Free CCPA opt-out letter generator, no signup

What this letter does

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California residents the right to know what personal information a business collects about them, to have it deleted, and to opt out of its sale or sharing. The statute is California Civil Code §1798.100 to §1798.199. The rights apply to businesses the law covers, and the law sets exceptions, so a business may keep some information or decline part of a request. This tool drafts a letter that cites the section for the request type you choose.

Your name, address, age, relatives, and property history are the raw material data brokers package and sell. A written request gives you a dated record of what you asked for and when. Where a business offers its own request form or method, use it; if its official process accepts a written request, adapt this letter to that process. A letter also helps when a form is broken or when you're following up on a request that went unanswered.

Where to send it

• Postal mail. Use the mailing address the business lists for privacy requests. Print, sign, and send certified with return receipt, and keep the receipt as proof of delivery.
• Email. Use the privacy request address in the business's current privacy policy, reached through its official site. An address from an old guide or a forwarded message doesn't confirm the recipient. Send the letter as a PDF attachment or paste it into the message body.
• Web form, if the business provides one. Fill in the form's own fields. If it has a notes or comments field, you can paste the letter body there. Save the confirmation it shows or sends you.

A confirmation that the business received your request is a receipt, not proof that anything was deleted. Record its later response separately, with the date.

Response timing

Timing depends on the request. For a request to delete or to know, covered businesses generally must respond within 45 calendar days and may extend once when permitted by the law; they may verify your identity first. For a request to opt out of sale or sharing, the business generally must stop within 15 business days, and the request doesn't need identity verification. If a business doesn't respond, you can submit a complaint to the California Privacy Protection Agency (CPPA) at privacy.ca.gov. Keep your delivery receipt or sent-email record so you can show what you sent and when.

If you don't live in California

CCPA rights apply to California residents. If you live elsewhere, don't send this as a CCPA request or claim California residency. Use the rights available under your own state's law or the business's voluntary privacy process, and follow that process's instructions. This letter is written for the CCPA; swapping in another state's citation doesn't adapt it to that law's scope, exceptions, or request rules.

One letter, or all of them at once

One CCPA letter covers one business. Your personal data can be spread across many data brokers and people-search sites, so a separate letter to each one takes time. Eligible California residents can also use DROP, the CPPA's Delete Request and Opt-out Platform, for an ongoing request to participating registered data brokers; exempt data, first-party relationships, and original public records have different limits (choosing a request route). If you'd rather hand off the work, Delist starts with a free scan; removal work is part of a paid plan, and you authorize it separately from your free scan. Either way, a request receipt, a provider response, and a later visibility check support different conclusions (reading removal evidence). The free letter is here either way.