Consumers can request deletion of personal information with identity verification

CCPA § 1798.105 gives every California consumer — not just account holders — the right to have their personal information deleted. Deletion must be real: soft deletes that flip a deleted_at flag while leaving the record intact violate the statute. Worse, requiring an account to submit a deletion request is explicitly prohibited; that barrier alone is a CCPA violation independent of whether deletion actually works. Data retained past its legal basis is also a data-breach liability — hard-deleted records cannot be exfiltrated. Regulators treat deletion request failures as evidence of a systemic compliance gap, escalating enforcement from warnings to fines.

Implement an unauthenticated deletion request endpoint that issues a verification token via email, then permanently removes or anonymizes the consumer's records — not a soft-delete — once verified. The route must be reachable without login.

// app/api/privacy/request/route.ts — unauthenticated deletion flow
import { randomBytes } from 'crypto'

export async function POST(req: Request) {
  const { requestType, email } = await req.json()
  const token = randomBytes(32).toString('hex')
  const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000)

  await db.privacyRequest.create({
    data: { type: requestType, email, verificationToken: token, expiresAt, status: 'pending_verification' }
  })

  await sendEmail({
    to: email,
    subject: 'Verify your California Privacy Rights request',
    body: `Verify here: https://yourdomain.com/privacy/verify?token=${token}`,
  })

  return Response.json({ ok: true })
}

On verification, run permanent deletion across all tables — not UPDATE users SET deleted_at = NOW(). Document the permitted CCPA deletion exceptions (active transaction, fraud prevention, legal obligation) in your fulfillment runbook so staff can apply them consistently.