Data Deletion Rights (GDPR / CCPA)
GDPR and CCPA give you the right to have your data deleted — many ToS bury that right under slow, burdensome request procedures.
Under the GDPR (right to erasure, Article 17) and the California CCPA/CPRA (right to delete), you can demand that a company delete the personal data it holds about you. The company must comply within roughly a month, with narrow exceptions, and cannot charge you for it.
What the ToS controls is friction. A compliant policy says 'click here to request deletion.' A hostile one routes the request through notarized postal mail to an offshore corporate agent, adds a processing fee 'where permitted', or stays silent while a 60-day retention window quietly re-captures everything. Each speed bump converts an absolute right into a form you probably won't file.
Watch also for deletion carve-outs: 'we may retain data as necessary for legitimate business purposes' is often legitimate (fraud prevention, legal holds) but occasionally becomes a blank check. The clauses that matter are the ones defining how fast, how cheap, and how completely your request is honored.
Account holders may request data deletion by submitting a certified written letter via notarized postal mail to our corporate representative. Processing fees up to $35 may apply where permitted by regional statutes.
Deletion rights are one of the three statutory topics ToS-TLDR checks explicitly — each scan reports whether the document's deletion process passes, is ambiguous, or fails.
Scan a terms-of-service document free →