Canada: withdraw consent and challenge compliance

    PIPEDA has no standalone erasure right, but you can withdraw your consent (Schedule 1, clause 4.3.8) and point out that information no longer needed should be destroyed, erased or made anonymous (clause 4.5.3). Raise a challenge with the person accountable for privacy at the company (clause 4.10), then complain to the OPC.

  8. 8

    Australia: ask for destruction or de-identification

    If the organisation no longer needs your information and no law requires it to keep it, it must take reasonable steps to destroy or de-identify it (APP 11.2). A correction request can also include deleting information. Complain to the organisation first, then to the OAIC if there's no answer after 30 days. Our Privacy Act page has the details.

  9. 9

    Escalate to the regulator

    Send your original request and every reply, with dates. Where to go:

No answer in time? Complain to Depends on where you live: CalPrivacy or the California Attorney General; the Texas Attorney General; the Oregon Department of Justice; the ICO (UK); your national data protection authority (EU); the OPC (Canada); the OAIC (Australia) .

Why support says no

A support agent may not be able to delete accounts, and a missing delete button is a design choice, not a legal answer. What counts is a request through the company's privacy channel, under a named law. In California, staff on a toll-free request line must be able to process CCPA requests, so "we can't do that here" isn't a valid reply there.

When keeping some data is allowed

Companies can often keep part of your data, for example to meet a legal obligation or finish a transaction. That's not a refusal. Under the CCPA the business has to name the specific basis and delete the rest. Under the GDPR and UK GDPR it has to give reasons within a month. A vague "we need to keep your data" is something to push back on in writing.

If your state has no privacy law

There may be no general legal right to deletion, so the company's own policy is what you can rely on. Use its process and keep records. Say clearly that you want the account and its data deleted, not just deactivated. California residents can also use DROP to send one deletion request to every registered data broker, which is a separate problem from the account itself.

Where Serus fits

A stubborn company with your account is a one-off fight, and the letters above are the right tool. The bigger, quieter spread of your details sits with data brokers and people-search sites you never signed up for. Serus finds the ones that list you where you live, sends the removal requests, follows up and checks for relistings. Run a free scan to see where you're listed.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

The company says it must keep some data. Is that allowed?

Often, yes, for example for legal obligations, security or completing a transaction. Under the CCPA it must explain the specific basis and delete the rest.

Can a California business make me create an account just to delete my data?

No. But if you already have an account, it may require you to submit the request through it.

Support says they can't delete accounts. What now?

In California, staff handling a toll-free request line must be able to process CCPA requests. Send a written request through a designated method, then complain if it's ignored.

Can a UK company refuse to delete my data?

Only if an exemption applies, and it must still respond and explain.

What if I'm in a US state without a privacy law?

There may be no general legal right to deletion, so rely on the company's own policy. California residents can also use DROP to send one deletion request to every registered data broker.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.