A California bill signed in 2018 gave you the right to demand a company delete your personal data. That was a first in the United States. But before you start sending CCPA data deletion requests to every app you have ever used, you need to understand what the law actually covers. It has real limits, and most summaries gloss over them.
The short answer: CCPA gives California residents four core rights. You can know what data a business holds, delete it, opt out of its sale, and not be penalised for using these rights. CPRA (2020) added correction and limits on sensitive data. But CCPA only applies to larger businesses and data-heavy ones, and it carves out data covered by HIPAA, GLBA, and FCRA. So it is powerful, but narrower than it sounds.
What is CCPA, and who does it cover?
The California Consumer Privacy Act went into effect in 2020. It applies to for-profit businesses that collect California residents’ personal information and meet at least one of these thresholds:
- Annual gross revenue above $25 million
- Buy, sell, or share the personal information of 100,000 or more consumers or households per year
- Derive 50% or more of annual revenue from selling consumers’ personal information
That third criterion catches most data brokers. But the first two immediately exclude the overwhelming majority of small apps, local businesses, and websites. The newsletter platform a startup uses? Almost certainly below the threshold. Your neighborhood dentist? Not covered.
This is not a bug in the law — it’s a deliberate policy tradeoff. But it means “California privacy rights” sound broader than they are in practice.
Your four core rights
If a business is covered by CCPA, you have four rights:
- Right to know — you can request what personal information a business has collected about you, where it came from, why it’s being used, and who it’s been shared with.
- Right to delete — you can ask them to delete your data, and they must comply (with some exceptions).
- Right to opt out of sale — if a business sells your data, you can tell them to stop. They must honor this within 15 business days.
- Right to non-discrimination — a business can’t charge you more, give you worse service, or deny you access because you exercised your privacy rights.
CPRA (2020 update) added two more rights. The right to correct inaccurate information. And the right to limit use of sensitive personal information, such as Social Security numbers, precise geolocation, racial or ethnic origin, and the contents of your messages.
How to send a CCPA deletion request
Most covered businesses are required to include a “Do Not Sell or Share My Personal Information” link in their website footer. Start there.
For a deletion request specifically:
- Find the company’s privacy page or privacy request portal (search “[company name] CCPA request” or “[company name] privacy rights”)
- Submit a request identifying yourself — expect to verify your identity, typically by confirming an email address or answering security questions
- The company has 45 days to respond, with one possible 45-day extension if they notify you
A valid response either confirms deletion or explains which legal exemption applies. If they don’t respond at all, that’s a violation you can report to the California Privacy Protection Agency (cppa.ca.gov).
Save confirmation emails. If a company restores deleted data without a valid legal reason, that’s actionable.
What does CCPA not cover?
This is where most summaries stop being useful. CCPA has significant carve-outs:
- Medical information covered by HIPAA — your health records, insurance claims, and prescription data fall under federal medical privacy law, not CCPA
- Financial information covered by GLBA — bank and credit union data is regulated by federal banking law
- Credit report data covered by FCRA — your credit file at Equifax, Experian, and TransUnion operates under the Fair Credit Reporting Act, which has its own dispute process
- Employment records — data collected in the employment context has limited protections under CCPA (CPRA expanded this somewhat, but it’s still narrower than consumer rights)
Then there is the thorny problem of large data brokers. LexisNexis and Acxiom deal heavily in data covered by other federal laws (FCRA, DPPA). That gives them partial exemptions from CCPA’s deletion requirements. You can still opt out of certain uses, but you may not be able to get everything deleted.
CCPA vs CPRA: what’s actually different now
Proposition 24 passed in November 2020 and took effect January 1, 2023. It created the California Privacy Protection Agency — an independent enforcement body with real investigative authority and a dedicated budget. Before that, enforcement fell to the California Attorney General’s office, which was understaffed and slow.
CPRA matters because enforcement now happens. The CPPA has opened investigations, issued fines, and made clear it will pursue companies that ignore opt-out requests. The law didn’t change dramatically, but the enforcement mechanism improved substantially.
The practical additions are twofold. CPRA gives you the right to correct your data, not just delete it. And it limits what companies can do with sensitive personal information, even if they do not “sell” it in the technical legal sense. The definition of “sharing” was also expanded to cover cross-context behavioral advertising, which is how ad networks track you.
States with similar laws
California privacy rights aren’t unique anymore. As of 2026, more than 20 US states have enacted consumer data privacy legislation. The most significant:
- Virginia — Consumer Data Protection Act (CDPA), effective 2023
- Colorado — Colorado Privacy Act (CPA), effective 2023
- Texas — Texas Data Privacy and Security Act (TDPSA), effective 2024
- Connecticut, Montana, Iowa, Indiana — all have active laws with varying scopes
Most of these follow a similar structure to CCPA: rights to access, delete, and opt out of sale or targeted advertising. The thresholds differ. Some cover businesses processing 25,000 consumers’ data; others set higher bars.
If you’re not in California, search “[your state] consumer data privacy law” — the odds are decent your state has something, even if it’s newer and enforcement is lighter.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.