Does it apply to us if we are not in California?

Possibly. It reaches for-profit businesses doing business in California that meet any one of three tests: revenue above a threshold, the volume of Californian personal information handled, or income from selling that information. Being registered elsewhere does not take you outside it, and a remote customer base is enough to raise the question.

What makes deletion requests hard once AI tools are in use?

Answering one properly means knowing everywhere a person's information reached. Tools adopted by individual teams rather than through a central process are precisely the destinations nobody recorded, so the request surfaces a gap that has been widening quietly rather than creating a new problem on the day it arrives.

How long does an opt-out last?

It stands until the individual authorises the selling or sharing again. That makes it an instruction to be held and honoured rather than a single suppression, which has implications for how the preference is stored and how it survives a system migration.

Glossary

CCPACalifornia Consumer Privacy Act

California's consumer privacy law, giving residents rights over information held about them and reaching businesses well beyond the state's borders.

In plain terms

A Californian law giving people there rights over what companies know about them. It catches businesses that have never had an office in California, because what matters is doing business with people in the state rather than being based there.

Why it matters

Because the deletion right and the AI tools an organisation has adopted pull in opposite directions. Somebody exercising it expects their information removed, and by then it may sit in an assistant's history, an automation's logs and a vendor's systems that nobody listed when the tool was adopted.

How it works

It reaches for-profit businesses doing business in California that meet any one of three tests: revenue above a threshold, handling the personal information of a large number of California residents or households, or deriving most of their revenue from selling that information. Meeting one is enough.

Doing business in California is not the same as being in California. The test is about who you deal with rather than where you sit, which is why organisations with no presence in the state find themselves inside it and usually find out late.

The rights are knowing, deleting, opting out and not being penalised for asking. That last one matters more than it looks: a business cannot treat somebody worse for exercising the others, so a retaliatory downgrade of service is itself the problem.

Sharing sits alongside selling, and that is the phrase that catches people. Arrangements nobody in the building would call a sale, such as passing information to advertising partners, are covered, so the honest question is where information goes rather than whether money changed hands.

An opt-out binds until the person changes their mind. Once the request arrives the business cannot sell or share that information again unless the individual later authorises it, which makes it a standing instruction rather than a one-off suppression.

For AI adoption the deletion right is the sharp end. Answering it properly means knowing every place a person's information reached, and tools adopted by teams rather than by a central function are exactly the places nobody has written down.

What decides whether it reaches you

The most expensive version of this error is not the company that decides it is out of scope and turns out to be in it. It is the company that is correctly in scope, knows it, and has answered only the first half of the question. Publishing a privacy notice and adding an opt-out link is visible work that gets done. Being able to answer a deletion request completely is invisible work that does not, and it is the half that AI adoption quietly makes harder every quarter. Each tool a team adopts is another place a person's information can come to rest, and none of those adoptions felt like a data decision at the time: somebody needed a summary, pasted a list of customers into an assistant, and got their summary. When the request arrives, the honest answer to where that information now is takes days to assemble and is rarely complete. The work that fixes it is not legal work. It is knowing what the organisation actually uses.

Seen in the wild

A deletion request arriving after customer details were pasted into an assistant.
ChatGPT
Contact records where information about people quietly accumulates.
Attio
An automation copying customer records into a second system nobody listed.
Zapier

Common misconceptions

People assume

It only applies to companies based in California.

In fact

It applies to for-profit businesses doing business in California that meet one of the stated tests. Where the company sits is not the question, which is why organisations with no presence in the state are routinely inside it.

People assume

We do not sell data, so the opt-out is irrelevant.

In fact

The right covers sharing as well as selling. Passing information to partners without money changing hands can be caught, so the question is where information goes rather than whether anybody was paid for it.

Questions

Does it apply to us if we are not in California?: Possibly. It reaches for-profit businesses doing business in California that meet any one of three tests: revenue above a threshold, the volume of Californian personal information handled, or income from selling that information. Being registered elsewhere does not take you outside it, and a remote customer base is enough to raise the question.
What makes deletion requests hard once AI tools are in use?: Answering one properly means knowing everywhere a person's information reached. Tools adopted by individual teams rather than through a central process are precisely the destinations nobody recorded, so the request surfaces a gap that has been widening quietly rather than creating a new problem on the day it arrives.
How long does an opt-out last?: It stands until the individual authorises the selling or sharing again. That makes it an instruction to be held and honoured rather than a single suppression, which has implications for how the preference is stored and how it survives a system migration.