How to CCPA-Delete Your Respondus Monitor Recording (California Students, 2026)
Who must respond, and when
Under CCPA, both your university and Respondus are "businesses" that must respond. Your university is the primary contact; Respondus is contracted as a service provider.
| Entity | Statutory deadline | Where to write |
|---|---|---|
| Your university (Cal-resident university or admits Cal residents) | 45 days, extendable +45 with notice | The privacy email in their CCPA notice - usually privacy@[your-school].edu |
| Respondus | 45 days, extendable +45 with notice | privacy@respondus.com |
Threshold: are you covered?
CCPA covers any individual who is a California resident, defined as either (a) someone domiciled in California, or (b) someone in California for other than a temporary purpose. As a student, you qualify if:
- You're enrolled at a California university (UC, CSU, CC, or private CA school), OR
- You're a California resident enrolled remotely at an out-of-state school.
Note: as of 2025, several other US states (Virginia VCDPA, Colorado CPA, Connecticut CTDPA) have similar rights - the procedure below adapts with minor citation changes.
The deletion request - exact wording
Subject: CCPA §1798.105 Deletion Request - [Your Full Name], Student ID [#]
Dear Privacy Officer,
I am a California resident exercising my right under California Civil
Code §1798.105 to request deletion of personal information collected
about me. Specifically:
- Respondus Monitor exam recordings (video, audio, screenshots, ID photo)
- LockDown Browser session logs
- Any associated metadata (IP address, device fingerprint, timestamps)
Date range: [start] through [end]
Courses: [course code(s)]
Verification: [your university email + student ID prove identity]
I request:
1. Confirmation of deletion within 45 days per §1798.130(a)(2).
2. Direction to Respondus (your service provider under §1798.140(ag))
to delete the same records.
3. Confirmation of which third parties received the data, if any.
If you intend to refuse this request, please cite the specific exemption
under §1798.105(d).
I have not received financial incentive for this request, and you may
not discriminate against me for making it (§1798.125).
Thank you,
[Name]
[University email]
[Student ID]
[Date]
Likely responses
| Response | What it means | Your move |
|---|---|---|
| Granted | Standard outcome for old, ungated recordings. | Save the confirmation. |
| Refused under §1798.105(d)(1) - necessary to complete a transaction | If grading is incomplete, retention may be necessary. | Wait until grades posted, re-request. |
| Refused under §1798.105(d)(8) - public-interest research | Some universities claim this for retention. | Push back: §1798.105(d)(8) requires data to actually be used in a specific public-interest research project. Generic retention claims don't qualify. |
| Refused under §1798.105(d)(2) - exercise of free speech / right to petition | Rarely applies to exam recordings. | Ask for the specific use case justified. |
| No response after 45 days | CCPA violation. | Complain to the California Privacy Protection Agency (CPPA): cppa.ca.gov. |
Escalation
- If denied or no response: file a complaint with the California Privacy Protection Agency (CPPA) - free online form at cppa.ca.gov.
- The CPPA can issue cease-and-desist orders and fines up to $7,500 per intentional violation.
- You may also have a private right of action under §1798.150 for unauthorized disclosure (separate from deletion refusal).
Practical tips
- Send AFTER grades are finalized - pre-grading requests are routinely refused as "necessary to complete a transaction".
- Use your university email - proves California residency claim if your enrollment record reflects it.
- Keep both deletion confirmations (university + Respondus) - proof for audits or future disputes.
- Anti-retaliation protection: §1798.125 prohibits the university from denying services or charging differently because you exercised CCPA rights.
Frequently asked questions
Does CCPA apply if my university is out-of-state but I'm enrolled remotely from California?
Yes. CCPA covers California residents regardless of where the business is located, as long as the business meets the threshold of revenue or volume - which essentially every university with online students does.
Will deleting my recording flag my account for academic-integrity review?
It cannot legally - CCPA §1798.125 prohibits retaliation. If you experience adverse action correlated with your deletion request, document it and add it to a CPPA complaint.
How is this different from the GDPR deletion request?
Different statute, different deadline (45 days vs 30), different escalation path (CPPA vs national DPA). Functionally similar - both let you compel deletion. Use CCPA if you're a California resident; GDPR if you're an EU resident; both if you're both.