ccpa-right-to-delete

Implements CCPA Section 1798.105 right to delete and CPRA amendments including service provider obligations, statutory exceptions for legal, security, and internal uses, consumer identity verification procedures, and 45-day response timeline management. Activate for CCPA deletion, CPRA right to delete, California privacy, consumer deletion queries.

Ir a la instalación

Repositorio: ThomasMoreAI/legal-skills-open
Última actividad en el origen: 1 de junio de 2026 a las 17:27
Idioma detectado de SKILL.md: inglés
Estrellas: 40
Forks: 4

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill ccpa-right-to-delete

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

name	ccpa-right-to-delete
title	CCPA/CPRA Right to Delete
description	Implements CCPA Section 1798.105 right to delete and CPRA amendments including service provider obligations, statutory exceptions for legal, security, and internal uses, consumer identity verification procedures, and 45-day response timeline management. Activate for CCPA deletion, CPRA right to delete, California privacy, consumer deletion queries.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/ccpa-right-to-delete
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	data-protection
language	en

CCPA/CPRA Right to Delete

Overview

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants California consumers the right to request deletion of personal information collected about them. This right is codified in Cal. Civ. Code Section 1798.105. Unlike the GDPR right to erasure which requires establishing one of six grounds, the CCPA right to delete is a more direct right — the consumer simply requests deletion and the business must comply unless a specific exception applies. The CPRA amendments expanded the obligations and introduced the California Privacy Protection Agency (CPPA) as the dedicated enforcement body. This skill covers the complete operational framework for receiving, verifying, assessing, and fulfilling deletion requests under CCPA/CPRA.

Legal Foundation

CCPA Section 1798.105 — Consumer's Right to Delete Personal Information

(a) A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.

(b) A business that collects personal information about consumers shall disclose the consumer's right to request deletion of the consumer's personal information.

(c) A business that receives a verifiable consumer request to delete the consumer's personal information shall delete the consumer's personal information from its records, notify any service providers or contractors to delete the consumer's personal information from their records, and notify all third parties to whom the business has sold or shared the consumer's personal information to delete the consumer's personal information unless this proves impossible or involves disproportionate effort.

(d) A business, service provider, or contractor shall not be required to comply with a consumer's request to delete the consumer's personal information if it is reasonably necessary for the business, service provider, or contractor to maintain the consumer's personal information in order to: [see exceptions below].

CPRA Amendments (Effective January 1, 2023)

Key CPRA changes affecting the right to delete:

Extended to service providers and contractors: Businesses must direct service providers and contractors to delete, not just notify them.
Third-party notification: Businesses must notify third parties to whom personal information was sold or shared to also delete.
CPPA enforcement: The California Privacy Protection Agency has rulemaking and enforcement authority.
Expanded definitions: "Sharing" (for cross-context behavioral advertising) added alongside "selling."

Exception	Description	Example at Orion Data Vault Corp
(d)(1) Complete the transaction	Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall, provide a good or service requested by the consumer, or reasonably anticipated within the context of a business's ongoing business relationship with the consumer	Active subscription or service delivery
(d)(2) Detect security incidents	Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity	Fraud investigation records, security incident logs
(d)(3) Debug	Debug to identify and repair errors that impair existing intended functionality	Error logs, crash reports tied to consumer account
(d)(4) Free speech	Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law	User-generated content on public forums
(d)(5) CCPA research	Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deletion is likely to render impossible or seriously impair the research	Anonymized research datasets (must meet CCPA research standards)
(d)(6) Internal use aligned with expectations	Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with the business	Service improvement analytics based on consumer's direct interactions
(d)(7) Legal obligation	Comply with a legal obligation	Tax records, AML records, employment records
(d)(8) Internal use — lawful and compatible	Otherwise use the consumer's personal information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information	Business operations where consumer reasonably expects data use
(d)(9) Comply with other law	Comply with federal, state, or local laws	HIPAA, FCRA, GLBA requirements

Verification Level	When Required	Methods
Reasonable degree of certainty	Deletion requests (standard)	Match at least 2 data points provided by consumer against information already maintained
Reasonably high degree of certainty	Deletion requests involving sensitive personal information or where deletion could cause significant harm to the consumer if incorrect	Match at least 3 data points + signed declaration under penalty of perjury

Method	Description	Data Points Matched
Account-based verification	Consumer logs into their verified account	Account credentials constitute verification
Email verification	Send verification link to email address on file	Email address + 1 additional data point
Knowledge-based verification	Ask consumer to confirm information only they would know	2-3 data points (name, address, transaction history, phone)
Government ID	Request government-issued identification	Use only when other methods insufficient; destroy copy after verification
Signed declaration	Request signed declaration under penalty of perjury	Required for high-certainty verification; supplements other methods

Milestone	Deadline	Action
Acknowledgement	10 business days from request receipt	Confirm receipt; provide expected completion date
Verification completion	As soon as practicable	Complete identity verification; if unable to verify, notify consumer
Response	45 calendar days from verifiable request receipt	Complete deletion and notify consumer; OR invoke extension
Extension (if needed)	Additional 45 calendar days (90 total)	Notify consumer of extension within initial 45 days; explain reason
Deletion completion	Within response deadline	Delete from business systems; direct service providers/contractors to delete; notify third parties

Aspect	CCPA Right to Delete	GDPR Right to Erasure
Grounds required	No — consumer simply requests deletion	Yes — must establish one of six grounds under Art. 17(1)
Scope	Personal information collected FROM the consumer	Personal data concerning the data subject (broader — includes data obtained from other sources)
Response timeline	45 calendar days (extendable to 90)	30 calendar days (extendable to 90)
Verification	Explicit verification requirements with defined certainty levels	Identity verification required but method at controller's discretion
Service provider obligations	Explicit — must direct service providers/contractors to delete	Implicit — controller must ensure processors delete under Art. 28
Third-party notification	Must notify third parties to whom PI was sold/shared	Must inform other controllers to whom data was disclosed (Art. 17(2) + Art. 19)
Exceptions	9 enumerated exceptions under §1798.105(d)	5 exceptions under Art. 17(3)
Enforcement	CPPA and California AG; private right of action limited to data breaches	Supervisory authorities; broader private right of action

ccpa-right-to-delete

Opciones de instalación

Revisa los archivos de origen

CCPA/CPRA Right to Delete

Overview

Legal Foundation

CCPA Section 1798.105 — Consumer's Right to Delete Personal Information

CPRA Amendments (Effective January 1, 2023)

CCPA Regulations (11 CCR Division 6)

CCPA/CPRA Right to Delete

Overview

Legal Foundation

CCPA Section 1798.105 — Consumer's Right to Delete Personal Information

CPRA Amendments (Effective January 1, 2023)

CCPA Regulations (11 CCR Division 6)

Exceptions to Deletion

CCPA Section 1798.105(d) — Nine Exceptions

Exception Assessment Procedure

Verification Procedures

Consumer Identity Verification Requirements

Verification Methods

Verification Workflow

Authorized Agents

Response Timeline

45-Day Response Period

Response Content Requirements

Service Provider and Contractor Obligations

Flow-Down Deletion Requirements

Service Provider Agreement Requirements

Differences from GDPR Right to Erasure

Monitoring and Compliance Reporting

CCPA Deletion Request Metrics

Annual CCPA Privacy Metrics Disclosure

Metric	Target	Reporting
Requests received (quarterly)	Track volume and trend	Quarterly to CPPA (if required)
Median response time	≤ 30 calendar days	Quarterly
Requests completed within 45 days	≥ 95%	Quarterly
Requests requiring extension	≤ 10%	Quarterly
Requests denied (with exception)	Track percentage and exception type breakdown	Quarterly
Service provider deletion confirmation rate	100% within 20 business days	Per request
Consumer appeals filed	Track volume and outcome	Quarterly

ccpa-right-to-delete

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

CCPA/CPRA Right to Delete

Overview

Legal Foundation

CCPA Section 1798.105 — Consumer's Right to Delete Personal Information

CPRA Amendments (Effective January 1, 2023)

CCPA Regulations (11 CCR Division 6)

CCPA/CPRA Right to Delete

Overview

Legal Foundation

CCPA Section 1798.105 — Consumer's Right to Delete Personal Information

CPRA Amendments (Effective January 1, 2023)

CCPA Regulations (11 CCR Division 6)

Exceptions to Deletion

CCPA Section 1798.105(d) — Nine Exceptions

Exception Assessment Procedure

Verification Procedures

Consumer Identity Verification Requirements

Verification Methods

Verification Workflow

Authorized Agents

Response Timeline

45-Day Response Period

Response Content Requirements

Service Provider and Contractor Obligations

Flow-Down Deletion Requirements

Service Provider Agreement Requirements

Differences from GDPR Right to Erasure

Monitoring and Compliance Reporting

CCPA Deletion Request Metrics

Annual CCPA Privacy Metrics Disclosure