How long do data brokers take to respond to deletion requests?
259 of the 439 data brokers that received a deletion request (59%) report a median response time of a week or less. 8 report a median over 45 days.
- 0: 12 of 439 brokers that received a deletion request (2.7%)
- 1: 112 of 439 brokers that received a deletion request (26%)
- 2 to 7: 135 of 439 brokers that received a deletion request (31%)
- 8 to 15: 85 of 439 brokers that received a deletion request (19%)
- 16 to 30: 59 of 439 brokers that received a deletion request (13%)
- 31 to 45: 28 of 439 brokers that received a deletion request (6.4%)
- Over 45: 8 of 439 brokers that received a deletion request (1.8%)
Median days to respond to a deletion request
Key findings
- 124 brokers report a median of one day or less.
- The slowest reported median is 172 days.
The data
| Median days to respond to a deletion request | Brokers | Share |
|---|---|---|
| 0 | 12 | 2.7% |
| 1 | 112 | 26% |
| 2 to 7 | 135 | 31% |
| 8 to 15 | 85 | 19% |
| 16 to 30 | 59 | 13% |
| 31 to 45 | 28 | 6.4% |
| Over 45 | 8 | 1.8% |
Shares are of 439 brokers that received a deletion request.
How we made this chart
Data brokers that operated in California in 2025 had to register with the California Privacy Protection Agency (CalPrivacy) in 2026. The registration form asks each one the same questions, and CalPrivacy publishes every answer.
Each broker reports the mean and median number of days it took to respond substantively to a deletion request. We grouped the brokers that received at least one deletion request by their reported median.
Limits to keep in mind:
- California generally gives a business 45 days to respond and allows one further 45-day extension with notice, so a median over 45 days is not by itself a violation.
- CalPrivacy states the registry covers businesses that operated as data brokers in 2025, while the form's column headings for response times name 2024. We report the figures as filed.
- Every figure is self-reported by the broker on its registration. CalPrivacy publishes the answers as filed, and DeepSearch has not audited them.
- Affiliated companies often register separately, so one corporate group can appear several times.