Data Removal Requests: Documenting What Happens Next

Sending data removal requests is the easy part. The hard part is knowing whether anything happened: which companies responded, which ones deleted your information, which asked for more details, and which went quiet. Without a record, it’s difficult to follow up, and nearly impossible to escalate.

The short answer: log every data removal request with the date, method, and confirmation number, and note when a response is due. In California, businesses must respond to a deletion request within 45 calendar days, and may extend that once by 45 days if they tell you. When a response arrives, check whether your information was actually removed, follow up in writing if it wasn’t, and escalate to the state regulator if a company ignores a valid request.

First, know which right you’re using

A deletion request carries the most weight when a law requires the company to act on it. California residents have the right to ask businesses covered by the California Consumer Privacy Act to delete personal information collected from them, and to tell their service providers to do the same (California Attorney General). A growing number of other states give residents similar rights, but the details, deadlines, and covered businesses vary.

Many people-search sites also offer an opt-out process even where no law requires it. Those requests still deserve a record. The log is often your only proof that you asked.

Start a request log before you send anything

A one-page log turns scattered emails into evidence. Track each company on its own row:

Alongside the log, save:

• the confirmation page or email for each request (a screenshot or PDF works);
• any verification request and what you sent in reply;
• the company’s response, word for word;
• before-and-after screenshots of any listing about you.

Our Digital Evidence Checklist explains how to save screenshots and emails so they hold up later.

Step 1: Send the request through the company’s designated method

Under the CCPA, businesses must designate at least two ways to submit a request, such as a web form, email, phone number, or mail; businesses that operate only online need to provide only an email address. They can’t require you to create an account just to submit a deletion request (California Attorney General).

Check the company’s privacy policy for its designated methods and use one of them. If a company later says it never received your request, a submission through its own listed channel, with a saved confirmation, is the strongest answer.

Step 2: Expect a verification step

Businesses must verify that the person asking for deletion is the person the information is about. Failing verification is one of the common reasons a business keeps information (California Attorney General).

Respond to verification requests promptly and log them, because unanswered verification can stall a request. Provide what’s needed to match you to the record, and if a request seems excessive, ask the company why it needs that information before you send it.

Step 3: Track the response deadline

In California, businesses must respond to a deletion request within 45 calendar days. They can extend the deadline by another 45 days, to 90 days in total, if they notify you (California Attorney General). Add the due date to your log the day you send the request, and set a reminder for the day after.

Other states set their own deadlines. Check the law where you live, or note the timeframe stated in the company’s privacy policy.

Step 4: Read the response carefully

A response isn’t always a deletion. Here’s what different answers usually mean and what to do next.

The response says…	What it usually means	What to do
Your information has been deleted	The company says it completed the request	Note the date, then recheck the site or service after a few weeks
Some information was kept	The law has exceptions, such as legal obligations or completing a transaction	Ask which exception applies and what was kept, and log the answer
We couldn’t verify your identity	The request is on hold or closed	Complete verification through the company’s method, or ask what else it needs
The law doesn’t apply to us or to you	The company says it isn’t covered, or you aren’t a resident of a state with these rights	Ask the basis for that position in writing; use the site’s voluntary opt-out if one exists
No response	The deadline may have passed	Follow up in writing, citing your original request date, then escalate

The California Attorney General notes that there are many exceptions allowing businesses to keep personal information, including to meet legal obligations and to complete transactions (California Attorney General).

Step 5: Confirm the information is actually gone

A confirmation email is a claim, not proof. After the company says it deleted your information, search for yourself again on that site or service and save a screenshot. Compare it with the “before” screenshot in your log.

People-search and data broker listings can reappear when a company collects new records about you. Put a recheck date in your log, every few months for sites that listed you before, and send a new request if a listing returns.

Step 6: Follow up, then escalate

If the deadline passes without a response, or the response doesn’t match what you see, send a short written follow-up. Include your original request date, your confirmation number, and what you’re asking for. The California Attorney General suggests checking that you used the business’s designated method and following up with the business to confirm it’s subject to the CCPA (California Attorney General).

If that doesn’t work, Californians can file a complaint with the California Privacy Protection Agency or the Attorney General. Neither office represents individual consumers, but complaints can lead to enforcement against patterns of misconduct. Outside California, contact your state attorney general’s consumer protection office.

Your log is what makes a complaint effective. Attach it, along with the confirmations and responses, so the regulator can see the timeline at a glance.

If you live in California: use DROP for data brokers

California’s Delete Request and Opt-out Platform, known as DROP, lets residents send one request asking every registered data broker to delete their personal information and stop selling it (privacy.ca.gov). Key points:

• It’s free. The state says it will never charge you to use DROP.
• DROP opened to consumers on January 1, 2026. Starting August 1, 2026, registered data brokers must access it at least every 45 days to process requests (CPPA).
• Brokers must report the status of each request within 45 days of retrieving it (CPPA), and you can check your status in DROP. Updates can take up to 90 days, and timing varies by broker (privacy.ca.gov).
• It covers registered data brokers. Companies you deal with directly, such as a store or app you use, still need their own deletion request. California’s data broker registry shows which businesses registered.

Record your DROP submission date and status in your log, just as you would for any other request.

If you live outside California

There is no national one-step tool. Send requests to each company or data broker individually, using the method in its privacy policy, and use the same log. Check whether your state has a comprehensive privacy law and what deadline it sets, and keep using voluntary opt-out processes where no law applies.

When removal is about safety, not just privacy

If someone is using your information or images to impersonate or harass you, deletion requests are only one step. See our guide on what to do when there’s a fake profile using your photos. If your information was exposed in a breach, our explainer on what a breach notice actually tells you covers what that exposure means.

Frequently asked questions

How long does a company have to respond to a data removal request?

Under California’s CCPA, 45 calendar days, extendable once by another 45 days if the company notifies you. Other states set their own deadlines.

What should I do if a data broker ignored my deletion request?

Check that you used its designated method, then follow up in writing with your original request date and confirmation number. If it still doesn’t respond, file a complaint with your state regulator, such as the California Privacy Protection Agency.

Does a company have to delete everything I ask it to?

No. Privacy laws include exceptions, such as information needed to meet legal obligations or complete a transaction. Ask which exception applies.

Is California’s DROP really free?

Yes. The state says it will never charge you to use DROP. It’s for California residents and covers registered data brokers.

Why did my information come back after it was removed?

Data brokers can collect new records about you. Recheck sites periodically and send a new request if a listing returns.

Do I need to keep records of my data removal requests?

It isn’t required, but a log with dates, confirmations, and responses is what lets you follow up and file an effective complaint.

Sources

• California Attorney General, California Consumer Privacy Act (CCPA)
• California Privacy Protection Agency, Delete Request and Opt-out Platform (DROP)
• California Privacy Protection Agency, California Approves Delete Act Regulations (Nov. 13, 2025)
• California Privacy Protection Agency, Data Broker Registry
• California Privacy Protection Agency, File a Complaint

This guide is general information, not legal advice. Privacy rights depend on where you live and which company holds your information. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Privacy Rights.