Right to Be Forgotten in California: What CCPA Actually Covers (And What It Doesn't)

What the CCPA Right to Delete Actually Is

The California Consumer Privacy Act took effect January 1, 2020, and was the first comprehensive state privacy law in the United States. At its core, CCPA gives California residents the right to know what personal information businesses collect about them, the right to request deletion of that information, and the right to opt out of its sale or sharing. The law applies to for-profit businesses that meet certain revenue or data-volume thresholds and that collect personal information from California residents.

The right to delete under CCPA (codified as Civil Code Section 1798.105) lets a consumer send a verified request to a covered business demanding that it delete personal information the business has collected about that consumer. The business must respond within 45 days, and in most cases must comply unless a recognized exception applies. Covered personal information is broad: it includes name, address, email, browsing history, purchase history, biometric data, geolocation data, and much more.

This is a powerful right -- but it operates entirely within the business-to-consumer data relationship. It is designed to address data brokers that build profiles on people, apps that track behavior, retailers that aggregate purchase history, and platforms that sell consumer data to advertisers. The paradigm is: a company has your data in a database, and you have the right to demand that company delete it.

That paradigm has nothing to do with a news article. A news article is editorial content published by a journalistic organization. The publisher does not hold a data profile on you in the commercial sense that CCPA addresses. The article is a piece of journalism, and California law treats journalism with explicit, protected exemptions.

The Journalism Exception: Why CCPA Does Not Touch News Articles

CCPA contains an explicit journalism exemption. California Civil Code Section 1798.145(a)(6) exempts from CCPA's deletion obligations any personal information that is "used by a business to fulfill its statutory obligations" under California shield law or related press protections, and more broadly, the law provides protections for the collection and publication of information that serves journalistic, editorial, or news-gathering purposes consistent with First Amendment principles.

The exemption exists for a straightforward constitutional reason. The First Amendment protects the press's right to publish information of public interest. A state privacy law that allowed private individuals to demand deletion of news articles about them would create an end-run around that constitutional protection. California's legislature was careful to preserve journalistic speech even as it expanded consumer data rights in the commercial sphere.

What this means in practice is clear: if a news outlet published an article about you -- whether it covers an arrest, a lawsuit, a business controversy, a public dispute, or any other matter of journalistic interest -- that publication is not subject to CCPA's right to delete. You cannot send a CCPA deletion request to the Los Angeles Times, the San Francisco Chronicle, or an online news site and compel them to remove an article about you under California privacy law.

This is not a loophole or an oversight. It is a deliberate policy choice that reflects the balance California has drawn between privacy rights and press freedom. That balance may be frustrating if you are the subject of damaging coverage, but it is the law as written and as enforced by the California Privacy Protection Agency.

Where CCPA Works Well: Data Brokers and the People-Search Problem

While CCPA cannot touch news articles, it is genuinely effective against a different category of online content that causes significant reputation harm: data broker profiles. Data brokers are companies that collect, aggregate, and sell personal information about individuals -- typically from public records, commercial sources, and other data aggregators. They then publish this information on people-search websites accessible to anyone who pays for a lookup or, in many cases, for free in basic form.

Companies like BeenVerified, Spokeo, Whitepages, Intelius, PeopleFinder, MyLife, TruthFinder, and dozens of others operate in this space. Their profiles on individuals can include home address history, phone numbers, email addresses, family member names, employment history, estimated income, criminal record summaries, and much more. These profiles frequently appear in Google search results when someone searches a person's name, and they can cause real harm to employment prospects, personal safety, and reputation.

CCPA's right to delete is squarely applicable here. A California resident can send verified deletion requests to these data brokers demanding removal of their profile. California also enacted the Delete Act (SB 362, effective 2026), which goes further by requiring data brokers to register with the state and, in the future, to honor deletion requests submitted through a single state-managed opt-out mechanism. This is a genuine and meaningful privacy right that California residents can exercise.

The distinction matters for two reasons. First, removing data broker profiles can meaningfully improve a person's search result footprint because those profiles do appear in Google results and their removal does reduce some types of unwanted personal information online. Second, the removal of a data broker profile is categorically different from the removal of a news article: one addresses commercial data aggregation, the other would require compelling a journalist or publication to alter or delete editorial content.

CCPA vs. GDPR: A Practical Comparison for News Article Removal

The confusion between CCPA and GDPR's right to be forgotten is understandable. Both are framed in the language of data privacy rights, and both include some version of a right to request deletion. But the two laws are fundamentally different in scope, enforcement mechanism, and what they actually cover.

The GDPR right to be forgotten -- formally the "right to erasure" under Article 17 of the General Data Protection Regulation -- is significantly broader than CCPA's right to delete. Under GDPR, an individual can request erasure of personal data when the data is no longer necessary for the original purpose it was collected, when the person withdraws consent, when the person objects to processing and there are no overriding legitimate grounds, or when the data was unlawfully processed. Critically, the right has been interpreted to apply to search engines: the landmark Google Spain case (2014) established that individuals can request that search engines de-index certain results linking to their personal data.

GDPR does not create an absolute right to remove news articles. Article 17(3)(a) contains an explicit exemption for processing necessary to exercise the right of freedom of expression and information, which covers journalism. But GDPR's framework does allow de-indexing requests to search engines that operate in the EU, and the balance it strikes between privacy and press freedom differs meaningfully from the US approach.

GDPR is European law. It applies to data controllers and processors who operate in the EU or who offer goods and services to EU residents. US residents dealing with US-based news publications and a US-based Google search are generally not within GDPR's jurisdiction. Some individuals attempt to invoke GDPR against Google's EU operations for content that appears globally, with mixed success and significant legal complexity. For most California residents dealing with a domestic news article, GDPR is not a practical tool.

What the CPRA Added in 2023 -- and What It Still Does Not Cover

The California Privacy Rights Act, passed as Proposition 24 in November 2020 and effective January 1, 2023, amended and substantially strengthened CCPA. The CPRA created new categories, new rights, and a new enforcement agency. Understanding what it added -- and what it did not change -- is important for anyone assessing their options under California privacy law.

The CPRA introduced the category of "sensitive personal information," which includes Social Security numbers, financial account numbers and credentials, health and medical information, biometric data, genetic data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, and precise geolocation data. Consumers gained a new right to limit the use and disclosure of sensitive personal information, which goes beyond the basic right to delete. A business subject to CPRA can be required not just to delete sensitive data but to restrict how it is used even if retained.

The CPRA also created the California Privacy Protection Agency (CPPA), an independent state agency dedicated to CCPA and CPRA enforcement and rulemaking. Previously, enforcement sat with the state Attorney General. The dedicated agency has increased enforcement capacity and regulatory activity. Data brokers in particular face heightened scrutiny under the Delete Act, which the CPPA is implementing.

None of these expansions altered the journalism exemption. News organizations remain exempt from CCPA and CPRA obligations as they relate to journalistic content. The CPRA's expanded sensitive personal information protections are meaningful for consumers dealing with commercial entities, but they do not give California residents any new rights to demand removal of news articles that contain sensitive information about them. The exemption that protects press freedom was preserved intact through the CPRA amendments.

Google in California: What CCPA Covers and What It Does Not

Google is a California company and a covered business under CCPA. This creates understandable confusion: if Google is subject to CCPA, can California residents use CCPA to demand that Google remove search results linking to news articles about them?

The answer requires distinguishing between two things Google does that look similar but are legally very different. First, Google collects personal data about its users -- search history, location data, advertising profiles, account information, and much more. That data collection is subject to CCPA, and California residents can exercise CCPA rights against Google with respect to data Google has collected directly about them as users of Google's services.

Second, Google indexes third-party websites -- including news publishers -- in its search results. When a news article about you appears in a Google search, Google is not "collecting" your personal data in the commercial sense that CCPA addresses. It is indexing and displaying a link to third-party editorial content. The journalism exemption that protects the original publisher also protects Google's display of that content in its search index. CCPA cannot compel Google to deindex editorial content any more than it can compel the original publisher to delete it.

Google does operate its own removal tools outside of CCPA for specific categories of content that it will deindex upon request. These tools exist because Google has made its own policy choices, not because CCPA requires them. Google will consider deindexing requests for content that includes financial account numbers and personal identification numbers, login credentials, medical records, national identification numbers, certain images of people, content posted in the context of doxxing or harassment, and -- following a 2023 policy change -- some arrest record information that does not relate to a final conviction. These tools are worth understanding and using where applicable, but they operate on Google's terms, not California's.

What California Residents Can Actually Do About News Articles

The fact that CCPA does not apply to news articles does not mean California residents are without options. The paths available are more difficult than a statutory deletion request, and success rates vary, but meaningful remedies exist. Our complete right to be forgotten guide covers the full landscape; this section focuses on what applies specifically in the California context.

California residents have no structural advantage over residents of other states when it comes to news article removal, but they do face the same set of options that exist throughout the United States. Our article on the right to be forgotten in the United States covers the full framework in detail. The primary paths are as follows.

• 1
  Request editorial removal from the publisher directly. News organizations do remove or update articles in specific circumstances: when the article contains factual inaccuracies, when the underlying matter has been resolved in a way that materially changes the picture the article presents, when the subject was a minor at the time, when the story involves information obtained in violation of law or journalistic ethics, or when the article is outdated to the point of being misleading. California's relatively robust press culture means many publications have formal editorial review processes. Working with a specialist who understands how to frame these requests significantly improves success rates.
• 2
  Use Google's removal tools for applicable content categories. If a news article contains your home address in the body text, your financial account information, or content that constitutes doxxing, Google's PII removal tool may produce deindexing of the specific article from Google Search. This does not delete the article from the publisher's website but removes it from Google results, which is often the practical goal. The process is imperfect and Google's decisions are discretionary, but the tool is worth using when the content falls within its stated categories. Our guide on whether Google removes negative articles explains the mechanics in detail.
• 3
  Assess defamation claims under California law. California is governed by the same First Amendment standards that apply nationally: truth is an absolute defense, and public figures face the actual malice standard established in New York Times v. Sullivan. California does have a relatively strong anti-SLAPP statute (Code of Civil Procedure Section 425.16) that can be used defensively if a plaintiff is accused of filing a defamation suit primarily to chill speech. For genuine defamation -- false statements of fact presented as true, causing measurable harm -- California courts are available. But the bar is real, the cost is high, and outcomes depend heavily on whether the article is accurate.
• 4
  Pursue search suppression through new authoritative content. If removal is not achievable, the practical alternative is to build indexed content that outranks the article for your name. Authored pieces in credible publications, professional profile optimization, speaking engagements, awards, and media coverage of different and positive events all contribute to pushing the negative article lower in search results. This is a longer-term strategy but often the most reliable one for content that publications will not remove. We cover this in depth in our article on what GDPR's right to be forgotten actually means for news articles.
• 5
  Use CCPA for what it does cover alongside your news article strategy. Even if CCPA cannot address the news article itself, it is worth running a parallel data broker removal campaign. Removing your profile from Spokeo, BeenVerified, Whitepages, and similar sites cleans up a category of search results that often appears alongside news articles and adds to the overall harm. A comprehensive approach uses every available tool for its appropriate purpose.

Arrest Records, Expungement, and the California News Article Problem

California has notably strong protections around arrest records that did not lead to conviction. Penal Code Section 851.8 provides a process for factual innocence findings and record sealing. Penal Code Section 851.87, added in 2017, created a right to petition for sealing of arrest records where no conviction resulted, without requiring a showing of factual innocence. These state law protections are meaningful for the underlying court records held by law enforcement and court systems.

But California's arrest record sealing provisions do not bind news organizations. If a news outlet published an article at the time of your arrest and the underlying record is later sealed or expunged, the publication is under no legal obligation to update or remove the article under California's arrest record laws. The First Amendment again constrains what state law can require of news publishers regarding historical coverage.

Google updated its removal policies in 2023 to allow deindexing requests for certain arrest record content where no charges were filed or where charges did not result in conviction. This is a significant practical tool for California residents dealing with arrest coverage, even though it operates through Google's own policy rather than California or federal law. The removal is not guaranteed and is subject to Google's case-by-case review, but it represents a meaningful avenue that did not exist before the policy change.

For arrest-related news articles where CCPA is inapplicable and Google's tools do not produce deindexing, editorial removal requests remain the primary path. Journalists and editors are often more receptive to removal requests for arrest coverage when the underlying case was dismissed, charges were never filed, or the person was acquitted. Framing such requests carefully, with documentation of the legal outcome, is essential to success.

Common Questions About California's Right to Be Forgotten