The CCPA is California's consumer privacy law, giving California residents rights over their personal information, including the right to ask covered businesses to delete it.
The California Consumer Privacy Act of 2018, expanded by the California Privacy Rights Act approved by voters in 2020, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above an inflation-adjusted amount (originally $25 million), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning at least half their revenue from selling or sharing personal information. It is enforced by the California Privacy Protection Agency and the Attorney General.
Under Civil Code §1798.105, a consumer can ask a business to delete personal information it collected from them, and the business must pass the request on to its service providers and contractors. Exceptions include completing a transaction, security, legal obligations and free speech. Businesses generally have 45 days to respond, extendable once by a further 45 days. Separately, California's Delete Act lets residents send one deletion request to all registered data brokers through the state's DROP platform, which brokers have had to process since 1 August 2026.
In practice
The CCPA deletion right is useful for personal information held by businesses, including some people-search and marketing companies, but on its own it does not reach news articles, other people's social posts or search results, and it protects only California residents. For people-search sites, the DROP platform and each site's own opt-out are usually the first steps; listings can reappear, so they need checking over time.
Source: Cal. Civ. Code §1798.105 ↗
Related removals
- Personal info on Google — $1,500 per URL, pay on success
Related terms
- Data broker — A data broker is a company that collects personal information about people it has no direct relationship with and sells, licenses or publishes it, often through people-search websites.
- GDPR Article 17 — GDPR Article 17 is the EU right to erasure: people can require an organisation to delete their personal data when a ground listed in the law applies and no exception overrides it.
- Doxxing — Doxxing is publishing someone's private personal information — such as a home address, phone number or ID details — to expose, harass or endanger them.
- SERP de-indexing — SERP de-indexing is the removal of a specific URL from search engine results pages, so it stops appearing in searches even though the page itself may still exist.