The Fine Print: The Copies Already Sold
The Fine Print is a twice-weekly series that reads California's privacy law from the consumer's side: what a word promises, what the text says, and what is left exposed.
A deletion request is usually pictured as one company erasing one file. But by the time most people ask, the data has often moved. It may have been sold or shared, possibly more than once. So the practical question is what happens to the copies that already left.
What the word promises
California's answer is better than many people assume. Under the CCPA, a business that receives a verifiable deletion request must delete the information from its own records, "notify any service providers or contractors to delete the consumer's personal information from their records, and notify all third parties to whom the business has sold or shared the personal information to delete the consumer's personal information unless this proves impossible or involves disproportionate effort" (Civ. Code §1798.105(c)(1), leginfo).
So the request is supposed to travel downstream. Our earlier explainer flagged that qualifier (what the statute means by "delete"). This post follows the copies themselves.
What the text says
The CCPA regulations, issued by the California Privacy Protection Agency, add detail. A business complies in part by "notifying all third parties to whom the business has sold or shared the personal information of the need to delete." If it says that is impossible or would take disproportionate effort, it "shall provide the consumer a detailed explanation that includes enough facts to give a consumer a meaningful understanding as to why the business cannot notify all third parties," and it "shall not simply state" that notice is impossible (Cal. Code Regs., tit. 11, §7022(b)(3), CCPA Regulations, effective 1 January 2026).
The business must also "inform the consumer whether it has complied with the consumer's request" (§7022(e)). Service providers and contractors have their own pass-along duty for anyone who "may have accessed personal information from or through" them (§1798.105(c)(3); §7022(c)(4)).
That is the promise. Now look at what you can see of it.
What stays exposed
You learn categories, not names. The right to know covers "the categories of third parties to whom the personal information was sold or shared" (§1798.115(a)(2), leginfo). A category such as "marketing partners" doesn't tell you where to look. Nothing in §1798.105 or §7022 tells the business to name the third parties it notified.
The notice is the business's step, and you can't watch it. The response tells you "whether it has complied." Neither §1798.105 nor §7022 requires it to tell you how many third parties were notified, when, or what each one did with the notice. If a copy is still in circulation, you have no list to check it against.
DROP is written around the broker's own chain. The Delete Act section that governs DROP tells a broker to delete and to "direct all service providers or contractors associated with the data broker to delete all personal information in their possession related to the consumers making the requests" (§1798.99.86(c)(1)(C), leginfo). The section doesn't mention the third parties a broker has already sold to. Whether the CCPA's notice duty in §1798.105(c)(1) also comes with a DROP request isn't something the text says on its face, and we don't try to answer it here. As we wrote about "Exempted," a status can be accurate and still tell you little (Exempted Why?).
The case the other way
There is a fair case for this design.
Contracts already follow the data. A business that sells or shares personal information must have an agreement that "obligates the third party, service provider, or contractor to comply with applicable obligations under this title" (§1798.100(d)(2), leginfo). And a third party "shall not sell or share" information it received from a business "unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out" (§1798.115(d)). Downstream copies are not left unregulated.
A list of names has costs. Recipient lists can be commercially sensitive, can go stale quickly, and would be one more document every request has to produce. The "detailed explanation" rule in §7022(b)(3) is a real check on the easiest excuse.
Oregon has taken this on, carefully. It lets a consumer obtain "a list of specific third parties, other than natural persons," that a controller disclosed data to. But it's "at the controller's option" whether that list covers "the consumer's personal data" or "any personal data" (ORS 646A.574(1)(a)(B), Oregon Revised Statutes). That shows a names-based right can be written, and also how much the details matter.
A fix anyone could carry out
- For the Agency: in guidance or a future §7022 update, have the deletion response state whether third-party notice was sent, to how many recipients, and on what date. That means a count, not names, so no recipient is identified, and the consumer still gets something to hold.
- For the Legislature: if a names-based right is added, tie it to the recipients of your data, not a general partner list, and to the period covered by the request.
- For businesses: say in the response that third-party notice went out, and keep the record. It costs little and answers the first question a consumer will ask.
- For you: before you delete, use the right to know to ask which categories of third parties received your data (§1798.115(a)(2)). When you request deletion, ask the business to confirm that third-party notice went out, and keep its reply with the date. If you see a DROP status, note it next to that reply (Your DROP Status, Decoded).
For the wider question of who checks a reported status, see our working paper, Who Verifies the Status?
Sources, read 3 November 2026: Cal. Civ. Code §1798.100, §1798.105, §1798.115 and §1798.99.86 on leginfo.legislature.ca.gov; California Privacy Protection Agency, CCPA Regulations (effective 1 January 2026), §7022; Oregon Revised Statutes ORS 646A.574 on oregonlegislature.gov.
Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.
Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.
Sirveil for business: sirveil.ai/for-business
NONE OF THIS CONSTITUTES LEGAL ADVICE.