Learn About Data Deletion Options and Privacy

Understanding Data Deletion: What It Means and Why It Matters

Data deletion is the process of removing personal information that companies, websites, and organizations have collected about you. This information might include your name, address, phone number, email, browsing history, purchase records, location data, and much more. When you delete data, you're requesting that these organizations permanently remove or destroy the records they hold about you.

Every time you use the internet, make a purchase, or interact with a business, data gets collected. Retailers track what you buy. Social media platforms record what you like and share. Search engines keep records of your searches. Websites monitor which pages you visit and how long you stay on them. Insurance companies, banks, and healthcare providers maintain detailed files. Data brokers—companies you've probably never heard of—purchase and sell your information to third parties. Over time, these organizations build extensive profiles about your habits, preferences, and behavior.

Understanding data deletion matters because having less information circulating about you means fewer opportunities for that data to be misused. It reduces the risk of identity theft, since criminals can't steal information that doesn't exist. It also limits how much companies can use your personal details for targeted advertising or discrimination. For example, if a lender doesn't have your full financial history, they have fewer ways to deny you credit based on protected characteristics.

Data deletion isn't about erasing yourself from the internet entirely—that's not realistic. Rather, it's about controlling which organizations hold information about you and for how long. Think of it like cleaning out old files from your home office. You don't throw out everything, but you get rid of documents you no longer need and that pose security risks. This guide explains the different ways you can request deletion and what options may be available to you.

Practical takeaway: Start by identifying which companies likely have your data. Think about where you shop online, which websites you use regularly, and which apps you've downloaded. These organizations all maintain files about you that could potentially be deleted upon request.

Consumer Rights: State Laws and Data Deletion Requests

Several U.S. states have passed laws that give consumers the right to request deletion of their personal data. These laws are relatively recent, with the most significant changes occurring between 2018 and 2023. California's Consumer Privacy Act (CCPA), which went into effect in 2020, was one of the first major privacy laws in the United States. It gives California residents the right to request that companies delete personal information collected from them, with some exceptions for legal or business purposes.

Other states have followed with similar legislation. Virginia's Consumer Data Protection Act, Colorado's Privacy Act, Connecticut's Data Privacy Act, and Utah's Consumer Privacy Act all include data deletion rights. These laws define "personal information" broadly to include identifiers, commercial information, biometric information, internet activity, geolocation data, and inferences drawn from data. The specifics vary by state—for example, some laws apply only to for-profit businesses that meet certain size thresholds, while others have broader reach.

Most state laws include important exceptions to deletion rights. Companies may retain data if they need it to complete a transaction you requested, comply with legal obligations, detect security fraud, or comply with other laws. For example, a retailer can keep purchase records for tax purposes. A bank must keep records for regulatory requirements. These exceptions ensure that deletion rights don't interfere with legitimate business operations or legal compliance.

To exercise deletion rights under these laws, you typically must submit a written request to a company. The company then has a specific timeframe—usually 30 to 45 days—to respond. They should either delete your data or explain why they can't. Some companies make this process straightforward by providing online forms. Others may require you to submit requests by mail or email. Many companies now offer a "Do Not Sell My Personal Information" link on their websites, which can be a starting point for deletion requests.

If you don't live in a state with a consumer privacy law, deletion rights may still be available to you in specific situations. For instance, the Health Insurance Portability and Accountability Act (HIPAA) gives patients the right to request amendments or corrections to their medical records. The Fair Credit Reporting Act allows consumers to dispute inaccurate information on credit reports. The Children's Online Privacy Protection Act (COPPA) gives parents rights over children's online data. Understanding which laws apply to your situation helps you know what rights you can exercise.

Practical takeaway: Check whether your state has passed a consumer privacy law. If it has, review the law's requirements and the companies it covers. Many state attorney general websites provide information about these laws and how to submit requests. If you don't live in a privacy-protected state, look for industry-specific laws that might apply to your data.

How to Submit Data Deletion Requests to Companies

Submitting a data deletion request requires you to contact a company directly and clearly state what you want. Start by identifying the company's privacy contact information. Most large companies maintain a privacy policy on their website that includes an email address or web form for privacy requests. Look for links labeled "Privacy," "Your Privacy Choices," "Data Subject Requests," or "Contact Us." Some companies have dedicated privacy teams that handle these requests separately from customer service.

When you submit a request, you should include specific information to make it clear who you are. Provide your full name, account number (if you have one), email address, and any other identifier the company uses for you. State clearly that you are requesting deletion of your personal data under applicable privacy laws. You might say: "I request that you delete all personal information you hold about me as permitted under [your state's privacy law]." Be specific about which information you want deleted if possible, though you can also request deletion of all personal information the company holds.

Keep records of your request. Save copies of any emails you send, take screenshots of web forms you submit, and note the date and method of your request. This documentation helps if you need to follow up or file a complaint later. Consider sending requests through trackable methods like registered mail or email with read receipts if you're mailing a request.

Be prepared for common responses. Companies may request additional information to verify your identity, which is a legitimate security measure. They might ask you to confirm your identity by providing passwords, the last four digits of an account number, or answering security questions. Provide this information so the company can verify you're actually the person the data belongs to. This protects you by preventing unauthorized deletion requests.

If a company denies your deletion request, they must provide a reason. Common reasons include: the data is needed to complete a transaction, the company is legally required to keep the data, the data is essential to detect fraud or prevent crime, or the data is necessary for another lawful business purpose. If you believe the denial is improper, you can file a complaint with your state's attorney general's office or the Federal Trade Commission. These agencies can investigate whether companies are properly following deletion laws.

Some companies use third-party services to manage privacy requests. If you submit a request through a company's website, you might be redirected to a service like TrustArc or OneTrust, which verifies your identity and manages the deletion process. This is normal. The company remains responsible for fulfilling your request, regardless of which service handles it.

Practical takeaway: Start with companies where you have active accounts or maintain regular relationships. These are often easiest to contact and most responsive to requests. Save all documentation of your requests for your records.

Data Brokers and Third-Party Deletion Options

Data brokers are companies that collect, buy, and sell personal information about millions of people without your knowledge or permission. They gather data from public records, purchase transactions, website interactions, and other sources. They then package this information and sell it to advertisers, marketers, insurance companies, employers, and other buyers. Unlike the direct relationships you have with retailers or social media platforms, you probably don't interact with data brokers directly, which makes them harder to control.

Examples of data brokers include companies like Spokeo, BeenVerified, Intelius, and PeopleFinders. These companies operate by aggregating public information—voter registrations, property records, court documents—and combining it with other purchased data to create detailed profiles. Other data brokers are less visible to consumers. For instance, Experian and Equifax collect financial and credit information. LexisNexis maintains insurance claims data. Acxiom aggregates purchasing and behavioral information. Many of these brokers resell the same data multiple times to different clients.