California Data Privacy Rights: How to Use CCPA to Delete Your Info

California has the strongest consumer data privacy law in the United States. The California Consumer Privacy Act gives residents sweeping rights over their personal information — including the right to demand that data brokers permanently delete it. Here is exactly what the law gives you and how to use it.

What Is the CCPA?

The California Consumer Privacy Act (CCPA) was signed into law in 2018 and took effect January 1, 2020. It was subsequently strengthened by the California Privacy Rights Act (CPRA), which voters approved in November 2020 and which became fully enforceable January 1, 2023.

Together, these laws give California residents five core rights over their personal data:

Critically, the CCPA applies to any business that meets certain thresholds and handles California residents' data — regardless of where the business itself is located. A data broker headquartered in Delaware that collects data on California residents is still bound by the law.

The California Delete Act (2023)

In September 2023, Governor Gavin Newsom signed Senate Bill 362, commonly known as the California Delete Act. It meaningfully extends the CCPA's practical reach.

The Delete Act creates a single opt-out mechanism for all data brokers registered with the California Privacy Protection Agency (CPPA). By 2026, every registered data broker in California must honor deletion requests submitted through the CPPA's authorized agent system. A consumer, or an authorized agent acting on their behalf, can submit one request and have it honored across every registered broker simultaneously.

This is the legal framework that makes services like GhostVault possible. When GhostVault submits deletion requests on your behalf, it is acting as your authorized agent under CCPA and the Delete Act — using the same legal mechanism you would use yourself, but automating it across hundreds of brokers at once.

Who Is Covered by the CCPA?

The CCPA applies to for-profit businesses that do business in California and meet at least one of these thresholds:

• Annual gross revenues exceeding $25 million
• Annually buys, sells, receives, or shares the personal data of 100,000 or more consumers or households
• Derives 50% or more of annual revenues from selling or sharing consumers' personal information

Virtually every major data broker qualifies under the second threshold — selling or sharing data on 100,000+ individuals is their core business model. This means the CCPA reachesSpokeo, WhitePages, BeenVerified, Intelius, Radaris, MyLife, and hundreds more.

What You Can Request Be Deleted

The CCPA covers a broad range of personal information. You can request deletion of:

• Name, address, phone number, and email address
• Social Security number and driver's license number
• Purchase history and browsing or search history
• IP address and other online identifiers
• Biometric data (fingerprints, face scans, voice recordings)
• Geolocation data
• Inferences drawn about you — such as inferred income, interests, or creditworthiness
• Relatives' names and household composition data

How to Submit a CCPA Deletion Request Yourself

If you want to submit deletion requests manually, here is the process for each data broker:

1. 1. Find the opt-out page. The CCPA requires every covered business to include a "Do Not Sell or Share My Personal Information" link on their homepage — typically in the footer. If you cannot find it, check their Privacy Policy or search Google for "[company name] do not sell my information."
2. 2. Locate your profile. Use the site's search function with your name and city to find your specific listing before submitting, so you can reference it in the request.
3. 3. Submit the request. Most brokers have a webform. You will typically need to provide your name, email address, state of residence, and sometimes the URL of your specific listing.
4. 4. Verify your identity. Many brokers require you to click a verification link sent to your email before they will process the request. Without completing this step, most brokers will not act on the deletion.
5. 5. Wait for the response. Under the CCPA, businesses must respond within 45 days, with a one-time extension of an additional 45 days if they notify you.
6. 6. Follow up if there is no response. If a broker does not respond or refuses without a valid reason, you can escalate to the California Privacy Protection Agency at cppa.ca.gov.

The catch: you must repeat this entire process for each of the 500+ registered data brokers separately. There are no shortcuts in the manual approach.

Using an Authorized Agent

The CCPA explicitly allows you to designate an authorized agent to submit privacy requests on your behalf. An authorized agent can exercise any of your CCPA rights — including the right to deletion — provided you have given them written permission.

This is precisely how GhostVault operates. When you sign up, you authorize GhostVault to act as your agent under California privacy law. GhostVault then submits CCPA-compliant deletion requests to 500+ registered data brokers on your behalf — using the same legal mechanism you would use manually, but doing it automatically and continuously as brokers re-add data over time.

What Happens If a Broker Doesn't Comply?

The California Privacy Protection Agency (CPPA) is the dedicated enforcement body for the CCPA and CPRA. It has the authority to:

• Fine businesses up to $2,500 per unintentional violation
• Fine businesses up to $7,500 per intentional violation
• Issue injunctions and compliance orders
• Audit businesses for compliance

The 2023 Delete Act also established a Data Broker Strike Force — a joint enforcement initiative between the CPPA and the California Attorney General's office — specifically tasked with pursuing non-compliant data brokers. Several brokers have already received enforcement actions and fines for failure to honor deletion requests and failure to register with the state.

Am I Protected If I Don't Live in California?

Technically, the CCPA only applies to California residents. However, in practice, most major data brokers honor CCPA deletion requests from residents of all US states. There are two main reasons:

1. 1. Operational impracticality. It is extremely difficult for a broker to verify a requestor's state of residency at the time of each request. Rather than risk violating the law, most brokers apply their CCPA compliance procedures universally.
2. 2. Other states have passed similar laws. As of 2026, more than a dozen states have enacted comprehensive consumer privacy legislation.

Whether you live in California or not, CCPA-style deletion requests work for most Americans today — and they'll carry more weight as additional states pass similar laws.