Which States Let You Delete Your Data?

As of 2026, about 20 states have comprehensive consumer privacy laws that give residents the right to see, delete, correct, and opt out of the sale of their personal data. California led the way, followed by Virginia, Colorado, Connecticut, and many more. If you live in one of these states, you can legally require businesses to delete your data and expect penalties if they refuse. If your state is not on the list, you are not stuck: because most large data brokers apply California-style rules across the whole country, you can often still get your information removed. Here is the full picture and how to actually use your rights.

Which states have privacy laws?

Around 20 as of 2026, and the number keeps climbing. California started it with the CCPA, later strengthened by the CPRA. Virginia, Colorado, Connecticut, and Utah followed, then a wave including Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and Nebraska. The newest to take effect, as of January 1, 2026, are Indiana, Kentucky, and Rhode Island, and several more states have passed laws that will switch on over the next couple of years. The trend is steadily upward, so it is worth checking your own state's current status, since these laws now cover roughly half of all Americans.

What rights do these laws give me?

The specifics vary, but most comprehensive state laws grant a consistent core set of rights: the right to know what personal data a business has collected about you, the right to delete it, the right to correct inaccuracies, the right to data portability, the right to opt out of the sale of your data and of targeted advertising, and the right not to be discriminated against for exercising any of these. Some states add the right to limit the use of sensitive data or to opt out of profiling used in automated decisions. When you submit a request, businesses generally have about 45 days to respond, with one 45-day extension allowed.

What if my state has no privacy law?

You still have meaningful options, especially for data broker removals. The legal gap looks larger than the practical one here, because most major national data brokers comply with California's rules everywhere rather than build separate systems per state. That means a resident of a state without its own law can often submit a deletion or opt-out request citing California's framework and have it honored. Beyond that, the Federal Trade Commission can act against unfair or deceptive data practices nationwide, and sector-specific federal laws like HIPAA for health data and the Gramm-Leach-Bliley Act for financial data apply everywhere. It is less certain than an enforceable state right, but in practice removals frequently work regardless of where you live.

Which state has the strongest law?

California remains the most protective. It is enforced by a dedicated agency, the California Privacy Protection Agency, includes a limited right for individuals to sue over certain data breaches, and went furthest of all by building a state platform that lets residents delete their data from hundreds of registered brokers with a single request. Maryland and Colorado also rank among the strictest, particularly on data minimization, which limits how much data a business can collect in the first place, and on requiring businesses to honor universal opt-out signals.

What is a universal opt-out signal?

It is a browser setting that automatically tells every website you visit not to sell or share your data, so you do not have to opt out manually on each one. Around a dozen states, including California, Colorado, Connecticut, Texas, and others, now legally require covered businesses to honor these signals. Turning on a universal opt-out in a supported browser is one of the easier ways to exercise your rights at scale, though it applies to websites you visit rather than to data brokers that already hold your information.

How do I actually use my rights?

This is where the rights meet reality, and the reality is that using them is manual. To remove yourself from data brokers, you have to identify each broker holding your data and submit a deletion or opt-out request to every one, whether under your state's law or by citing California's. None of these laws consolidate that work for you outside California's broker platform, and none of them stop a people-search site from rebuilding your listing from fresh public records afterward. The right to delete is real, but exercising it across dozens of sites, over and over as listings return, is the part that falls on you. Consumer Reports found that automated and do-it-yourself removals cleared only about 27 percent of exposed listings, while removals handled by real people who monitor and refile reached roughly 70 percent. The law gives you the lever; someone still has to keep pulling it. Our complete guide to removing yourself from data brokers walks through the process.

Frequently asked questions

Can I use California's law if I do not live in California?

Legally, California's law protects California residents. In practice, many national data brokers apply its standards to everyone, so a request citing that framework is often honored regardless of your state. It is not a guaranteed right for non-residents, but it frequently works for broker removals.

Do these laws apply to every business?

Most set thresholds, so they apply mainly to larger businesses or those handling a lot of consumer data, often measured by number of residents or revenue from selling data. Some states set no minimum count for certain rules, so coverage depends on your state and the specific business.

Does a deletion request stop a broker from re-adding me?

Not permanently. A broker may delete your data when asked, then rebuild a listing later from fresh public records. That is why deletion is a moment in time rather than a permanent state, and why ongoing monitoring matters more than a single request.

Will more states pass privacy laws?

Almost certainly. The count has risen steadily since 2018, with more laws enacted and scheduled to take effect in the coming years. In the absence of a federal standard, states are expected to keep expanding privacy rights, so your options may grow over time.