If a company receives a ‘right to be forgotten’ request from one consumer, does it have to delete information it obtained from other consumers in the same household?


The CCPA states only that a business may have to delete the information that it obtained “from” the consumer that submits the right to be forgotten request.1 That said, an amendment to the CCPA deferred the full impact of the Act upon employee data until January 1, 2021.As a result, if a business obtained information from two consumers that reside in the same household, and receives a right to be forgotten request from one of those consumers, it does not need to delete the information that it obtained from the other consumer.  As an example, if two individuals in the same household signed up to receive advertising from a retailer by mail, and one of those individuals exercised their right to be forgotten, the retailer could continue to send advertisements to the second individual.