Your right to delete applicant data, state by state

Why the state matters at all

A deletion request works better when it names the basis you are relying on. It signals that you know the right exists, and it routes the message to the team that handles statutory requests rather than to general support.

The substance barely changes between states — you are asking the same organisation to delete the same data. What changes is the sentence naming the law.

California: the strongest position

California is the clearest case. The California Consumer Privacy Act, as amended by the CPRA, expressly covers job applicants — a scope many other state laws do not match, since several exempt employment data outright.

The Delete Act (SB 362) adds obligations for registered data brokers, which is relevant where a recruiting platform builds profiles of people who never applied to it.

If you live in California, you have the most direct route of anyone in the United States. Use it.

States with a comprehensive privacy law

These states have their own request wording in ATS Reset, grounded in their applicable data protection law:

An important caveat: several comprehensive state privacy laws exempt data held in an employment context, or apply only to businesses above a size threshold. Being on this list does not guarantee that every recipient must comply with every request. It means you have a named basis to cite, which is a materially better starting position than none.

If your state has no comprehensive law

Roughly half of U.S. states still have none. A request from those states rests on the federal fallback instead.

The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) governs consumer reporting agencies — organisations that assemble information about people and supply it to third parties for employment decisions, among others. Whether particular hiring technology falls inside that definition is genuinely contested, and it is the central question in the Eightfold class action.

Expect a mixed response. Some recipients will say the FCRA does not apply to them, which may well be correct. Others will process the request anyway, because honouring a reasonable deletion request is cheaper than arguing about it. Both outcomes are informative.

Outside the United States

If you are applying from outside the U.S., a request framed under “applicable data protection law” is the sensible general form. Readers in the UK and EU have a considerably stronger position under UK GDPR and the GDPR’s right to erasure, and should say so explicitly.

What a recipient can lawfully refuse

Deletion rights are not absolute anywhere. Common and legitimate grounds for refusing or narrowing a request include:

• A competing legal obligation. An employer inside its EEOC preservation window may be required to keep the application record.
• Pending litigation or an active charge. Records must be preserved until resolved.
• Failure to verify identity. Which is exactly why you should send from the email address you applied with.
• The law not applying to them. Size thresholds, employment-data exemptions, and jurisdiction all bear on this.

The practical rules that apply everywhere

1. Send it yourself, from your application email address. It is the single strongest identity signal you have, and a third party writing on your behalf usually triggers a verification loop that slows everything down.
2. Target vendors, not just employers. Vendors hold the profile, the ranking and the assessment result, and are less often bound by employer preservation duties.
3. Keep a record. What you sent, to whom, on what date. It is what makes a follow-up credible.
4. Follow up once. Many requests are simply missed.

ATS Reset writes the request for your jurisdiction using the wording for your state, and tracks what you have sent. See pricing · What to do before you apply again