Blog

Your privacy rights by state: CCPA, California's Delete Act and other state laws

ยท 5 min read

The United States has no single, comprehensive federal privacy law. Instead, a growing list of states have passed their own consumer privacy laws, and a few have laws aimed specifically at data brokers. This guide explains, in plain English, what those laws generally let you do and how to use them. It is general information, not legal advice; for your specific situation, check your state attorney general's website or talk to a lawyer.

The short version

  • About 20 states now have comprehensive consumer privacy laws. California's is the oldest and broadest.
  • These laws generally let residents see, correct and delete personal data a covered business holds about them, and opt out of the sale of their data and targeted advertising.
  • California goes further for data brokers: since January 1, 2026, Californians can use one state platform, called DROP, to ask every registered data broker to delete their data.
  • People-search opt-outs work everywhere. Even where no state law applies, most people-search sites offer an opt-out to anyone.

California: the CCPA

The California Consumer Privacy Act (CCPA), expanded by the California Privacy Rights Act, gives California residents the right to:

  • Know what personal information a business collects about them and how it is used and shared
  • Delete personal information the business collected from them, with some exceptions
  • Correct inaccurate personal information
  • Opt out of the sale or sharing of their personal information
  • Limit the use of sensitive personal information, such as precise location
  • Not be discriminated against for using these rights

The law applies to for-profit businesses that meet certain size or data thresholds, not to every company.

How long businesses have to respond: under the California Attorney General's guidance, a business must respond to a deletion request within 45 calendar days, and can extend that once by another 45 days if it tells you.

Authorized agents: the CCPA lets you use an authorized agent to make requests on your behalf. The business can ask for proof that you gave the agent permission and may ask you to verify your identity directly.

Global Privacy Control: in California, a business must treat a Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your data. Colorado and a growing number of other states also require businesses to honor universal opt-out signals.

California's Delete Act and DROP

California's Delete Act targets data brokers specifically. Data brokers must register with the California Privacy Protection Agency every year, and the state publishes the registry online.

The law also created the Delete Request and Opt-out Platform (DROP). It works like this:

  1. A California resident submits one deletion request through the state's DROP website. It launched for consumers on January 1, 2026.
  2. Starting August 1, 2026, registered data brokers must access DROP at least once every 45 days, match the requests against their records, and process deletions.
  3. The state says it can take up to 90 days for your request status to update in DROP.

DROP covers registered data brokers, not every business. It is a powerful tool for Californians, and it works alongside site-by-site opt-outs rather than replacing them.

Other states with comprehensive privacy laws

Comprehensive privacy laws are now in effect in states including Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, in addition to California. The details differ, but most give residents rights to:

  • Confirm whether a business is processing their data, and get a copy
  • Correct inaccuracies (most states)
  • Delete their data
  • Opt out of targeted advertising, the sale of their data, and certain kinds of profiling

Most of these laws give businesses 45 days to respond, with a possible extension. Some let you use an authorized agent for certain requests, such as opt-outs.

Data broker registries

Besides California, Vermont, Texas and Oregon require data brokers to register with the state. Registries don't remove your data by themselves, but they show which companies call themselves data brokers and often list how to contact them or opt out.

An important limit: public records

Most state privacy laws exclude publicly available information, such as data lawfully drawn from government records. Because many people-search listings are built from property, court and other public records, a legal deletion request may not reach everything on a listing.

That is why voluntary opt-outs still matter. Most people-search sites offer an opt-out to anyone, in every state, regardless of whether a privacy law applies. See our guides to how people-search sites get your information and removing yourself from data brokers.

How to use your rights

  1. Find the business's privacy request page. It is usually linked from the privacy policy or a "Your Privacy Choices" or "Do Not Sell or Share" link in the site footer.
  2. Use the method the business designates. Requests sent another way may not count.
  3. Expect to verify your identity. Share only what is needed to match your record.
  4. Keep a record of what you sent and when, and follow up if the deadline passes.
  5. If a business ignores a valid request, you can file a complaint with your state attorney general, or in California, with the California Privacy Protection Agency.

How ShieldApps Privacy helps

ShieldApps Privacy works in all 50 states. Your signed authorization lets us act as your agent and send the opt-out and deletion requests you choose, in your name. We search the sites on our list that allow automated searches, send requests where we support the site's opt-out form, and give you step-by-step instructions for the rest. Some states' privacy laws give you extra rights, such as California's DROP deletion request, and your dashboard shows the options that apply where you live. We actively monitor for new and returning listings and email you progress reports. Our own privacy rights page explains how to make a request about the data we hold. See plans and pricing.