What is the CCPA right to delete?

The right to delete is the CCPA request consumers reach for most, and the one businesses most often mishandle. It is not an absolute erase button, and it is not limited to a single database. Section 1798.105 sets out exactly what a consumer can ask you to delete, how quickly you have to act, and the narrow set of reasons that let you keep the data.

What can a consumer ask you to delete?

Under California Civil Code section 1798.105(a), a consumer has the right to request that a business delete any personal information about the consumer that the business collected from the consumer. The phrase "collected from the consumer" matters. It covers what you gathered directly, such as an account signup, a purchase, or a support ticket. A business also has to disclose this right, under section 1798.130, so consumers know it exists.

How fast must you respond?

You have 45 days from a verifiable consumer request. You must promptly determine whether the request really comes from the consumer or an authorized agent, but that verification step does not buy you extra time beyond the 45 days. Deletion reaches past your own systems: section 1798.105(c) requires you to direct your service providers and contractors to delete the personal information from their records, and to notify any third parties, unless doing so proves impossible or involves disproportionate effort.

When can you keep the data?

Section 1798.105(d) lists nine exceptions where you do not have to delete, if keeping the data is reasonably necessary. They include completing the transaction the information was collected for, helping to ensure security and integrity, debugging to repair errors, exercising or protecting free speech, complying with the California Electronic Communications Privacy Act, conducting certain public-interest research, enabling solely internal uses aligned with the consumer's expectations, complying with a legal obligation, and other internal uses compatible with the context in which the consumer provided the data. Read them narrowly and record which one applies, because a vague "we need it" is not one of them.

How it fits your other CCPA duties

Deletion does not stand alone. A consumer who can ask you to delete can also ask you to know and correct their data, and can use a Do Not Sell or Share request to stop the flow of their information to third parties. All of it depends on the upfront notice at collection that tells consumers what you hold in the first place.

Next step

If you are not sure your deletion process meets the 45-day clock or handles service providers correctly, the free 2-minute Obligation Scan checks whether the CCPA applies to you and lists the request-handling steps you owe, so a deletion request does not turn into an enforcement problem. The US state privacy laws hub shows how California's rights compare with the other state laws.