Data Privacy & Digital Rights
Make a CCPA / VCDPA / CPA data deletion request, get non-consensual intimate images removed under the TAKE IT DOWN Act 2025, and assert your right to be forgotten under US state privacy laws.
Covered in this guide:
The US still has no comprehensive federal data-privacy law. Instead, a patchwork of state privacy laws — California's CCPA / CPRA, Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, and a growing list (Texas, Oregon, Tennessee, Montana, Iowa, Indiana, Delaware, New Hampshire, New Jersey, Maryland, Minnesota, Rhode Island, Kentucky, Nebraska) — gives most Americans a working right to access, delete, and opt out of the sale of their personal data. The federal layer is the TAKE IT DOWN Act, signed 19 May 2025, which criminalises non-consensual intimate imagery (including AI deepfakes) and requires covered online platforms to remove such content within 48 hours of a valid notice — covered platforms have until 19 May 2026 to implement the notice-and-removal process.
For victims of non-consensual intimate imagery, two specialist services run alongside the legal path: StopNCII.org (operated by SWGfL / Revenge Porn Helpline) hashes 18+ adult images for proactive removal across participating platforms; takeitdown.ncmec.org (operated by the National Center for Missing & Exploited Children) does the same for under-18 imagery. The Cyber Civil Rights Initiative (cybercivilrights.org) provides US victim support. Use these alongside — not instead of — the legal channels.
Key Laws
TAKE IT DOWN Act
Public Law 119-12 (signed 19 May 2025)
Federal criminal prohibition on NCII and AI deepfakes; covered-platform 48-hour notice-and-removal requirement (in force for platforms by 19 May 2026).
California Consumer Privacy Act / Consumer Privacy Rights Act
Cal. Civ. Code § 1798.100 et seq.
Right to know, delete, correct, and opt-out of sale/sharing of personal information; 45-day business response (extendable once by 45).
Virginia Consumer Data Protection Act
Va. Code Ann. § 59.1-575 et seq.
Right to access, correct, delete, port, and opt out of targeted advertising; 45-day controller response.
Children's Online Privacy Protection Act (COPPA)
15 U.S.C. § 6501 et seq.
Verifiable parental consent rules and deletion rights for personal data of children under 13.
Making a Data Deletion Request Under US State Privacy Laws
Under California's CCPA / CPRA and the growing roster of state comprehensive privacy laws, US consumers can require a business to delete the personal information it has collected from them. The CCPA a...
Removing Non-Consensual Intimate Images and Deepfakes
If you are in immediate danger, call 911. The Cyber Civil Rights Initiative crisis helpline is 1-844-878-2274. Non-consensual intimate imagery — including AI-generated deepfakes — became a federal cri...
Online Harassment, Cyberstalking, and Threats
If you are in immediate danger, call 911. Online harassment in the US falls under a layered patchwork: federal 18 U.S.C. § 2261A criminalises cyberstalking that crosses state lines or uses interstate...