The most common misconception about the California Consumer Privacy Act is that it only helps California residents. The law technically defines a "consumer" as a California resident, but the critical detail is in how the law operates in practice.
The CCPA regulates the behavior of businesses. Specifically, it applies to any for-profit company that does business in California and meets any of these thresholds: annual gross revenue over $25 million, buys or sells the personal information of 100,000 or more consumers or devices per year, or derives 50% or more of annual revenue from selling personal information.
Every major data broker in the United States meets at least one of these thresholds. Spokeo, BeenVerified, WhitePages, Acxiom, LexisNexis, Verisk, Oracle Data Cloud, Epsilon, and thousands of others all do business in California and handle data from millions of consumers. The CCPA applies to all of them.
When a data broker receives a CCPA deletion request from a consumer in Texas or Ohio or North Dakota, they have a choice: verify the consumer's state of residency before processing, or simply delete the data regardless of where the consumer lives.
Most major brokers choose to process all requests. The reason is purely economic. Building and maintaining a system to verify state residency for every deletion request costs more than simply deleting the data. The broker's database does not sort records by the consumer's current state — it sorts by name, address, phone number, and email. Filtering by state would require additional verification steps, additional staff time, and additional legal liability if they get the determination wrong.
It is cheaper to delete everyone's data than to verify who has the legal right to demand deletion. This is the practical reality that makes CCPA effective nationwide.
Not all brokers take the practical approach. Some explicitly reject deletion requests from consumers in states without comprehensive privacy laws, citing residency as the reason they won't act on the demand. This is legal: a broker is only required to honor CCPA requests from California residents. When they process requests from other states, they are doing so voluntarily — and some choose not to.
This is precisely why federal privacy legislation matters. Consumers in the 30 states without comprehensive privacy laws have no legal right to demand deletion from these brokers. Their personal information remains for sale indefinitely.
As of August 2026, these 20 states have enacted comprehensive consumer privacy laws that include some form of data deletion rights:
| State | Law | Effective |
|---|---|---|
| California | CCPA / CPRA | 2020 / 2023 |
| Colorado | Colorado Privacy Act | 2023 |
| Connecticut | CT Data Privacy Act | 2023 |
| Delaware | Personal Data Privacy Act | 2025 |
| Florida | Digital Bill of Rights | 2024 |
| Indiana | Consumer Data Protection Act | 2026 |
| Iowa | Consumer Data Protection Act | 2025 |
| Kentucky | Consumer Data Protection Act | 2026 |
| Maryland | Online Data Privacy Act | 2025 |
| Minnesota | Consumer Data Privacy Act | 2025 |
| Montana | Consumer Data Privacy Act | 2024 |
| Nebraska | Data Privacy Act | 2025 |
| New Hampshire | Privacy Act | 2025 |
| New Jersey | Data Privacy Act | 2025 |
| Oregon | Consumer Privacy Act | 2024 |
| Rhode Island | Data Transparency and Privacy Protection Act | 2026 |
| Tennessee | Information Protection Act | 2025 |
| Texas | Data Privacy and Security Act | 2024 |
| Utah | Consumer Privacy Act | 2023 |
| Virginia | Consumer Data Protection Act | 2023 |
If you live in one of these states, you have state-level deletion rights in addition to CCPA. If you live in one of the other 30 states — including North Dakota, South Dakota, Wyoming, Alaska, and others — the CCPA is your primary tool, with the understanding that some brokers may reject your request.
The language you use in your communication to a data broker matters enormously. There is a critical legal difference between an opt-out request and a CCPA deletion demand.
An opt-out request asks the company to stop selling your data. It is voluntary. The company may comply, or they may not. There is no legal enforcement mechanism for a generic opt-out request. Most data removal services send opt-out requests.
A CCPA deletion demand citing Section 1798.105 instructs the company to delete all personal information it has collected about you, directs it to instruct its service providers to do the same, and cites a specific statute with enforcement provisions. Non-compliance within 45 days constitutes a violation subject to penalties of $2,500 per violation (or $7,500 for intentional violations).
The difference between an opt-out request and a CCPA deletion demand is the difference between asking politely and citing the law. Both may achieve the same result, but one carries consequences for refusal.
If you want to exercise your rights under the CCPA, your communication to the data broker should include your full name, current address, email address, and phone number for identification purposes. It should explicitly cite the California Consumer Privacy Act, Section 1798.105, and use the word "delete" — not "remove," "suppress," or "opt out." It should specify that this is a deletion request, not a portability request, because some brokers deliberately misclassify deletion requests to avoid destroying data. It should state the 45-day compliance deadline and note that non-compliance may result in a complaint to the California Attorney General.
If you designate an authorized agent to submit requests on your behalf — as allowed under CCPA Section 1798.140(j) — the agent should include proof of authorization. This is what consumer privacy services do: act as your authorized agent, sending legally structured deletion demands on your behalf to every broker that holds your data.
The honest caveat: Using the CCPA from a non-California state is a gray area. Most brokers comply because it is easier than fighting. Some reject. No court has definitively ruled on whether out-of-state consumers can invoke CCPA. What we can say is that in our experience, the vast majority of brokers process CCPA requests regardless of the consumer's state. The practical success rate is high enough that CCPA remains the most effective tool available to consumers in states without their own privacy laws.
We send legally structured CCPA deletion demands — not opt-out requests — to 2,415 data brokers on behalf of subscribers in all 50 states. We cite the statute, specify the deadline, and follow up on non-compliance. $9.95/month.
Start Your Free 7-Day TrialNo credit card required. Cancel anytime. We never sell your data.