Modern state privacy laws confer upon individuals the ability to ask for their personal information to be deleted. Statutes differ, however, in the scope of the “deletion right.” For example, some states only permit consumers to request the deletion of personal information that the consumer provided to the organization (allowing the organization to keep personal information that it obtained from third party sources or created itself), whereas other statutes allow consumers to make broader requests. It should be noted that even if a statute grants consumers the ability to request the deletion of a particular data type, the statute may still have exceptions that allow an organization to refuse the request. For example, if an organization is required by law to keep certain information, it may refuse a deletion request regardless of whether the data was collected directly from the consumer or via a third party.
The following provides a comparison of the types of personal information for which consumers can request deletion: