| name | ccpa-right-to-delete |
| title | CCPA/CPRA Right to Delete |
| description | Implements CCPA Section 1798.105 right to delete and CPRA amendments including service provider obligations, statutory exceptions for legal, security, and internal uses, consumer identity verification procedures, and 45-day response timeline management. Activate for CCPA deletion, CPRA right to delete, California privacy, consumer deletion queries. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/ccpa-right-to-delete |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
CCPA/CPRA Right to Delete
Overview
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants California consumers the right to request deletion of personal information collected about them. This right is codified in Cal. Civ. Code Section 1798.105. Unlike the GDPR right to erasure which requires establishing one of six grounds, the CCPA right to delete is a more direct right — the consumer simply requests deletion and the business must comply unless a specific exception applies. The CPRA amendments expanded the obligations and introduced the California Privacy Protection Agency (CPPA) as the dedicated enforcement body. This skill covers the complete operational framework for receiving, verifying, assessing, and fulfilling deletion requests under CCPA/CPRA.
Legal Foundation
CCPA Section 1798.105 — Consumer's Right to Delete Personal Information
(a) A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.
(b) A business that collects personal information about consumers shall disclose the consumer's right to request deletion of the consumer's personal information.
(c) A business that receives a verifiable consumer request to delete the consumer's personal information shall delete the consumer's personal information from its records, notify any service providers or contractors to delete the consumer's personal information from their records, and notify all third parties to whom the business has sold or shared the consumer's personal information to delete the consumer's personal information unless this proves impossible or involves disproportionate effort.
(d) A business, service provider, or contractor shall not be required to comply with a consumer's request to delete the consumer's personal information if it is reasonably necessary for the business, service provider, or contractor to maintain the consumer's personal information in order to: [see exceptions below].
CPRA Amendments (Effective January 1, 2023)
Key CPRA changes affecting the right to delete:
- Extended to service providers and contractors: Businesses must direct service providers and contractors to delete, not just notify them.
- Third-party notification: Businesses must notify third parties to whom personal information was sold or shared to also delete.
- CPPA enforcement: The California Privacy Protection Agency has rulemaking and enforcement authority.
- Expanded definitions: "Sharing" (for cross-context behavioral advertising) added alongside "selling."
CCPA Regulations (11 CCR Division 6)
