A growing number of US states give residents a legal right to ask a company to delete personal data about them. California was first. As of October 2026, the states below also have comprehensive consumer privacy laws in force, and each includes a right to delete. Most follow the same pattern: the company has 45 days to respond, can extend once, and must give you a way to appeal a refusal, after which you can complain to the state Attorney General.
States with a comprehensive privacy law in force
Effective dates are from a June 2026 comparison of state laws, cross-checked against reporting on the January 2026 laws. Laws keep being passed, so check the IAPP's state tracker for anything newer than the date at the top of this page.
- California — California Consumer Privacy Act, amended by the CPRA. See our CCPA deletion request template.
- Virginia — Consumer Data Protection Act, effective January 1, 2023.
- Colorado — Colorado Privacy Act, effective July 1, 2023.
- Connecticut — Connecticut Data Privacy Act, effective July 1, 2023.
- Utah — Utah Consumer Privacy Act, effective December 31, 2023.
- Texas — Texas Data Privacy and Security Act, effective July 1, 2024.
- Oregon — Oregon Consumer Privacy Act, effective July 1, 2024.
- Montana — Montana Consumer Data Privacy Act, effective October 1, 2024.
- Delaware, Iowa, Nebraska and New Hampshire — effective January 1, 2025.
- New Jersey — New Jersey Data Privacy Act, effective January 15, 2025.
- Tennessee — Tennessee Information Protection Act, effective July 1, 2025.
- Minnesota — Minnesota Consumer Data Privacy Act, effective July 31, 2025.
- Maryland — Maryland Online Data Privacy Act, effective October 1, 2025.
- Indiana, Kentucky and Rhode Island — effective January 1, 2026.
Florida also has a law (the Florida Digital Bill of Rights, effective July 1, 2024), but it applies only to companies with more than $1 billion in annual global revenue that also meet one of a few further tests, such as running an app store or a smart-speaker service.
Enacted but not yet in force: Oklahoma's law was enacted in March 2026 and takes effect January 1, 2027. Alabama's Personal Data Protection Act was signed on April 16, 2026 and takes effect May 1, 2027.
How the right to delete works under these laws
Virginia's law was the model for many of the others, so it is a useful reference. Under Code of Virginia §59.1-577, a consumer has the right:
To delete personal data provided by or obtained about the consumer.
That wording matters for people-search sites and data brokers. "Obtained about" reaches data a company collected from somewhere other than you, which is how brokers build profiles. The Connecticut Attorney General describes Connecticut's right the same way: it covers data collected by a company from third parties as well as data you provided.
The same Virginia section sets the procedure most of the states share:
- 45 days to respond. The company must respond within 45 days of receiving your request.
- One extension. It may extend once by another 45 days "when reasonably necessary," if it tells you within the first 45 days.
- Free of charge. Responses are free up to twice a year, unless a request is manifestly unfounded, excessive or repetitive.
- An appeal process. If the company refuses, it must offer a way to appeal. It then has 60 days to answer the appeal in writing.
- The Attorney General. If the appeal is denied, the company must tell you how to contact the Attorney General to submit a complaint.
Connecticut's Attorney General describes the same 60-day appeal response, and directs consumers to choose "Consumer Data Privacy" on its online complaint form. Details differ from state to state, so treat Virginia as the pattern, not the rule for every law.
Limits that apply almost everywhere
- Size thresholds. These laws generally apply only to businesses above thresholds set in each statute, usually tied to how many state residents' data they process or how much revenue they make from selling data. A small site may be outside the law.
- Publicly available information is excluded. Virginia's definition of personal data excludes "publicly available information," which includes information lawfully made available through government records. Other states use similar definitions. A site that republishes property or court records may rely on this.
- Exemptions. Data regulated by other laws, such as consumer reports under the Fair Credit Reporting Act, is often carved out. See what background check companies can keep under the FCRA.
- No private lawsuit. These laws are generally enforced by the state Attorney General, not by individuals suing.
A letter you can send
This is the general US-state letter the free OptStub kit produces. It does not name a statute because the right section depends on your state; you can add your state's law by name if you know it.
To: [the company's privacy request address]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your city, state]
Address: [optional: the address the listing shows]
Phone: [optional]
Email: [optional]
Profile URL: (paste the URL of your profile page here)
I am making this request under my state's comprehensive consumer
privacy law, and any equivalent right otherwise available to me.
You must respond within 45 days of receipt, and I reserve the
right to appeal a refusal.
Please confirm in writing when the deletion is complete.
Most of these laws also give you the right to opt out of the sale of personal data and of targeted advertising, which is why the letter asks the company to stop selling or sharing as well as delete.
If you live in a state without one of these laws
You can still ask. Many people-search sites run an opt-out form that anyone can use, whatever state they live in, and our opt-out guides show each site's own process. The difference is that without a state law there is no statutory deadline and no appeal step to point to.
After you send it
Write down the date you sent each request and the date 45 days later. If a company misses the deadline, refuses without a reason, or doesn't offer an appeal, see what to do if a data broker ignores you. Removal is not guaranteed: a company may rely on an exemption, and brokers can re-list data from new sources, so check your listings again after each deadline passes.