Consumers may ask businesses to delete information gathered about them from any source, and online-only businesses must offer an online way to submit privacy requests.
Consumers may request deletion of personal information a business collected about them from any source. Businesses may keep limited records or information for specified purposes, including legal duties and security.
Online-only businesses with a direct relationship to consumers must offer an online way to submit requests to access, delete, or correct personal information, as well as an email address.
Businesses must treat a consumer’s deletion request as covering personal information they collected about that consumer, including information from other sources. This applies to personal information about a consumer, regardless of whether the business got it from the consumer or another source. A business may keep a record of the request and the minimum data needed to ensure the information stays deleted and is not used for another purpose when it obtained the information from a source other than the consumer. Businesses may retain information when reasonably necessary for listed purposes, including legal duties, security, and completing a transaction.
An exclusively online business with a direct relationship to a consumer must offer an online way to submit privacy requests, as well as an email address. This applies to businesses that operate only online and have a direct relationship with the consumer whose information they collect. The online method may be a web form or online portal.
No hearings or votes scheduled.