Handling Deletion Requests Under the CCPA: What Businesses Must Do

Under the California Consumer Privacy Act (CCPA), California residents have the right to request deletion of their personal information. For businesses, deletion requests create some of the most complex operational obligations under the CCPA, involving identity verification, statutory exceptions, response timelines, and documentation.

This article explains what the CCPA right to delete means in practice, when deletion is required, when a business may lawfully refuse or limit deletion, and how to handle deletion requests within broader consumer rights workflows.

The right to delete is one of the most widely exercised consumer rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It gives California residents the ability to ask businesses to remove personal information that has been collected from them. It gives California residents the ability to ask businesses to remove personal information collected from them and, from January 1, 2027, personal information collected about them from other sources.

In practice, deletion requests are rarely straightforward. Businesses must balance consumer rights with legal retention obligations, security needs, fraud prevention, and internal operational requirements. Many enforcement actions and complaints arise not because businesses ignore deletion requests, but because they misunderstand when deletion is required and when lawful exceptions apply.

What is the CCPA’s right to delete?

The CCPA right to delete allows a consumer to request that a business delete personal information it has collected from the consumer, subject to specific statutory exceptions. A CCPA deletion request is the verifiable request a consumer sends to exercise that right. From January 1, 2027, the right also covers personal information a business collected about the consumer from other sources.

This right applies when:

• The business is subject to the CCPA
• The requester is a California resident
• The personal information was collected from the consumer
• The business collected the personal information from the consumer or, from January 1, 2027, about the consumer from another source

However, deletion is not absolute. The CCPA does not require businesses to erase personal information in every circumstance. Instead, it establishes a default obligation to delete, followed by a defined list of situations where retention is permitted or required.

How the CCPA right to delete changes in 2027

From January 1, 2027, the CCPA right to delete covers personal information a business collected from or about a consumer, not only information the consumer provided directly. That includes data obtained from data brokers, marketing partners, and enrichment or identity resolution services, subject to the CCPA’s existing exceptions.

The change comes from SB 923, which Governor Newsom signed on September 27, 2026. For data obtained from sources other than the consumer, businesses may keep a record of the request and the minimum data needed to stop deleted information from being re-added, for example through a list import or a profile refresh. Businesses should use that record only for that purpose.

In practice, the bigger change is operational. A deletion search will need to reach the CRM, marketing, and vendor systems where purchased or appended data lives, so an up-to-date CCPA data map becomes even more important. SB 923 also requires businesses that operate only online to offer an online way to submit privacy requests, such as a web form or portal, in addition to an email address.

For what this means for your marketing, IT, and vendor processes, see our guide to CCPA changes for third-party data.

Is California a right to delete state?

Yes. California is commonly referred to as a "right to delete" state because the CCPA explicitly grants consumers the right to request deletion of their personal information.

However, this right exists within a structured legal framework. Businesses are expected to evaluate each deletion request against statutory exceptions and respond accordingly. Treating deletion as automatic can be just as risky as refusing deletion without justification.

Which deletion requests are subject to the 45-day response timeline?

Deletion requests are request-based consumer rights, often referred to as data subject requests, and follow the same response timing framework as access and correction requests.

In most cases, businesses must:

• Confirm receipt of the deletion request within 10 business days
• Provide information about the verification process and expected response timing
• Verify the identity of the requester
• Respond to the request within 45 days of receiving it, subject to a possible extension

For a detailed explanation of how the response clock works, see our guide on the CCPA 45-day response timeline.

Verifying identity for deletion requests

Before deleting personal information, businesses must take reasonable steps to verify that the requester is the consumer whose data would be affected.

Verification requirements vary based on the nature of the data and the risk of harm from unauthorized deletion. In practice, businesses often rely on:

• Email-based verification links sent to the address on file
• Re-authentication through an existing account
• Matching information provided in the request against data already maintained

If identity cannot be verified, the business may deny the deletion request but must explain the reason in its response. Verification obligations are explained in more detail in our article on verifying identity under the CCPA.

When must a business delete personal information?

Once a deletion request is verified, the business must delete the personal information unless a statutory exception applies.

In practice, deletion may involve:

• Removing personal information from active records and systems
• Applying permitted technical measures, such as de-identification or aggregation, where consistent with the CCPA and its regulations
• Instructing service providers or contractors to delete the data
• From January 1, 2027, keeping a minimal suppression record so deleted third-party data is not re-added

Through December 31, 2026, deletion obligations apply to personal information collected from the consumer. From January 1, 2027, they also apply to personal information collected about the consumer from other sources. In both cases, they extend to downstream processors where applicable.

When can a business refuse to delete personal information?

The CCPA allows businesses to retain personal information when deletion would interfere with specific permitted purposes.

The CCPA lists eight deletion exceptions. A business may keep personal information when it is reasonably necessary to:

• Complete a transaction or provide a service requested by the consumer
• Help ensure security and integrity, where reasonably necessary and proportionate (for example, detecting fraud or security incidents)
• Debug systems or fix errors
• Exercise free speech, or protect another consumer’s right to free speech
• Comply with the California Electronic Communications Privacy Act
• Carry out public or peer-reviewed research in the public interest, where deletion would seriously impair it and the consumer gave informed consent
• Support solely internal uses that are reasonably aligned with the consumer’s expectations and compatible with the context in which the information was provided
• Comply with legal obligations

Separately, the CCPA’s general exemptions in Civil Code section 1798.145 let businesses exercise or defend legal claims. SB 923 does not change any of these exceptions, so from 2027 they apply to third-party data in the same way.

These exceptions are grounded in the CCPA statute and further clarified by CPPA regulations. Applying exceptions consistently and documenting the rationale is critical.

Deletion exceptions under the CCPA

What happens if a deletion request is denied?

If a business denies a deletion request in whole or in part, it must:

• Inform the consumer of the denial
• Explain the basis for the decision
• Identify the applicable exception

Blanket refusals or vague explanations can increase enforcement risk. Clear, request-specific responses are expected.

Do businesses have to notify service providers?

Yes. When a business deletes personal information in response to a valid request, it must also instruct its service providers and contractors to delete the information and notify any third parties to whom the business sold or shared the information to do the same, unless doing so proves impossible or involves disproportionate effort.

This requirement highlights the importance of data mapping and vendor coordination when handling deletion requests. From January 1, 2027, the wider deletion scope means more of your vendors, such as enrichment tools and CRM integrations, may hold data that falls within a request.

Practical example: handling a CCPA deletion request

A California resident submits a deletion request through a company’s privacy request form. The business acknowledges receipt and initiates identity verification by sending a verification link to the email address associated with the account.

After verification, the business reviews the personal information it holds about the consumer across internal systems. From January 1, 2027, that review also covers data obtained from third parties, such as interest segments added by an enrichment vendor. Certain data elements are deleted, while others are retained to comply with legal obligations under tax and recordkeeping requirements.

Within the 45-day response period, the business confirms deletion and clearly explains which data was retained and why. All steps are documented internally as part of the business’s consumer rights records.

How deletion requests fit into broader CCPA consumer rights obligations

Deletion is one part of the broader consumer rights framework under the CCPA and CPRA. It interacts closely with:

• Identity verification requirements
• Response timelines
• Data minimization and retention practices
• Vendor and service provider management

For a broader overview, see our guides on consumer rights under the CCPA and CPRA and the CCPA compliance guide for businesses.

Businesses serving Utah residents should also review the Utah Consumer Privacy Act, which includes its own deletion right alongside a new right to correct that took effect in July 2026.

How Clym helps businesses manage CCPA deletion requests

Businesses install Clym on their website to allow consumers to submit deletion requests through the Clym widget or the Governance Portal.

Because the Governance Portal gives consumers an online place to submit requests, it can support online-only businesses as they prepare for SB 923’s online request method requirement.

Once submitted, requests appear in the Clym Control Center, where businesses can:

• View and track deletion requests in one place
• Monitor response deadlines
• Communicate with requesters
• Record verification steps and outcomes
• Maintain documentation for audits or regulatory inquiries

This structured approach helps businesses handle deletion requests consistently across domains.

Conclusion

The CCPA right to delete is a powerful consumer right, but it is not absolute. Businesses must delete personal information when required, retain it when legally permitted, and clearly explain their decisions.

From January 1, 2027, that obligation also reaches personal information a business obtained about consumers from third parties. Well-designed deletion workflows, supported by verification, exception analysis, and documentation, are central to managing this obligation effectively.