Your Privacy Rights
Your Data Deletion Rights, State by State (2026)
The short version
Nineteen states now have comprehensive privacy laws in force, and every one of them gives residents a right to ask a company to delete their personal data. The rights are narrower than they sound: Iowa and Utah only cover data you handed over yourself, most laws exclude anything drawn from public records, and companies that bought your data from someone else can often "comply" without erasing it. California is the exception - its DROP platform sends one deletion request to more than 575 registered data brokers, and brokers must start processing those requests on August 1, 2026.
Do you actually have the right to delete your data?
It depends entirely on where you live. As of 2026, 19 states have comprehensive consumer privacy laws in force, and each one gives residents a right to ask a company to delete personal data it holds about them. If you live in one of the other 31 states, you have no general deletion right at all.
There is no national privacy law filling the gap. Congress has never passed one, so your rights are an accident of your address: a Coloradan and a Missourian can be listed on the same broker site with the same data, and only one of them can legally demand its removal.
Which states give you a deletion right in 2026
Three new laws switched on this year - Indiana, Kentucky and Rhode Island all took effect January 1, 2026, according to the IAPP's state privacy legislation tracker. Here is the full picture, including the two states whose deletion rights come with a significant asterisk.
| State | Law | In effect since | Right to delete |
|---|---|---|---|
| California | CCPA / CPRA | Jan 1, 2020 | Yes, plus DROP |
| Virginia | VCDPA | Jan 1, 2023 | Yes |
| Colorado | CPA | Jul 1, 2023 | Yes |
| Connecticut | CTDPA | Jul 1, 2023 | Yes |
| Utah | UCPA | Dec 31, 2023 | Only data you provided |
| Texas | TDPSA | Jul 1, 2024 | Yes |
| Oregon | OCPA | Jul 1, 2024 | Yes |
| Florida | FDBR | Jul 1, 2024 | Very large platforms only |
| Montana | MCDPA | Oct 1, 2024 | Yes |
| Delaware | DPDPA | Jan 1, 2025 | Yes |
| Iowa | ICDPA | Jan 1, 2025 | Only data you provided |
| Nebraska | NDPA | Jan 1, 2025 | Yes |
| New Hampshire | NHDPA | Jan 1, 2025 | Yes |
| New Jersey | NJDPA | Jan 15, 2025 | Yes |
| Tennessee | TIPA | Jul 1, 2025 | Yes |
| Minnesota | MCDPA | Jul 31, 2025 | Yes |
| Maryland | MODPA | Oct 1, 2025 | Yes |
| Indiana | INCDPA | Jan 1, 2026 | Yes |
| Kentucky | KCDPA | Jan 1, 2026 | Yes |
| Rhode Island | RIDTPPA | Jan 1, 2026 | Yes |
Effective dates compiled from published state privacy law trackers (IAPP, MultiState, Clym), July 2026. Scope of the deletion right per state law overviews from Privacy Rights Clearinghouse. Trackers differ on whether to count Florida, which is why you will see both "19" and "20" in circulation.
What "delete" actually means in these laws
A deletion right is not an erase button. In practice it is a request you send to one company at a time, that company verifies who you are, and then it deletes what the statute obliges it to delete - which is often less than you assumed when you filed.
The clearest example is the Virginia model, copied by most states that followed. Virginia's law lets you ask a controller to delete data "provided by the consumer or obtained about the consumer," which sounds complete. But a company that got your data from a third party is treated as compliant if it simply keeps a record of your request and opts you out of further processing, per the Privacy Rights Clearinghouse summary of the law.
Read that again if you are targeting data brokers, because brokers are exactly the companies that obtain data from third parties. In a Virginia-style state, a broker can honor your deletion request by writing it down.
Where the deletion right is weakest
Three states stand out for giving less than the headline suggests. If you live in Utah, Iowa or Florida, it is worth knowing the limits before you spend an afternoon filing requests that the law does not actually back.
- Utah and Iowa limit deletion to "personal data provided by the consumer." Data a company collected about you from somewhere else is out of scope. Neither law originally included a right to correct inaccurate data, though Utah added one effective July 1, 2026.
- Florida's Digital Bill of Rights only applies to companies with more than $1 billion in global gross annual revenue that also meet a further test, such as running an app store or drawing most of their revenue from online ads. Almost no data broker qualifies.
- Iowa also has the slowest clock in the country: controllers get 90 days to respond, plus a 45-day extension, where most states allow 45 plus 45.
California is the one state with a real off switch
Everywhere else, deletion means contacting companies one at a time. California residents can send a single request that reaches every data broker registered with the state at once, through a free government platform called DROP - the Delete Request and Opt-out Platform, built under the California Delete Act and run by the California Privacy Protection Agency.
Consumer sign-ups have been open since January 2026, and the deadline that matters is now days away: from August 1, 2026, registered brokers must begin retrieving and processing DROP requests, and must check for new ones at least every 45 days. One request reaches more than 575 registered brokers.
DROP has real edges. It only covers brokers registered with California, not every site that lists you, and it does nothing about companies you have a direct relationship with, search engines, or data covered by the FCRA, GLBA or HIPAA exemptions. Our step-by-step California DROP guide covers the sign-up, and DROP versus a paid removal service covers what it does not reach.
How to file a deletion request and make it count
The mechanics are similar in every state. Find the company's privacy policy, look for the consumer rights or "your privacy choices" section, and use the submission method it names there - a web form, a privacy email address, or a toll-free number. Requests sent to general customer service tend to disappear.
Then the clock starts. In most states the company has 45 days to respond and can take another 45 if it tells you why. Expect to prove who you are, since a company that cannot verify you is allowed to refuse. Keep the confirmation email and the date you filed: that record is what makes an appeal or a complaint possible later.
State laws outside California also require an appeals process for refusals, and the company has to tell you how to use it. If the appeal goes nowhere, escalate - our guide to where to file a privacy complaint walks through the attorney general route.
The public records gap nobody puts in the press release
This limitation undoes the most deletion requests, and it is written into the laws themselves. State privacy statutes exclude "publicly available information" from the definition of personal data. Virginia's law, for instance, exempts information from government records and from widely distributed media.
People-search profiles are assembled largely from exactly that material: property deeds, voter files, court filings, marriage and business records. So a broker can accept your deletion request in good faith, delete the commercially purchased half of your file, and keep publishing the public-record half. The Electronic Privacy Information Center has argued this exemption, along with carve-outs for FCRA and GLBA data, is what lets much of the broker industry stay effectively unregulated.
This is why a legal request and a site-by-site opt-out are different tools. The opt-out asks the site to suppress your listing whatever its source. It is not a legal right in most states, but it is often the thing that actually takes the page down.
The states that make data brokers register
A second, quieter set of laws helps even where deletion rights are thin: broker registration. California, Vermont, Texas and Oregon each require data brokers to register with the state, and the resulting registries are public. That turns an invisible industry into a list you can work through.
Oregon's registry is the most useful for a consumer. Each registered broker's entry includes contact details and opt-out information, so you can go down the list rather than guessing which sites hold you. Texas runs a searchable registry through the Secretary of State under its Data Broker Act. These registries are open to anyone - you do not have to live in the state to read one.
Two more are coming. Connecticut and New Jersey have both passed broker registration requirements that phase in through 2027; New Jersey's law was signed June 30, 2026, with its public registry due to stand up in March 2027.
What to do if your state has no privacy law
Thirty-one states still give you no general deletion right, and waiting for a bill is not a plan. The practical route is the same one Californians use for brokers that DROP does not reach: free, site-by-site opt-outs, which every major people-search site offers to anyone in the US regardless of where they live.
Two other levers help. Many national companies apply one privacy process to all customers because maintaining fifty is more expensive, so it is often worth filing a request even without standing. And "do not sell or share my personal information" links, explained in our guide to that link, are frequently exposed to everyone rather than gated by state.
We keep a library of free, dated opt-out guides for 57 major brokers, plus a walkthrough for what to do if you are not in California. More posts on your legal rights are in the privacy rights section.
Find out who is listing you first
Before you file anything, see which brokers are likely to hold your data and whether your email turns up in a known breach. The scan is free, needs no account, and nothing you type is stored.
Frequently asked questions
Which states let me delete my personal data?
As of 2026, 19 states have comprehensive consumer privacy laws in force, and each gives residents a right to request deletion: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Florida has a law too, but it only covers a handful of very large platforms.
Do I have deletion rights if my state has no privacy law?
You have no general legal right to deletion, but you still have the practical one. Every major people-search site offers a free opt-out to anyone in the US regardless of state, and many national companies apply their California privacy process to all customers because running two systems is more expensive than running one.
How long does a company have to respond to a deletion request?
In most states the deadline is 45 days, extendable by another 45 days if the company tells you why it needs longer. Iowa is the outlier with a 90-day clock plus a 45-day extension. The clock starts when the company receives your request, not when it finishes verifying who you are.
What happens if a company refuses to delete my data?
Most state laws outside California require the company to run an appeals process, and it must tell you how to use it when it denies you. If the appeal fails, you can complain to your state attorney general. In California, complaints go to the Attorney General or the California Privacy Protection Agency.
Does a state deletion request remove me from people-search sites?
Often only partly. State privacy laws exclude publicly available information, including data lawfully obtained from government records, from the definition of personal data. Since people-search profiles are built largely from public records, a broker can honor your request and still keep publishing the public-record half of your profile.
Is California's DROP the same as a CCPA deletion request?
No. A CCPA request goes to one company at a time. DROP is a free state-run platform under the California Delete Act that sends a single deletion request to every data broker registered with the state, more than 500 of them. It is open to California residents only.
Can a company charge me to delete my data?
Not for a normal request. State laws generally require companies to answer consumer requests free of charge up to twice a year, and only allow a reasonable fee for requests that are unfounded, excessive or repetitive. If a site asks for a payment or a subscription to remove your listing, that is a red flag.
Why does a broker say it deleted my data when I still show up?
Two reasons. Under the Virginia-style laws, a company that bought your data from a third party can comply by recording your request and opting you out rather than erasing anything. And brokers continually re-ingest public records, so a genuinely deleted listing often reappears within three to six months.
Sources: IAPP US State Privacy Legislation Tracker and its January 2026 analysis of new state requirements; MultiState's 2026 summary of comprehensive privacy laws in effect; Privacy Rights Clearinghouse law overviews for Virginia, Iowa and Utah; California Attorney General (CCPA consumer rights and the 45-day response window); California Privacy Protection Agency (the Delete Act and DROP); IAPP and the Electronic Privacy Information Center on the publicly available information exemption; Oregon Division of Financial Regulation and the Texas Secretary of State data broker registries; Troutman Pepper Locke's Regulatory Oversight analysis of New Jersey's June 30, 2026 data broker law.