Did you ask an online merchant to delete your data only to hear absolute silence? You are not alone.
Companies vacuum up phone numbers, browsing habits, and card receipts without a second thought. Yet the minute you ask them to scrub that file, support vanishes.
You don't have to wait forever.
The Timelines Companies Actually Have to Follow
Privacy statutes set hard boundaries for business data teams. They cannot sit on your request.
- 45 calendar days: Under the California Consumer Privacy Act, a business must respond to your verified request to access, change, or delete data within 45 days. They can take a 45-day extension for complicated files. But they must notify you before the initial window closes.
- 12 months: Covered companies must update their public privacy notice every 12 months. This notice must detail everything they gathered and shared during the preceding year.
- 48 hours: Under Section 3 of the Take It Down Act enforced by the FTC starting May 19, 2026, platforms must remove nonconsensual intimate images within 48 hours of a valid request.
What Counts as a Legitimate Dispute
Thing is, confusing website terms do not violate privacy laws. You have an actionable dispute only when a company blows past statutory response dates, hides tracking scripts, or ignores your verified opt-out request.
What Controls Your Privacy Rights
Your rights stem from statutory law, not customer service promises. Here is what actually controls your claim:
| Your Situation | What Controls the Issue | What Does Not Control It |
|---|---|---|
| Company ignores your data deletion request past 45 days | Statutory state privacy laws like CCPA and CPRA | Unenforceable customer support promises |
| Website sells personal data after you set an opt-out signal | Mandated recognition of Global Privacy Control (GPC) signals | The company's internal marketing preferences |
| App silently shares sensitive location data with brokers | FTC privacy guidance on unfair and deceptive practices | General statements buried in generic website terms |
| Business fails to refresh its notice for years | State statutory annual review mandates | The date you signed up for your account |
Why Companies Miss Deadlines
Turns out, missed privacy deadlines rarely happen because of some grand corporate conspiracy. Most online platforms connect dozens of third-party software plug-ins directly into their checkout and customer marketing funnels, so when your deletion ticket lands, a low-level support agent has to manually chase down that single email address across three or four separate cloud databases, which takes an absurdly long time and inevitably falls through the cracks. It's messy, disorganized work. Still, bad plumbing is no legal defense. The statutory clock runs anyway.
How to Dispute a Missed Deadline
Don't waste your energy arguing with customer service chat reps. Build an undeniable paper trail instead.
-
Verify your submission timestamp
Locate your original confirmation email or submission receipt. You must establish the exact calendar date the company received your request. That date starts the statutory clock. -
Send a formal cure notice
Reply directly to the dedicated privacy contact address listed in their policy. State your initial filing date, cite the expired 45-day window, and demand a prompt fix. If you plan to sue under the CCPA, you must give the business 30 days written notice to cure the violation first. -
Archive your documentation
Download timestamped PDF copies of every web form, automated help-desk ticket, and email exchange. If the business claimed an extension, verify whether they notified you before the initial 45 days lapsed. -
File an enforcement complaint
Submit an administrative complaint through the CalPrivacy complaint portal if your dispute falls under California law. The portal prompts you to name the business, identify violated rights, and upload proof. You can also report deceptive business practices directly to the FTC. -
Enable automated privacy signals
Turn on Global Privacy Control in your browser settings. This broadcasts an automated opt-out signal whenever you visit participating websites.
Exceptions Where Businesses Can Refuse
To be honest, companies do not have to delete every scrap of data on demand. The law carves out clear exceptions. A merchant can lawfully keep your information to fulfill an open purchase, honor a product warranty, or maintain an active subscription you asked for.
Legal obligations create another major carve-out. State and federal tax rules force businesses to preserve payroll and accounting records for years. Companies can also keep records needed to detect security incidents, fight identity theft, or prosecute fraud. Those safety files stay put.
What to Do Next
Check your calendar right now. If your deletion request has sat unanswered past the 45-day mark, stop arguing with generic support bots. Send a formal written cure notice to their privacy team today. If they still ignore you, submit your complaint and records directly to state enforcement agencies.