Must I delete a consumer's personal data on request in the United States?

Controller, Online retailer, Online service, SME

Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law.

Yes, a verified deletion request must be honoured unless a statutory exception applies.

Delete the personal data, and under the CCPA also notify service providers, contractors and third parties to delete, unless an exception such as completing a transaction, security or legal obligation applies.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Verify the request
2. Check the statutory exceptions
3. Delete from own systems
4. Instruct service providers and contractors to delete (CCPA)
5. Keep a record of the request

45 days from receipt, extendable once by 45 days with notice.

• Cal. Civ. Code 1798.105
• Va. Code 59.1-577(A)(3)

sha256 7ab70f848e19f931fe8f28aa02cbb68828579a9587a02d5a9016b8a9b7649b36 · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · response deadline: 45 days · extension: One extension of 45 days with notice · regulator: California Privacy Protection Agency and California Attorney General · max civil penalty: 2,500 dollars per violation, 7,500 dollars per intentional violation or violation involving minors under 16, adjusted for inflation (1798.155, 1798.199.90)
• VA, Virginia Consumer Data Protection Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Virginia Attorney General · max civil penalty: 7,500 dollars per violation (59.1-584)
• CO, Colorado Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Colorado Attorney General and district attorneys · max civil penalty: not in register
• CT, Connecticut Data Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Connecticut Attorney General · max civil penalty: not in register
• TX, Texas Data Privacy and Security Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Texas Attorney General · max civil penalty: 7,500 dollars per violation (541.155)
• OR, Oregon Consumer Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Oregon Attorney General · max civil penalty: 7,500 dollars per violation (646A.589)

GDPR Art. 17crosswalk

• What are the exceptions to the CCPA right to delete?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-notice (business_agent)
• agent:us:business:privacy-opt-out (business_agent)