If you live in California, you can ask a business to delete personal information it collected from you and to stop selling or sharing it. The two rights come from California Civil Code §1798.105 (deletion) and §1798.120 (opt-out of sale or sharing). The business has 45 calendar days to respond, and it can extend that once by another 45 days if it tells you why. Below is a letter you can copy, what each part does, and what to expect after you send it.
The template
Fill in the bracketed parts, delete any line you don't want to share, and send it to the address the business lists for privacy requests. The legal paragraph is the same wording the free OptStub kit puts in every California letter.
To: [the business's privacy request address]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your city, state]
Address: [optional: the address the listing shows]
Phone: [optional]
Email: [optional]
Profile URL: (paste the URL of your profile page here)
I am making this request under the California Consumer Privacy Act,
Civ. Code §1798.105 (deletion) and §1798.120 (opt-out of sale or
sharing). You must respond within 45 days of receipt.
Please confirm in writing when the deletion is complete.
Why the letter asks for two things
Deletion and opt-out of sale or sharing are separate rights with different rules, and asking for both covers more ground.
- Deletion (§1798.105). The statute gives you the right to request deletion of personal information "which the business has collected from the consumer." Once a business verifies the request, it must delete the information and notify its service providers, contractors, and the third parties it sold or shared the information with, unless that proves impossible or involves disproportionate effort.
- Opt-out of sale or sharing (§1798.120). You can direct a business that sells or shares your personal information to stop. Under the regulations (11 CCR §7026), a business may not require a verifiable request for an opt-out, may not make you create an account to submit one, and must stop selling or sharing no later than 15 business days after it receives the request.
The opt-out matters because a people-search site usually did not collect your information from you. It assembled it from other sources, and that is the business the opt-out right was written for.
What the business has to do, and when
The regulations set the timeline:
- Within 10 business days, the business must confirm it received your deletion request and explain in general how it will verify you and when to expect an answer (11 CCR §7021(a)).
- Within 45 calendar days of receipt, it must respond. The clock starts the day it receives the request, "regardless of time required to verify the request" (§7021(b)).
- Up to 90 days in total if it gives you notice and an explanation for needing more than 45 days (§7021(b)).
If the business denies a deletion request in whole or in part, it must give you a detailed explanation of the basis for the denial, delete whatever is not covered by the exception it relies on, and use what it keeps only for that exception (11 CCR §7022(f)).
Verification: what to send, and what not to
A business may deny a deletion request if it cannot verify who you are, but it has to tell you that this is the reason (11 CCR §7022(a)). In practice a broker matches a request against the record it holds, which is why the template includes optional address, phone and email lines: those are what a site uses to find the right profile. Pasting the profile URL is usually the most precise identifier you can give.
Give the minimum a site needs to find you. If a business asks for more, such as a photo ID, you can ask what it will be used for. The opt-out of sale or sharing does not need to be verified at all, so a request for ID should not hold that part up.
Using someone else to send it
You can authorize another person to submit a CCPA request for you. The business may ask for proof that you gave signed permission, and may ask you to verify your identity or confirm the authorization directly with it, but it cannot make you resubmit the request yourself (11 CCR §7063(a)).
What the CCPA does not reach
Be realistic about the limits before you send a batch of letters:
- Publicly available information is excluded. The CCPA's definition of personal information does not include information "lawfully made available from federal, state, or local government records," among other categories. A site that republishes court or property records may rely on that.
- Exceptions apply. The Attorney General lists information needed to complete a transaction or comply with a legal obligation, and requests the business cannot verify, among the reasons a business may refuse.
- The deletion right covers information collected from you. That is one reason the template pairs it with the opt-out.
None of this means a request is pointless. It means the answer you get back may be a partial deletion, an opt-out, or a refusal with reasons, and each of those is a response the law requires.
California DROP: one request to registered brokers
California also runs a free state platform, DROP, that sends one deletion request to the data brokers registered with the state. If you live in California, it is worth filing there first, then using individual letters for sites it doesn't reach. Our page on California DROP covers who can use it and what it leaves out.
If the business misses the deadline
Keep a copy of what you sent and when. If the 45 days pass with no response, or no notice of extension:
- Send a short follow-up quoting your original request and the date it was sent.
- File a complaint with CalPrivacy, the California Privacy Protection Agency, at its online complaint form. It says plainly that it "doesn't represent individual consumers and cannot act as your attorney," but uses complaints to decide on inquiries and investigations.
- You can also file with the California Attorney General, which enforces the CCPA.
The CCPA gives individuals a right to sue only for certain data breaches (§1798.150(c)), not for an ignored deletion request, so the regulators are the route. Our article on what to do if a data broker ignores you walks through the follow-up in more detail.
Where to send it
Most brokers list a privacy email or a web form in their privacy policy. Our opt-out guides list the documented address or form for each site we cover, such as Spokeo, Whitepages and BeenVerified. Where a site only accepts its own form, use the form and keep a screenshot of the confirmation.
Removal is not guaranteed. Some sites comply, some refuse with a stated exception, and data can be re-listed later from new sources, so it is worth checking each listing again after the deadline has passed.
If you don't live in California, see state privacy laws with a right to delete for the states with similar laws.