Consumer privacy requests: deletion request records and request submission methods

The law closes a gap that let businesses keep and use consumer data acquired from third parties after a deletion request. It also requires online-only businesses with direct consumer relationships to offer an online way to submit privacy requests.

What the law does ​

• Expands deletion requests to cover any personal information a business collected from or about a consumer.
• Requires businesses to delete requested data, direct service providers and contractors to delete it, and notify relevant third parties, unless doing so is impossible or disproportionately burdensome.
• Lets businesses that obtained data from another source retain the deletion-request record and only the minimum data needed to keep the consumer's information deleted and unused.
• Requires exclusively online businesses with direct consumer relationships to provide both an email address and an online request method, such as a web form or portal.

Who it affects ​

• Consumers seeking to delete personal information held by businesses.
• Businesses covered by the California Consumer Privacy Act, including businesses that obtain consumer data from third parties.
• Service providers, contractors, and third parties that receive consumer personal information from those businesses.

Context ​

The law furthers the purposes and intent of the California Privacy Rights Act of 2020.