Handling deletion requests from privacy services

What these requests are

Consumers pay privacy services to ask companies to delete their data or stop selling it. The service then sends the same request to many companies at once, usually by email. If you're a data broker or hold marketing data, you may receive hundreds a month from several services, each in its own format.

They often differ from a request a consumer writes themselves:

• The reply address may be different from the sender, buried in the body of the email.
• They may include a case or reference number the service asks you to quote.
• The consumer's details are laid out in the service's own format, sometimes with several email addresses or phone numbers.
• Some arrive as corrections of an earlier request.

Why it matters

Under California's CCPA, consumers can use an authorized agent to make requests for them, and the same deadlines apply as if the consumer wrote to you directly. For a request to delete, you must confirm receipt within 10 business days and respond within 45 calendar days (extendable once by a further 45 days if you tell the consumer). Requests to opt out of the sale or sharing of personal information must be acted on within 15 business days. Other states' privacy laws set similar duties. At bulk volume, the risk is less about any one request and more about the ones that slip through.

A practical checklist

1. Use one inbox for privacy requests and publish it, so requests don't scatter across sales and support mailboxes.
2. Recognise each sender's format. Note how each service lays out the consumer's details, reply address and reference.
3. Verify where the law allows. For agent requests you may ask for proof the consumer authorized the agent; see our guide to authorized agent requests.
4. Act on every identifier given: all the email addresses, phone numbers and postal addresses, not just the first.
5. Reply where the request asks, quoting any reference, so the service can match your answer to its case.
6. Keep a record of what was asked, when it arrived and when you answered.
7. Don't answer machines. Bounces and auto-replies to your own replies can start a loop if they're treated as new requests.
8. Check for stragglers. Regularly look for unread requests that your process didn't pick up, especially from senders you haven't seen before.

How Simple Opt-Out Compliance helps

It connects to your privacy inbox and answers these requests automatically from your own address, using your template. It picks out reply addresses and references from privacy services, ignores bounces and repeat requests, keeps a downloadable record of every reply, and can show you the unread requests nothing has answered yet.

Official sources: California Attorney General: CCPA · California Privacy Protection Agency: regulations.

This guide is general information, not legal advice. Privacy laws and regulations change; check the official sources linked above or ask your lawyer about your situation. Last reviewed October 2026.