How to request data deletion in California

California gives residents two separate deletion tools. The Delete Act created the Delete Request and Opt-out Platform (DROP), a state-run website that passes one request to every registered data broker, meaning businesses that sell information about you that you did not give them directly. The California Consumer Privacy Act (CCPA) covers businesses you deal with yourself, and you contact each of those individually.

As of 4 October 2026, DROP is open and in its processing phase. It launched on 1 January 2026, and data brokers have been legally required to process requests since 1 August 2026. The state says DROP reaches more than 600 data brokers.

1. 1.Go to privacy.ca.gov/drop and start a request.
2. 2.Verify that you are a California resident through the California Identity Gateway. The state says this confirms residency without creating an account or storing your personal information.
3. 3.Create your profile. Name, date of birth and ZIP code are required. Email addresses, phone numbers, former names and identifiers such as a mobile advertising ID are optional.
4. 4.Review and submit. You receive an 8-digit DROP ID, which you use to check your status.
5. 5.Check back. Brokers have up to 90 days to report how they processed your request, and must then re-check and delete new matching data at least every 45 days.

Each broker reports a status. "Deleted" means it matched you and deleted your non-exempt information. "Exempted" means the law allows it to keep all of what it holds. "Opted-out" means it could not make an exact match. "Record not found" and "Pending" mean what they say.

1. 1.Check that the CCPA applies. It covers for-profit businesses that do business in California and have over $25 million in gross annual revenue, or buy, sell or share the personal information of 100,000 or more California residents or households, or earn half or more of their revenue from selling residents' personal information.
2. 2.Find the request method in the business's privacy policy. A business must offer at least two methods, and cannot make you create an account just to submit a deletion request.
3. 3.State that you are a California resident requesting deletion under the CCPA, and give enough detail to be matched, such as your name, email and account number.
4. 4.Complete identity verification if asked. Businesses must verify that the requester is the person the information is about.
5. 5.Save a copy with the date. The business must confirm receipt within 10 business days and respond within 45 calendar days. It may extend by another 45 days if it tells you.

You may authorize another person or a service to submit a CCPA request for you. The Attorney General's guidance says the business may ask for proof that you gave that agent signed permission. The Delete Act also says DROP must support a consumer's authorized agents.

Neither route is absolute. Under Civil Code section 1798.105, the CCPA right covers personal information the business collected from you, and a business may keep what it reasonably needs to complete a transaction, maintain security, fix errors or comply with a legal obligation, among other listed exceptions. The Attorney General also notes that personal information does not include publicly available information, such as an address found in public property records.

For DROP, the state's guidance says data brokers are not required to delete publicly available data, data covered by a statutory exemption, or data you gave a business directly.

First check that you used the method named in the privacy policy, then follow up in writing. If the deadline passes or the refusal does not match an exception, you can file a complaint with the California Privacy Protection Agency or with the Attorney General. The Attorney General states that individuals cannot sue businesses for most CCPA violations; lawsuits are limited to certain data breaches. This guide is general information, not legal advice.