A data deletion request is not one form that works everywhere. California's CCPA gives residents a legal right to tell many businesses to delete personal information. Separate from that, Google, Meta, Apple, Amazon, and TikTok each have their own account and privacy tools, and those tools are usually open to anyone with a login.
Which pile are you trying to shrink? A broker dossier you never signed up for is a different job from closing a shopping account.
If you live in California, you can often do both.
Everyone else still has the product settings. This walkthrough stays practical. It's not legal advice.
Who can demand deletion under U.S. state law
California residents have the clearest statutory deletion right in the United States. The California Consumer Privacy Act, including CPRA amendments in effect since 2023, lets a consumer ask a covered business to delete personal information collected about them. Other states have enacted similar laws. Their clocks and exceptions don't match California's.
You'll still need to verify your identity. A business can deny a request it can't reasonably confirm.
| Path | Who it is for | What it actually reaches |
|---|---|---|
| CCPA deletion request | California residents | Covered businesses and, in many cases, their service providers |
| In-app or account deletion | Anyone with a login | That company's product, on that company's timeline |
| DROP | California residents who pass residency checks | Registered data brokers, not stores or apps you used directly |
| GDPR erasure | People in the EU, in defined cases | Controllers subject to GDPR, which is a different statute |
People outside California shouldn't expect a California agency to force a deletion, so use the company's own portal if you still want the account gone.
How to send a deletion request to a company you used
California privacy guidance says you can usually file through a web form, email, or a toll-free number listed in the privacy policy. Search that policy for "delete," "privacy request," or "your privacy choices."
- Find the official request method and save a screenshot.
- Ask for deletion of personal information. An opt-out of sale is a different request.
- Provide the identifiers they ask for, such as the account email or phone number.
- Record the date, ticket number, and confirmation email.
- Give them the response window. For CCPA, businesses should respond within 45 days and tell service providers or third parties that received the information, so those parties can follow it too.
Save that email.
Thing is, tapping "delete account" in settings may not notify every downstream buyer of your data. If you're a California resident and that downstream copy is the problem, file the privacy request as well.
Here's wording you can reuse.
I am a California resident requesting deletion of my personal information under Civil Code section 1798.105. My account email is [email]. Please delete the information that is not subject to an exception, notify service providers and third parties as required, and confirm when that is done.
Skip the driver's license photo unless they ask after a failed check. Extra ID scans just create another file.
Data brokers are a separate job
Brokers package information about people who never opened an account with them. DROP is California's answer to that mess.
The Delete Request and Opt-out Platform lets a verified California resident send one deletion request toward registered brokers. CalPrivacy has described it as a way to reach over 600 active brokers. You still send a separate request to each business you actually gave information to.
Residency checks come first. If the automated match fails, California rules provide a way to ask for review of that classification.
CalPrivacy launched DROP on January 1, 2026. Beginning August 1, 2026, data brokers must pull those hashed requests at least once every 45 days. If a broker finds a match in its records, it must delete the information on a rolling 45-day basis, subject to limited exemptions. CalPrivacy and the California Privacy Protection Agency spell out that cycle.
DROP won't close your Amazon account. It won't wipe a Google login. Those stay on the company track above.
Google, Meta, Apple, Amazon, and TikTok
These are product tools. Layouts move. If a menu label changed, search the in-app help for "delete your data" or "delete your account."
Google keeps deletion and download controls inside the account. You can remove a service, wipe categories such as Search or YouTube history, or close the whole account. Watch for a confirmation email before you assume it's done.
Meta's Facebook, Instagram, and Threads deletion runs through Accounts Center or settings. A WIRED walkthrough notes that Facebook and Instagram can take 30 days, and Facebook says some deletion can take as long as 90 days as copies fall off backup systems. Logging in during a grace period can cancel the request, which is easy to do by accident if you still have the app on your phone and tap it out of habit one morning because a notification showed up.
Apple lets you request deletion from its privacy pages or from Settings while signed in with your Apple ID. Save any case or tracking number they display.
Amazon's privacy pages include data deletion and account-closure options. Closure is rarely instant. Read the confirmation for any waiting period before the close becomes final.
TikTok puts download and delete controls under Profile, then Settings, then your information. Removing the app from your phone doesn't delete the account. If the in-app path errors out, use the contact listed in TikTok's privacy policy.
To be honest, download the archive first if you might want those photos later. Deletion is a poor archive strategy.
When a business can refuse
CCPA deletion isn't a wipe of every possible record. A business may keep information needed for a legal obligation, security, completing a transaction, or other exceptions written into the statute, and it should say so if it denies part of your request.
If they stall
Past the 45-day window with no real answer, California consumers can complain to the Attorney General through the CCPA page or contact the California Privacy Protection Agency. A private CCPA lawsuit generally requires prior written notice of the sections you believe were violated and 30 days for the business to say it has cured the problem.
Keep the emails. Dates beat adjectives.
GDPR is not a U.S. consumer default
Turns out pasting "GDPR Article 17" into a California form doesn't upgrade your rights. GDPR is EU law. It can apply if you are in the EU, or in some situations where a company is established in the EU or targeting people there.
EU controllers generally have one month to respond to an erasure request, with a possible extension. Exceptions include legal duties, public-interest archives, and certain speech or research uses. Escalate to a national data protection authority if the controller stonewalls, not to the California AG.
If you're a U.S. resident using a U.S. service, start with CCPA (if you qualify) or the company's own tools. Use GDPR wording only when that statute actually covers you.
Pick one target today. California residents who want brokers gone should start at DROP, save the confirmation, then file with the one or two companies that still hold a live account.