# CCPA Data Deletion Request: State Laws Compared

A CCPA data deletion request is one of several state rights. Compare six state laws, what each lets a business keep, and how to escalate a refusal.

---


A CCPA data deletion request is a written ask, sent through the channel a business designates, for it to delete the personal information it collected from you. California's privacy agency says the business must substantively respond within 45 calendar days, and several other states give their residents a comparable right under their own laws, with their own deadlines and appeal steps.

The right is narrower than its name suggests. It is a right against a business that holds your data, not against a newspaper, a court site or a stranger's blog, and every one of these laws lets the business keep some information. The useful skill is knowing which law covers you, what the business may lawfully keep, and what to do on day 46 if you have heard nothing.

This guide reads the official pages of six states: California, Colorado, Connecticut, Virginia, Texas and Oregon. Where a page did not state something, the guide says so rather than filling the gap. It is information, not legal advice: your own attorney in your state decides what applies to you.

<div class="box"><b>The short version</b>
<ul><li>Your residence decides the law. California, Colorado, Connecticut, Virginia, Texas and Oregon each give residents a right to ask a business to delete personal data, with different coverage thresholds.</li><li>Five of the six regulator pages read for this guide set a 45 day response clock, extendable once by 45 days if the business tells you why. The Oregon page read did not state a clock.</li><li>Every law lets the business keep some data: legal obligations, security, completing a transaction and exempt categories. A partial deletion is common and is not automatically a violation.</li><li>A refusal has a next step: an appeal in Connecticut, Virginia and Texas, and a complaint to the state regulator in each of the six.</li><li>None of this deletes what others published about you. For that, you need a different route.</li></ul></div>

<figure class="keyfacts">
<div class="keyfacts-grid">
<div><b>45 days</b><span>the response window in California, Colorado, Connecticut, Virginia and Texas, plus one extension of 45</span></div>
<div><b>10 business days</b><span>California's deadline to confirm that a request was received</span></div>
<div><b>60 days</b><span>how long a controller has to answer an appeal in Connecticut and Virginia</span></div>
</div>
<p class="fig-src">California Privacy Protection Agency FAQ, California Attorney General CCPA page, Colorado Attorney General Colorado Privacy Act page, Connecticut Attorney General CTDPA page, Virginia Code section 59.1-577 and Texas Attorney General privacy page, each as read for this guide.</p>
</figure>

## Which state law covers you depends on where you live, not where the business sits

The law that applies is the one for your state of residence, and it covers a business that operates in or targets that state and passes a size threshold. A company headquartered elsewhere is still covered, so the company's location tells you nothing about your rights.

Residence matters in a second way. California's agency says a California resident is a person, not a business, and includes employees, job applicants and business contacts. Colorado's page defines a consumer as a Colorado resident acting only in an individual or household context, which excludes people acting in a commercial or employment context and job applicants. A request tied to your job is therefore treated differently by state.

Size thresholds then decide whether a business is covered at all. The regulators' pages give these:

- **California.** The law covers for-profit businesses that do business in the state and meet size or data-handling tests set in the statute: an annual revenue figure, the volume of residents' data bought, sold or shared, or the share of revenue from selling or sharing personal information. The exact figures are adjusted over time and the Attorney General page could not be re-read for this guide, so check the current numbers there before relying on them.
- **Colorado.** Business in Colorado or aimed at Colorado residents, plus either processing the data of more than 100,000 individuals in a year, or revenue or discounts from selling the data of 25,000 or more.
- **Connecticut.** At least 35,000 consumers' data controlled or processed (payment-only processing excluded), or sensitive data processed, or personal data offered for sale. Consumer health data controllers are covered regardless of size.
- **Texas.** The page read gives no size threshold. It says small businesses, as the federal Small Business Administration defines them, are generally exempt, though a small business that sells a consumer's sensitive data must first get consent.

The Virginia and Oregon pages read for this guide gave no comparable threshold list, so check the statute before you assume a small company is in scope. In practice a local shop with a mailing list is often outside these laws, while a national retailer or an app usually is inside them.

## Six state deletion rights side by side

The table sorts what each regulator page says about the deletion right itself. A blank in the guide means the page read did not say, not that the law is silent.

<div class="tablewrap"><table><thead><tr><th>State</th><th>What deletion reaches, per the page</th><th>If the business refuses</th><th>Who enforces</th></tr></thead><tbody>
<tr><td><strong>California</strong></td><td>Personal information the business collected from you, and a duty to tell its service providers</td><td>Complaint to the Attorney General; the page does not describe an internal appeal</td><td>Attorney General and the privacy agency</td></tr>
<tr><td><strong>Colorado</strong></td><td>Right listed; the page gives no further detail</td><td>Complaint to the Attorney General; the page does not describe an appeal</td><td>Attorney General and district attorneys</td></tr>
<tr><td><strong>Connecticut</strong></td><td>Data from third parties, data you gave, and compiled public information used to build a profile</td><td>Appeal; the controller answers within 60 days, then must give Attorney General contact details</td><td>Attorney General</td></tr>
<tr><td><strong>Virginia</strong></td><td>Personal data provided by or obtained about you</td><td>Appeal answered in writing within 60 days; Attorney General contact if denied, where available</td><td>See statute</td></tr>
<tr><td><strong>Texas</strong></td><td>Personal data provided by you or obtained about you</td><td>Appeal; if denied, the company must say how to complain to the Attorney General</td><td>Attorney General only</td></tr>
<tr><td><strong>Oregon</strong></td><td>Personal data; parents and teens can also ask for a child's or their own</td><td>Complaint form to the Department of Justice</td><td>Department of Justice</td></tr>
</tbody></table></div>

Two differences matter. First, the scope of your data varies. California's page frames deletion around information collected from you, while Connecticut's page includes data a controller got from third parties and compiled public information used to build a profile. If a company assembled a profile from other sources, the wording in your state decides whether it is reachable.

Second, the escalation path differs. Connecticut, Virginia and Texas describe an internal appeal; the California and Colorado pages read describe only a complaint to the regulator. Do not wait for an appeal your state may not provide.

## California: the request, the clock and the exceptions

**The right.** The privacy agency's FAQ says a business must tell its service providers to delete your information when you request deletion. The Attorney General's CCPA page, summarized when this guide was prepared, frames the right as deleting personal information the business collected from you, and says there are many exceptions. That page could not be re-read for the final check, so confirm its details on the page before filing.

**The channel.** The privacy policy must explain how to submit a request. The privacy agency's FAQ says businesses must generally offer at least two methods, that one of them has to be a toll-free phone number, that a business with a website must offer one through it, and that a business operating exclusively online needs only an email address. Use the designated method, which may differ from general customer service, and if it fails, notify the business in writing and try another.

**The clock.** The agency's FAQ says the business must confirm receipt of a request within 10 business days and substantively respond within 45 calendar days, with a further 45 days if it notifies you, for 90 in total.

**Verification and providers.** The agency says a business may deny a delete request if it cannot verify your identity, and that a business must tell its service providers to delete your information, so send the request to the business itself.

**The exceptions.** The Attorney General's page, as summarized for this guide and not re-read for the final check, lists reasons a business may keep information along these lines:

- the information is exempt from the CCPA, including publicly available information such as property records, and certain categories such as medical or credit reporting information
- the business cannot verify your request
- it is needed to complete your transaction, provide a reasonably anticipated product or service, or handle certain warranty and recall matters
- it is used for certain business security practices
- it is used for certain internal purposes compatible with reasonable consumer expectations
- it is needed to comply with legal obligations or to handle legal claims

**Suing.** The Attorney General's page, as summarized for this guide, says consumers generally cannot sue under the CCPA apart from a narrow action tied to data breaches. Check it before assuming a court route, and ask a lawyer in your state.

## Colorado, Connecticut, Virginia, Texas and Oregon: what changes from California

### Colorado

The Attorney General's page lists deletion among the consumer rights without procedural detail. Controllers must respond within 45 days and may extend by 45 more if they explain within the first 45. Companies that deal with consumers only online need to offer just an email address.

Enforcement belongs to the Attorney General and district attorneys, and individuals cannot sue. Complaints go through the Attorney General's online form.

### Connecticut

Connecticut's page is the broadest on scope: deletion extends to data obtained from third parties and to compiled publicly available information used to build a consumer profile. The response window is 45 days, extendable by 45. A denied requester can appeal; the controller has 60 days to respond with its reasons and, if it denies the appeal, must give Attorney General contact information. There is no private right of action.

The page lists exempt entities, among them governments, nonprofits (not for consumer health data), GLBA-covered financial institutions, HIPAA-covered entities and insurers. It points to Conn. Gen. Stat. section 42-524 for the reasons a controller may deny a request; that statute could not be read for this guide.

### Virginia

The Virginia Code, section 59.1-577, is the only statute text read directly for this guide. It lets a consumer request "to delete personal data provided by or obtained about the consumer," requires a response within 45 days, allows one extension if the controller explains within the first 45 days, and requires an appeal process, and the controller must answer an appeal in writing within 60 days. Information is free up to twice annually, and a controller may charge a reasonable fee or decline only for manifestly unfounded, excessive or repetitive requests, which it must prove.

Section 59.1-582 says a controller may still comply with laws and subpoenas, prevent fraud, perform a contract, and investigate, establish, exercise or defend legal claims. It also says the chapter imposes no obligation that adversely affects the rights or freedoms of any person, such as free speech. A controller relying on an exemption bears the burden of showing it applies.

### Texas

The Texas Attorney General's page says consumers can have personal data provided by them or obtained about them deleted. Companies must respond within 45 days, may take one 45 day extension with a stated reason, and must answer free of charge up to twice a year. They must offer an appeal, and if it is denied must say how to complain to the Attorney General, who has exclusive enforcement authority. Exempt entities include state agencies, GLBA financial institutions, HIPAA entities, nonprofits and higher education; exempt data includes data governed by HIPAA, the Fair Credit Reporting Act and FERPA.

### Oregon

The Oregon Department of Justice page says anyone can request that a business delete personal data, and that parents and teens can ask a website to delete information about a child or themselves. If a business does not respond, you can file the Department's complaint form; the Privacy Unit sends notices of violation to businesses it finds non-compliant, which are then expected to comply or may face penalties; the amounts and the compliance period were not re-checked for this guide. The page read did not state a response deadline, a threshold or an appeal step, and an enforcement report could not be opened, so check the statute for the clock.

## What a business may keep after a valid request

Most disappointment comes from a partial answer. The structure is similar in every state: the right exists, then a list of reasons to keep data. Four categories account for most of what survives.

<div class="tablewrap"><table><thead><tr><th>What you want gone</th><th>Why it may stay</th><th>What to ask instead</th></tr></thead><tbody>
<tr><td><strong>Purchase and billing records</strong></td><td>Completing the transaction, warranty, legal obligations</td><td>Ask to delete marketing and profile data, and ask how long records are kept</td></tr>
<tr><td><strong>Account log-in and fraud records</strong></td><td>Security practices; preventing illegal activity</td><td>Ask for the retention period and the purpose</td></tr>
<tr><td><strong>Data tied to a dispute with you</strong></td><td>Establishing or defending legal claims</td><td>Resolve the claim first, then ask again</td></tr>
<tr><td><strong>Public-record data the business copied</strong></td><td>Publicly available information is outside the CCPA, per the Attorney General page</td><td>Check whether your state, such as Connecticut, reaches compiled public data</td></tr>
<tr><td><strong>Credit, medical and similar data</strong></td><td>Governed by other federal laws and carved out</td><td>Use that law's own dispute or access process</td></tr>
</tbody></table></div>

A denial is not the end. In several states the business must explain its reasons and, in Virginia and Texas, how to appeal. Ask for the specific exception it relies on. In Virginia the controller bears the burden of showing an exemption applies, and a vague answer is a good reason to appeal or complain.

## How to file a request that can be enforced later

Treat a deletion request as a document you may have to show a regulator.

<figure class="fig">
<figcaption><b>The order that keeps a request enforceable</b></figcaption>
<ol class="fig-steps">
<li><b>Confirm the state and the business</b>Check that you are a resident of a state with a deletion right, and that the business is one that meets the thresholds. Start with large holders.</li>
<li><b>Find the designated channel</b>Read the privacy policy for the section on privacy rights. Use the web form, email address or number listed there, not general customer service.</li>
<li><b>Write the request once and keep it short</b>Name the right in your state, ask for deletion of the personal data the business holds about you, and give only the details needed to find your record.</li>
<li><b>Verify yourself minimally</b>Answer the identity questions the business asks. The California privacy agency says a business may deny a request it cannot verify, so answer once and keep the exchange.</li>
<li><b>Save proof</b>Keep a screenshot or the sent email with date and time, and note the confirmation number. Diary the day on which 45 days run out.</li>
<li><b>Escalate on the clock, not on impatience</b>If the business misses the window, or refuses without a clear exception, appeal if your state provides one, then complain to the Attorney General.</li>
</ol>
</figure>

Keep the request itself plain and neutral: no threats and no demand for money. Any escalation is a separate letter. Do not send the same request to several addresses in one week, because a muddled trail lets the business say it never received the right one.

## Authorized agents, universal signals and what to do when the business refuses

California's Attorney General page, as summarized for this guide, covers authorized agents who submit a request for you and the Global Privacy Control, a browser setting that operates as an opt-out of sale or sharing rather than a deletion. That page could not be re-read for the final check, so confirm the current rules on it before relying on either route.

When a business refuses or does not answer, sort the problem by type before you act.

<div class="tablewrap"><table><thead><tr><th>What happened</th><th>First step</th><th>Next step</th></tr></thead><tbody>
<tr><td><strong>No reply after 45 days</strong></td><td>Check that you used the designated method, then follow up in writing</td><td>Complaint to the Attorney General (or Department of Justice in Oregon)</td></tr>
<tr><td><strong>Refused, citing an exception</strong></td><td>Ask which exception and which data</td><td>Appeal in Connecticut, Virginia or Texas; complaint elsewhere</td></tr>
<tr><td><strong>Partly deleted</strong></td><td>Ask for a list of what was kept and why</td><td>Treat unexplained retention as a refusal</td></tr>
<tr><td><strong>Says it cannot verify you</strong></td><td>Offer the verification it asks for, once</td><td>If it keeps refusing without a method, complain</td></tr>
<tr><td><strong>Says a vendor holds it</strong></td><td>Ask which business the vendor works for</td><td>Send the request to that business</td></tr>
</tbody></table></div>

A complaint works best when it is specific, in every state: dates, the channel you used, the answers you got. Where the pages read say individuals cannot sue, the regulator is your enforcement route, and it may not resolve your case quickly.

## Where state deletion rights stop, and the guides that cover the rest

State deletion laws are one route among several. Four neighboring subjects are covered elsewhere on this site, so each gets one paragraph.

Data brokers are the businesses behind most people-search listings. California's Delete Act led to DROP, which the privacy agency's page says is free for California residents, reaches over 600 registered brokers, requires brokers to start processing on August 1, 2026 and to access it at least every 45 days, and can take up to 90 days to show status updates. A broker-by-broker opt-out sequence is a separate job from the single-company request in this guide.

What brokers actually hold is a different question again. A file can combine identity details, property records, purchase signals and inferred traits, and reading your own file first helps you pick targets. California's privacy law also lets you ask what a business holds; check the agency's FAQ for the current limits.

In Europe the equivalent right sits in the GDPR, with a different legal basis and process. If you are outside the United States, or your data sits with a European company, the route is a GDPR erasure letter, not a state request.

Finally, the United States has no general right to be forgotten that reaches news articles and search results. State privacy laws reach data held by businesses, and none of the pages read gives a right to have a lawfully published article taken down. For content published by someone else, the route is the publisher, the platform, the search engine or a court; a private [removal and de-listing review](/remove-negative-content) helps decide which is realistic.

## A realistic timeline and an invented scenario

Statutory windows are measured in days, but real files run longer because of verification, partial answers and appeals. The right-hand column is our experience, written as "usually", not a promise.

<div class="tablewrap"><table><thead><tr><th>Stage</th><th>Statutory marker</th><th>What usually happens</th></tr></thead><tbody>
<tr><td><strong>Day 0</strong></td><td>Request filed through the designated channel</td><td>Automatic acknowledgment, often within days</td></tr>
<tr><td><strong>Business day 10</strong></td><td>California: confirmation of receipt</td><td>Identity questions arrive if the business needs them</td></tr>
<tr><td><strong>Day 45</strong></td><td>Response due in five of the six states read</td><td>Most answers arrive in this window, many near its end</td></tr>
<tr><td><strong>Day 90</strong></td><td>Outer limit with one notified extension</td><td>Only if the business sent a reasoned extension notice</td></tr>
<tr><td><strong>Appeal plus 60 days</strong></td><td>Connecticut and Virginia appeal window</td><td>A written decision; if upheld, Attorney General contact details</td></tr>
</tbody></table></div>

**An invented scenario, with assumptions.** A Connecticut resident, call them the requester, wants a large online retailer to delete their account profile and browsing history. Assume the retailer meets the Connecticut threshold, that it designates a web form, and that no sensitive or health data is involved. These are invented parties and invented dates.

On March 1 the requester files the request through the form and saves a screenshot. Forty-five days after March 1 is April 15, which is the response deadline. On April 10 the retailer replies that it deleted the browsing history but kept order records for tax and warranty reasons, which fits the transaction and legal obligation exceptions the pages describe. The requester accepts that and asks in writing for the retention period.

Suppose instead the retailer had refused everything on April 10 without citing an exception. The requester could appeal. If the appeal is received on April 12, the retailer has 60 days, which runs to June 11; if it denies the appeal, it must give Attorney General contact details, and the requester files the complaint form with the screenshot, the dates and both responses.

The lesson is the paper trail: the statute helps only if you can show when the clock started.

## Your next step: pick one business and send one plain request

Choose the single holder whose data worries you most: the one with your address, your payment history or your location trail. Find its privacy rights page, use the designated method once, and put the day 45 date in your calendar.

<div class="box hot"><b>If this is happening to you now</b>
<p>If personal data is already spreading, or the content you want gone was published by someone other than a business holding your account, a deletion request alone will not stop it. We can review the whole exposure with you before you spend weeks on the wrong route. Start with a <a href="/audit">private audit</a>.</p></div>

Reputation Partners treats these state rights as one tool in a wider plan: they reduce what companies hold about you, but they do not decide what search engines and AI assistants find. The sources behind this guide are the [California Attorney General's CCPA page](https://oag.ca.gov/privacy/ccpa), the [Colorado Privacy Act page](https://coag.gov/resources/colorado-privacy-act/), the [Connecticut Data Privacy Act page](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act), [Virginia Code section 59.1-577](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-577/) and the [Texas Attorney General's privacy page](https://texasattorneygeneral.gov/es/node/259071). Oregon's Department of Justice page was read but not linked. Utah, Montana, Florida and every other state with a comprehensive privacy law could not be read for this guide, so check your own Attorney General's page.

## Questions people ask

### Does a CCPA deletion request work if I do not live in California?

No. The California Privacy Protection Agency says a California resident is the person covered. If you live in another state, look for your state's law. Colorado, Connecticut, Virginia, Texas and Oregon give residents a comparable deletion right. If your state has no such law, you can still ask a company in writing, but it has no legal duty to comply.

### Will a business delete everything I ask it to?

Usually not everything. The Attorney General's California page lists reasons a business may keep data, including completing a transaction, security, legal obligations, legal claims and exempt categories. Expect a partial answer for purchase records and fraud logs. Ask which exception covers each item kept, and treat an unexplained refusal as a reason to appeal or complain.

### What if the business never answers?

Check first that you used the designated method, because a request to the wrong address may not count. If you did, follow up in writing after the 45 day mark, then file a complaint with your state's Attorney General, or Oregon's Department of Justice. Include dates, the channel you used and any reply you received.

### Can I sue a company that ignores my deletion request?

Generally not. The Colorado, Connecticut and Texas pages say individuals cannot sue, and California's enforcement sits with its Attorney General and privacy agency. California's Attorney General page, as summarized for this guide, describes only a narrow private action tied to data breaches. Your realistic remedy is a regulator complaint, and a lawyer in your state can tell you if another claim exists.