Your rights · United States
The CCPA “right to be forgotten” is the right to delete
California has no right to be forgotten. It has a right to delete. Under the CCPA (Civil Code §1798.105) a covered business must delete the personal information it collected from you, tell its service providers to do the same, and answer within 45 days. What it does not give you is the European right to have search results de-listed — that idea has no US equivalent. Here is what the right to delete actually covers, what a business can refuse, and the letter to send.
What the right to delete gives you
Deletion of what they collected from you
A covered business must delete the personal information it collected from you, and tell its service providers and contractors to delete it too. Since the CPRA amendments it must also notify third parties it sold or shared your information to, unless that is impossible or involves disproportionate effort.
45 days, extendable once
The business has 45 calendar days from receiving a verifiable request. It can extend by a further 45 days if it tells you why within the first window. Under the CCPA regulations it should confirm receipt within 10 business days.
No fee, no lawyer
A deletion request is free. A business may need to verify you are who you say you are — a matching email address is usually enough — but cannot make you create an account to ask.
Someone can ask for you
You may authorise another person or a service to submit the request on your behalf. The business can ask for proof of that authorisation.
Who it applies to
You must be a California resident. The business must be a for-profit company doing business in California that meets any one of three thresholds: annual gross revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning half or more of its revenue from selling or sharing personal information. Most data brokers and people-search sites clear at least one.
Data brokers must also register with the California Privacy Protection Agency, and registered brokers can be reached all at once through DROP under the Delete Act — how DROP works and where it stops.
What a business can refuse
The statute lists the exceptions. A business relying on one has to tell you which. Outside this list, “we need it” is not an answer.
- Completing a transaction you asked for, or providing a service you are still using.
- Detecting security incidents, fraud or other illegal activity.
- Debugging to repair errors in its systems.
- Exercising free speech, or another consumer’s free-speech rights.
- Complying with the California Electronic Communications Privacy Act.
- Public or peer-reviewed research in the public interest, with your consent.
- Internal uses reasonably aligned with what you would expect, given your relationship with the business.
- Complying with a legal obligation.
The bigger gap is definitional. Information that is “publicly available” — an address in county property records, a court filing, a professional licence — falls outside the CCPA's definition of personal information. People-search sites are built on exactly that, so a deletion request can succeed on paper and leave the profile standing. For those sites the broker's own opt-out is usually the route that works.
The letter
United States · CCPA §1798.105
Most covered businesses publish a “Your Privacy Choices” or CCPA request form — using it is fine and often faster. The letter works where there is none, or where the form only offers an opt-out of sale rather than deletion.
Subject: CCPA request to delete — [Your full name] To whom it may concern, As a California resident, I am exercising my right to delete under Section 1798.105 of the California Consumer Privacy Act (CCPA), as amended by the CPRA. Please delete all personal information you have collected about me, and direct any service providers, contractors and third parties to whom you have sold or shared it to do the same, as the statute requires. Identifying details to locate my records: - Full name: [Your full name] - Email address(es): [Email addresses the business may hold] - Phone number: [Phone number, if relevant] - Postal address: [Your address, if relevant] Please confirm receipt within 10 business days and complete the deletion within 45 days of receiving this request. If you rely on an exception to retain any of my information, identify the exception and the information it covers. Regards, [Your full name] [Date]
If they refuse or ignore you
Write to the business once more, keep dated copies, then complain to the California Privacy Protection Agency or the Attorney General. Under the CCPA only those agencies can enforce a refused deletion — the private right to sue covers data breaches only. How to report a company walks through the routes. Not in California? The UK and EU equivalent is GDPR Article 17: the right to erasure template.
One request clears one business
Your details sit with hundreds of brokers, and each one needs its own request, its own chase and its own check. BLACKEYES sends the deletion and erasure requests under the CCPA and UK GDPR as appropriate for each company, tracks every reply to its deadline, and shows you the company's actual answer. See where your data is first — free.
Run my free exposure checkFAQ
Does the CCPA have a right to be forgotten?
Not by that name, and not in the European sense. The “right to be forgotten” comes from a 2014 EU court ruling about de-listing search results, later written into GDPR Article 17 as the right to erasure. California’s CCPA gives you a right to delete (Civil Code §1798.105): a covered business must delete the personal information it collected from you and tell its service providers to do the same. It does not give you a way to make search engines de-list results about you.
How long does a CCPA deletion request take?
A business has 45 calendar days from receiving a verifiable request, and can extend by a further 45 days if it tells you why within the first period. It should confirm receipt within 10 business days. Most large businesses answer through a “Your Privacy Choices” or CCPA request form, which is often faster than email.
Can a business refuse to delete my data under the CCPA?
Yes, in listed situations: to complete a transaction, for security and fraud detection, to fix errors, for free speech, for certain research, for internal uses you would reasonably expect, or to comply with a legal obligation. It must tell you which exception it relies on. Information that is “publicly available” — such as an address in county property records — is outside the CCPA’s definition of personal information, which is the biggest gap for people-search sites.
Does the right to delete reach data brokers?
One business at a time, yes. Data brokers that meet the thresholds are covered, but each needs its own request. California’s Delete Act adds a second route for registered brokers specifically: one request through the state’s DROP platform reaches every broker on the registry at once.
What if I don’t live in California?
The CCPA’s rights belong to California residents. Virginia, Colorado, Connecticut, Texas and a growing list of other states have their own deletion rights with similar shapes and different deadlines. In the UK and EU, GDPR Article 17 applies — with a one-calendar-month deadline and an absolute objection to direct marketing.
What can I do if a business ignores me?
Complain in writing to the business once and keep dated copies, then file a complaint with the California Privacy Protection Agency or the Attorney General. Under the CCPA only those agencies can take enforcement action for a refused deletion; the private right to sue is limited to data breaches.