The United States has no single comprehensive federal privacy law giving everyone a right to see or delete the data companies hold about them. What exists instead is a patchwork: sector-specific federal laws like COPPA for children and FERPA for education records, and a growing set of state consumer privacy laws that do create those rights for their own residents. Whether you can make a company delete your data therefore depends substantially on your state.
What state privacy laws typically grant
The state comprehensive privacy laws that have passed generally share a core set of consumer rights, though the details and the names differ: a right to know or access what a business has collected, a right to request deletion, a right to correct inaccurate information, a right to obtain a portable copy, and a right to opt out of the sale or sharing of personal information and of targeted advertising.
They also generally apply only to businesses meeting certain size or revenue thresholds, so a small site may be outside the law entirely. And they protect residents of that state, which is why the answer changes when you move.
Provisions aimed specifically at minors
Several state privacy laws include provisions that treat data about minors differently — commonly requiring opt-in consent before selling or using a minor's data for targeted advertising, rather than the opt-out standard applied to adults. This matters because, as our COPPA article explains, federal protection largely stops at 13, and these state provisions are one of the few places where teenagers are treated differently from adults.
Because the number of states with such laws has been growing and their effective dates are staggered, the honest position is that this is a moving picture. Your state attorney general's office is generally the authority on what applies to residents of your state right now.
How to actually make a request
Companies subject to these laws generally must provide a way to submit a request — often a privacy page, a form, or a dedicated email address, and sometimes a toll-free number. Look for a “Your Privacy Choices,” “Do Not Sell or Share My Personal Information,” or “Privacy Rights” link, usually in a site footer.
A request generally requires enough information to verify who you are, and companies typically have a set number of days to respond. Keep a copy of what you sent and when. If a company subject to the law ignores a valid request, the state attorney general is usually the enforcement route — and for data brokers specifically, our article on data brokers covers the separate registries and deletion mechanisms a few states have set up.
Remember this
- There is no single comprehensive federal privacy law — deletion rights come mostly from state consumer privacy laws.
- These typically grant rights to access, delete, correct, port, and opt out of sale or targeted advertising.
- Several include stronger opt-in rules for minors' data — one of the few places teens are treated differently from adults.
- Look for a privacy-rights link in the site footer, keep a copy of your request, and escalate to your state attorney general.
Sources
This article provides general educational information, not individualized legal advice. KidsKnowRights is not a law firm, and reading this article does not create an attorney-client relationship. Laws vary by state, age, and circumstances, and they change over time. For advice about a real situation, talk with a licensed attorney or a legal aid organization.