7 min read
CCPA vs GDPR: Which Deletion Right Are You Using?
CCPA §1798.105 and GDPR Article 17 both compel deletion, but they differ in who qualifies, what brokers must verify, and how fast they must respond.
Every removal request DataFreeMe sends cites both statutes. That is deliberate: brokers rarely tell you which framework they are honoring, and citing both removes the easiest excuse for ignoring you.
CCPA / CPRA — California
- Applies to California residents; many brokers extend it nationwide rather than maintain two pipelines.
- Deletion right lives in Civil Code §1798.105.
- Businesses must confirm receipt within 10 business days and act within 45 days, extendable to 90.
- They may verify your identity, but cannot demand more data than needed to do so.
GDPR — EU and UK
- Article 17, the "right to erasure," applies to anyone in the EU/UK regardless of citizenship.
- One month to respond, extendable by two months for complex requests.
- No fee unless the request is manifestly unfounded or excessive.
What this means practically
Send the request, log the date, and set a follow-up for 45 days out. Silence is not compliance — it is the single most common broker behavior, and a documented second request is what usually breaks the logjam.
LegalCCPAGDPR