How to Make a Company Delete Your Data in California: CCPA and DROP

What data rights do Californians have under the CCPA?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you several separate requests. Each one does something different, so name the one you want.

Not every company is covered. The best-known test is annual gross revenue above $26,625,000, the figure in effect since 2025; other tests turn on how much personal information a business buys, sells or shares. A small local shop may fall outside the law.

How do you send a CCPA deletion request?

Use one of the methods the business lists in its privacy policy. Businesses must offer two or more ways to submit deletion, correction and access requests, including a toll-free phone number. A business that operates only online and has a direct relationship with you may offer just an email address. Businesses with websites must accept requests through the site.

1. Open the company's privacy policy and find its request methods, often a web form, email address or toll-free number.
2. Submit a request stating that you are a California resident and that you request deletion under Civil Code section 1798.105. Add an opt-out of sale and sharing in the same message if you want both.
3. Give the identifiers the company needs to find you, such as the email on the account, and nothing more.
4. Answer the verification step. The company may ask for authentication that is reasonable for the data involved, but it may not make you create an account to submit a request (if you already have one, it may ask you to use it).
5. Save the confirmation and calendar the 45-day date.
6. If the company announces an extension, note the new date. It may extend once, by 45 days, and must tell you within the first 45.

Opt-out requests move faster. The agency's guidance says businesses must comply as soon as feasibly possible, up to a maximum of 15 business days, and must honor qualifying opt-out preference signals such as Global Privacy Control.

Can a company refuse to delete your data?

Yes, in defined situations. Section 1798.105(d) lets a business keep information when it is reasonably necessary to:

• Complete the transaction, honor a warranty or recall, provide a service you asked for, or otherwise perform a contract with you.
• Help ensure security and integrity, or debug errors.
• Exercise free speech or another legal right.
• Comply with the California Electronic Communications Privacy Act.
• Carry out certain research you consented to.
• Support internal uses reasonably aligned with your expectations given your relationship with the business.
• Comply with a legal obligation.

If the business refuses, ask it in writing which exception it relies on. A vague answer, or silence after 45 days, is a reason for a follow-up letter. The business may also keep a confidential record of your deletion request so that it does not sell your information again.

How do you remove your data from data brokers in California?

Use DROP, the Delete Request and Opt-out Platform run by the California Privacy Protection Agency, which now calls itself CalPrivacy. The Delete Act required the agency to launch it by January 1, 2026, and it may not charge consumers to use it (Civil Code section 1798.99.86).

• One verified request reaches every registered data broker, and you can exclude specific brokers.
• As of October 2026: since August 1, 2026, each registered broker must check DROP at least once every 45 days and process new requests within 45 days.
• If a broker cannot verify you, it must treat the request as an opt-out of sale and sharing.
• Brokers must also direct their service providers and contractors to act on the request. After deleting your data, a broker must repeat the deletion at least every 45 days and may not sell or share new personal information about you, with limited exceptions.
• You can check the status of your request, and change it after 45 days.

DROP covers registered data brokers. For a company you dealt with directly, such as a retailer or app, send that company its own request.

What can you do if a company ignores your request?

File a complaint with CalPrivacy online or on its paper form, or with the California Attorney General. Include the date of your request, how you sent it, and any reply. CalPrivacy says it does not represent individual consumers, but complaints inform its enforcement work.

The CCPA's private lawsuit right covers data breaches caused by unreasonable security, not ignored deletion requests. If your information was exposed in a breach, the steps and the 30-day notice are in responding to a California data breach notice. Robocalls and marketing texts are governed by different laws; see stopping unwanted texts and calls.

When an attorney-written privacy request letter makes sense

You can submit a CCPA request yourself through the company's form. A lawyer's letter becomes useful when a business has ignored repeated requests, demanded identity documents out of proportion to the data, claimed an exception that does not seem to fit, or kept using your information in a way that harmed you, or when the data issue sits inside a larger dispute. For the overall format, see what a demand letter is.

When a business stalls like that, Talk to My Lawyer is one route: a licensed California attorney writes your letter from your request history and the company's replies, cites the CCPA sections that apply, and sends it on your behalf. If you are weighing a legal claim, get advice specific to your situation.