---
title: "Decide whether personal information the business no longer needs should be deleted or disposed of"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-22-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Decide whether personal information the business no longer needs should be deleted or disposed of

> List each category still held, the purpose on the collection notice, and whether that purpose has ended. Separate a consumer's deletion request from the business's own retention decision.

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | List each category still held, the purpose on the collection notice, and whether that purpose has ended. Separate a consumer's deletion request from the business's own retention decision. |
| What the lawyer must review | The California Privacy Protection Agency's FAQ requires a covered business to limit retention, as well as collection and use, to the purposes it describes, and only to what is reasonably necessary and proportionate. A California resident can also request deletion of personal information the business collected from them, and the business must tell its service providers to delete, subject to exceptions such as a legal duty to keep the information. The FTC Start with Security guide says a business should know what personal information it stores, keep only what is essential, protect what it keeps, and properly dispose of what it no longer needs. These pages do not describe an Australian-style de-identification alternative that replaces deletion. |
| Written for | United States |
| Applies to | [Decide whether personal information no longer needed should be destroyed or de-identified](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/decide-whether-personal-information-no-longer-needed-should-be-destroyed.md) |

## Checking plan

- What the AI does: List each category still held, the purpose on the collection notice, and whether that purpose has ended. Separate a consumer's deletion request from the business's own retention decision.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The Attorney General's page lists further exceptions to the right to delete, including completing a transaction and certain warranty or product-recall purposes.
- A children's online service has a separate COPPA retention duty: keep the child's information only as long as necessary for the purpose and delete it using reasonable measures.

## Sources

- [California Privacy Protection Agency: Frequently Asked Questions](https://cppa.ca.gov/faq.html) (checked 2026-10-22)
- [Start with Security: A Guide for Business](https://www.ftc.gov/business-guidance/resources/start-security-guide-business) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*