# Standards and Regulatory References — CCPA Right to Delete

## Primary Legislation

### California Consumer Privacy Act (CCPA)
- **Cal. Civ. Code §1798.105** — Consumer's right to delete personal information
- **Cal. Civ. Code §1798.105(a)** — Right to request deletion of collected personal information
- **Cal. Civ. Code §1798.105(b)** — Business obligation to disclose deletion right
- **Cal. Civ. Code §1798.105(c)** — Business obligation to delete and direct service providers, contractors, and third parties to delete
- **Cal. Civ. Code §1798.105(d)** — Nine exceptions to deletion obligation
- **Cal. Civ. Code §1798.100(d)** — Business shall not collect additional categories of personal information without notice

### California Privacy Rights Act (CPRA) Amendments
- **Cal. Civ. Code §1798.105(c) (as amended)** — Extended obligations to notify third parties to whom PI was sold or shared
- **Cal. Civ. Code §1798.140(ag)** — Definition of "service provider" (amended)
- **Cal. Civ. Code §1798.140(j)** — Definition of "contractor" (new)
- **Cal. Civ. Code §1798.185** — CPPA rulemaking authority

## CCPA Regulations

### California Code of Regulations, Title 11, Division 6
- **§999.312** — Methods for submitting requests to delete
- **§999.313** — Responding to requests to delete
- **§999.314** — Service provider obligations
- **§999.323** — General rules regarding verification
- **§999.324** — Verification for password-protected accounts
- **§999.325** — Verification for non-account holders
- **§999.326** — Authorized agents

### CPPA Regulations (Updated)
- Final regulations adopted by the California Privacy Protection Agency updating the California Attorney General's original regulations

## Enforcement

### California Privacy Protection Agency (CPPA)
- Established by CPRA as the dedicated enforcement body (effective July 1, 2023)
- Administrative enforcement authority with power to impose fines
- **Cal. Civ. Code §1798.199.40-§1798.199.95** — CPPA powers and procedures

### California Attorney General
- Retains concurrent enforcement authority
- **Cal. Civ. Code §1798.155** — Civil penalties: up to $2,500 per violation; $7,500 per intentional violation or violation involving minors

## Comparison Frameworks

### GDPR (for cross-reference)
- **Article 17** — Right to erasure (right to be forgotten)
- Key differences: CCPA does not require establishing grounds; broader exceptions; explicit verification requirements

### Other US State Privacy Laws (with deletion rights)
- **Virginia CDPA §59.1-577** — Right to delete
- **Colorado CPA §6-1-1306** — Right to delete
- **Connecticut CTDPA §42-520** — Right to delete
- **Utah UCPA §13-61-201** — Right to delete
- **Oregon Consumer Privacy Act §1-10** — Right to delete
- **Texas TDPSA §541.101** — Right to delete

## Industry Guidance
- **IAPP CCPA Compliance Guide** — Practical implementation guidance for deletion requests
- **Future of Privacy Forum — CCPA Implementation Resources** — Consumer request handling frameworks