How many deletion requests can a consumer send to a business each year?

The CCPA does not specify how many deletion requests a consumer can send to a business each year. However, it does permit businesses to “refuse to act on” a deletion request if a consumer’s requests become “unfounded or excessive.”¹  The Act specifically calls out “repetitive” requests as an example of an excessive practice.²  If a dispute arises between a business and a consumer regarding whether a particular quantity of requests is, or is not, excessive, the CCPA states that the “business shall bear the burden of demonstrating” that the quantity received is “manifestly . . . excessive.”³  One method that businesses may consider adopting when determining whether deletion requests are excessive, or in demonstrating that excessiveness, is to compare the quantity of deletion requests received from a particular consumer, with the quantity of deletion requests received from other consumers.  To the extent that a particular consumer’s quantity of requests significantly departs from the behavior of most (or all) other consumers, a strong argument could be made that the requests have become repetitive and excessive.