Data Deletion Request Runbook for Ads, CRM, and Email

TL;DR: When a customer asks you to delete their data, most US state laws give you 45 days to erase them from every system — ads, CRM, email, support. Deletion requests grew 82% in a year. A written runbook cuts handling from hours to under one hour per request.

What is a customer data deletion request?

A data deletion request is a customer formally asking your business to erase the personal information you hold about them — their email, phone number, order history, ad audience entries, and support tickets. In the US, this is often called the "right to delete." According to MultiState, twenty US states have comprehensive privacy laws in effect in 2026, and most give businesses 45 days to honor a deletion request. California allows one 45-day extension if you notify the person, per Clym's CCPA guide.

This is not a niche legal edge case anymore. According to DataGrail, data deletion requests climbed 82% year over year, making deletion the fastest-growing privacy request type for the fourth consecutive year. And Gartner predicted fines tied to mismanaged data subject rights would exceed $1 billion by 2026.

A deletion request is not the same as an unsubscribe or an ad opt-out. Unsubscribing stops emails but keeps the record. An opt-out (like Global Privacy Control) stops data sharing but keeps the profile. Deletion means the record itself has to go — from every marketing system you run. That is why handling customer data deletion requests across ads, CRM, and email needs a runbook, not improvisation. It is the same discipline behind any repeatable back-office process, which is why we treat it as part of AI and workflow automation for small business: a documented, partly automated workflow beats a scramble every time.

Where deletion requests hit a small business stack

The hard part is not the law — it is that one customer lives in six to ten systems. A single data deletion request across marketing systems typically touches:

• E-commerce: Shopify or WooCommerce order records, plus the customer profile synced to your email platform.
• Email and SMS marketing: Klaviyo, Mailchimp, or ActiveCampaign profiles, segments, and campaign history.
• CRM: HubSpot, Pipedrive, or Salesforce contact records, deals, notes, and call logs.
• Ad platforms: Google Ads Customer Match lists and Meta custom audiences built from uploaded emails.
• Support: Zendesk, Gorgias, or Intercom conversation history.
• The dark corners: spreadsheets, Zapier tables, data warehouse copies, and old CSV exports on someone's laptop.

Service businesses hit the same problem with booking tools and quote spreadsheets. B2B teams hit it with enrichment tools that quietly re-create contacts. Agencies hit it twice — once in their own stack and once in every client account they manage. If you have never mapped where customer data lives, a CRM data hygiene sprint is the natural first step, because you cannot delete what you cannot find.

Case study: from six hours per request to under one

A small e-commerce skincare brand we worked with — about 40,000 contacts — sells through Shopify with Klaviyo for email, HubSpot as the CRM, Google Ads and Meta for paid, and Zendesk for support. This example is an operator composite from That'sGonnaHelp project experience, not a public customer claim.

Before 2025 the brand saw maybe one deletion request a quarter and handled it by memory. Then volume rose to three or four per month, mirroring the 82% industry growth in deletion requests. Each request took five to six hours: the owner searched seven systems by hand, asked two contractors to check their exports, and wrote an email confirming completion. At roughly $40 per hour of loaded operator time, that was about $220-$240 per request — consistent with the low end of Gartner's estimate that manually fulfilling a single data subject request costs about $1,500 on average once legal review and rework are included at larger firms.

The breaking point was a rework incident. A deleted customer received a win-back email three weeks later. The cause: their profile was deleted in Klaviyo but not suppressed, and a nightly Shopify-to-Klaviyo sync quietly re-created it. The customer replied with a screenshot and a threat to complain to the state attorney general. Nothing came of it, but the owner stopped treating deletion as an ad-hoc chore.

The fix was a runbook, not new software. We wrote a one-page system inventory listing every tool that stores customer data, who owns the login, and the exact deletion mechanism in each. We added a request intake form on the privacy page that captures the requester's email and request type, feeding a ticket with a 45-day countdown.

The order of operations mattered most. The runbook snapshots the customer's identifiers first (email, phone, order IDs), then works from the edges inward: remove from Google Ads and Meta audience lists, suppress and then delete in Klaviyo, GDPR-delete in HubSpot, redact in Shopify and Zendesk, and only then confirm to the customer. Suppression happens before deletion in every tool that supports it, so automated syncs cannot re-create the profile.

What went wrong during rollout: Meta had no one-click "remove this person" button for an old uploaded list, so the team had to re-upload a cleaned customer list to update the audience. Two legacy CSV exports in Google Drive were found only in month two, after a full Drive search for the customer's email became a mandatory runbook step.

Results after three months: handling time fell from five-plus hours to about 45 minutes per request, no repeat-contact incidents, and every request closed with a dated log entry. The build cost roughly $3,000 in setup time. Against $200+ per request in saved labor at four requests a month, the payback planning range was four to six months — before counting avoided complaint risk. Treat these numbers as an estimate from one composite engagement, not a guarantee.

How do you respond to a data deletion request?

Respond by confirming receipt, verifying the requester's identity, deleting or de-identifying their data in every system, telling your vendors to do the same, and sending a completion confirmation — all within your legal deadline, typically 45 days. Here is the runbook version:

1. Log the request the day it arrives. Use a form or a dedicated privacy inbox. Record the date, channel, and requester's identifiers. The 45-day data deletion request timeframe starts at receipt, not when you get around to it.
2. Verify identity with data you already hold. Match the request to the email or phone number on file — for example, reply to the email address on the account. Do not collect new sensitive documents for a routine marketing-data request.
3. Check exemptions before deleting. CCPA right to delete exceptions let you keep data needed to complete a transaction, handle warranties and returns, meet tax and legal record obligations, or maintain security. Keep what the law requires, delete the marketing copies, and note which exemption you applied.
4. Snapshot identifiers, then delete from the edges inward. Save the email, phone, and customer IDs to your request log first. Then clear ad audiences, then email/SMS, then CRM and support. If you delete the CRM record first, you lose the keys you need to find them elsewhere.
5. Suppress before you delete. In every tool with a suppression concept, suppress first so integrations cannot re-add the profile after deletion.
6. Notify service providers and vendors. CCPA regulations expressly require you to tell your service providers to delete the consumer's data from their records too, per Kelley Drye's analysis of state privacy law requirements. For an SMB this usually means your agency, your data enrichment vendor, and any fulfillment partner holding customer files.
7. Confirm completion in writing and archive the log. Send the customer a short confirmation. Keep the request record — California expects businesses to keep records of privacy requests for 24 months, and you may not charge a fee for processing, per Clym.

Speed matters: as covered by CIO Dive, 58% of companies failed to meet data request deadlines in a Talend benchmark of GDPR-style requests. A written data deletion policy with named owners is what keeps you out of that 58%.

How do you delete customer data from ads, CRM, and email tools?

Yes — if a verified customer asks for deletion, you are expected to remove them from ad audiences you built from their data, not just your CRM. Each platform has its own mechanism, and knowing them in advance is most of the work:

The pattern across all six rows: a normal "delete" or "archive" button usually is not a compliance delete. Look for the wording "GDPR delete," "privacy request," "erasure," or "redact" in each tool. That distinction — permanent purge versus recoverable archive — is exactly what auditors and platform logs record.

How do you keep a deleted customer from being re-added?

Suppression is the answer: a minimal do-not-recreate record that blocks syncs, imports, and lookalike uploads from resurrecting a deleted profile. Deletion without suppression fails silently, because modern SMB stacks re-sync contacts nightly from e-commerce platforms, form tools, and enrichment services.

Practical suppression setup: keep the deleted person's email on the ESP suppression list (Klaviyo's deleted-profiles list does this automatically), add it to a small "privacy suppression" table your import automations check before creating contacts, and exclude it from every future ad-audience upload. Most US privacy laws permit retaining the minimum data needed to honor the request itself — that is what a suppression entry is. We covered the mechanics of keeping suppression lists in sync across CRM imports in a separate guide, and the same audit-trail thinking applies as in consent record-keeping for SMS and email.

Test it the way you would test any automation: run a fake deletion end to end, then re-import an old export containing that test contact and confirm the profile stays dead.

What does handling deletion requests cost?

For a typical SMB, the realistic planning range is $0-$500 per month in tooling plus 30-60 minutes of labor per request once a runbook exists — versus multiple hours per request without one. Estimated costs in USD:

According to DataGrail, manual privacy request processing costs businesses an estimated $1.26 million annually per 5 million unique website visitors — a 43% increase over 2023. SMB numbers are far smaller, but the direction is the same: volume is rising, and manual handling scales linearly with it. If you want to sanity-check whether automating intake and per-system checklists pays back at your request volume, run your own numbers through our automation ROI calculator. All figures above are planning ranges — check current vendor pricing before budgeting.

When a full runbook is not a good fit

If you get one deletion request a year, a full automated pipeline is overkill — a one-page system inventory and a saved checklist are enough. The law still applies to you; the automation just does not pay back yet.

If you operate only offline with no email marketing, no ad audiences, and no CRM, your exposure is a single system and this article is mostly future-proofing. And if you are mid-migration between CRMs or email platforms, fix the migration first — writing a runbook against a stack that changes next month is wasted work.

Common mistakes

• Treating unsubscribe as deletion. The customer asked for erasure; suppressing emails while keeping the profile does not satisfy the request.
• Deleting the CRM record first. You just destroyed the identifiers you needed to find the person in your ad and email tools. Snapshot first, delete last.
• Forgetting uploaded ad audiences. Customer Match lists and Meta custom audiences are copies of your data sitting inside ad platforms. They do not clean themselves.
• Skipping vendor notification. State rules require telling service providers to delete too; an SMB that never emails its agency or enrichment vendor leaves the job half done.
• No suppression, so syncs re-create the contact. The most common failure we see: deletion works, then a nightly integration resurrects the profile and the customer gets a campaign email.

FAQ

How long do you have to respond to a data deletion request? Most US state privacy laws set a 45-day deadline from receipt, and California allows one 45-day extension with notice to the consumer. GDPR-style rules in Europe use one month. Put the deadline on a ticket timer the day the request arrives.

What are the exceptions to the CCPA right to delete? You may keep data needed to complete the transaction the customer requested, handle returns and warranties, detect fraud and maintain security, comply with tax and other legal record-keeping obligations, or for certain internal uses compatible with customer expectations. Exemptions cover specific records, not the whole customer — you still delete the marketing copies.

How do customers submit data deletion requests? Through whatever channels you designate — typically a privacy page form or a dedicated email address. Under CCPA you cannot charge a fee for processing. Make the channel easy to find, because requests that arrive through support chat or Instagram DMs still start the legal clock.

Do small businesses have to comply with data deletion requests? It depends on thresholds. Most state laws apply above revenue or data-volume thresholds — for example, CCPA generally covers businesses with over $25 million revenue or data on 100,000+ consumers, and other states set their own lines. Many SMBs fall under at least one state's law once their email list grows, so check the states where your customers live rather than assuming exemption.

What happens if you ignore a data deletion request? You risk state attorney general enforcement, fines per violation, and complaint escalation. Gartner projected over $1 billion in cumulative fines for mismanaged data subject rights by 2026. For an SMB the more immediate damage is usually a public complaint or a chargeback-style dispute from an angry customer.

What is the difference between unsubscribing and deleting someone's data? Unsubscribe stops messages but keeps the record; opt-out stops selling or sharing data but keeps the profile; deletion erases the record itself, subject to legal exemptions. A deletion request generally implies all three.

Should you keep a record of completed deletion requests? Yes. California expects request records kept for 24 months, and a dated log of what was deleted, where, and under which exemptions is your proof if a regulator or the customer asks. Keep the log itself minimal — request date, identifiers needed for suppression, systems cleared, and completion date.

Answer clarity notes

• Dates: statistics reflect their linked source's publication period (DataGrail 2025 report, Gartner 2023 prediction, MultiState 2026 tracker, Talend/CIO Dive 2020 benchmark); state privacy laws change — verify current rules before acting.
• Scope: this article is US SMB operational guidance for marketing-system workflows. It is not legal advice; deletion obligations, thresholds, and exemptions vary by state and situation, so confirm specifics with a privacy attorney.
• Evidence: public sources support the linked statistics; the skincare-brand case study is a That'sGonnaHelp operator composite, not a public customer claim.
• Do not infer: cost figures, time savings, payback periods, and tooling prices are planning ranges and estimates, not guarantees; platform deletion mechanics (Google Ads, Meta, HubSpot, Klaviyo, Shopify) reflect vendor documentation at publication and can change — check current vendor docs.

Sources

• MultiState — 20 State Privacy Laws in Effect in 2026
• Clym — Handling Deletion Requests Under the CCPA
• DataGrail — Consumer Demand for Data Privacy Surges
• Gartner — Fines for Mismanaged Data Subject Rights to Exceed $1 Billion
• K2view — DSAR Processing Costs
• CIO Dive — 58% of Companies Fail GDPR Request Deadlines
• Kelley Drye — Instructing Vendors to Fulfill Deletion Requests
• Google Ads API — Manage Customer Match Lists

---

Not sure your stack would pass a deletion request end to end? That'sGonnaHelp maps SMB marketing systems and builds the intake, checklist, and suppression automation around them — get in touch if you want a second pair of eyes on your runbook.