GDPR Phone Number Deletion: What Are Your Rights?

What counts as “erasure” under GDPR?

GDPR (the EU’s General Data Protection Regulation) gives individuals a “right to erasure,” sometimes called the right to be forgotten, under Article 17. If a company, legally called a “data controller,” holds your phone number, email, or other identifying information, you can ask them to delete it, and they usually have one month to respond.

There are exceptions. A bank might keep your number for a legally required retention period. A company might argue the number is needed to prevent fraud on a shared account. But for ordinary marketing lists, app signups, or newsletter databases, erasure requests are usually granted. This is general information, not legal advice. If a company refuses a legitimate request, your national data protection authority is the place to escalate.

Enforcement isn’t theoretical

If you’re wondering whether companies actually take these requests seriously, the fine data answers it. Regulators have shown they will penalize mishandled personal data at scale.

How does this compare to CCPA in the US?

The California Consumer Privacy Act (CCPA) gives US residents a comparable right to request deletion of personal information, including phone numbers, held by businesses that meet certain size or revenue thresholds. The mechanics differ from GDPR, so response windows, exceptions, and enforcement bodies aren’t identical, but the core idea is the same: you can ask, and a covered business generally has to act. We break the US side down in our guide to CCPA phone number rights.

Neither law can force a company to delete a number if you have an active account you still want to use, or if the number is tied to a fraud-prevention record. Both laws apply to data a business already has. They don’t stop you from handing over a number to a new service tomorrow.

Why your real number ends up in so many databases

Most people give out their real number dozens of times a year, for app signups, loyalty programs, one-time downloads, or accounts they’ll use once. Each of those companies becomes a separate data controller with your number in their systems, sometimes indefinitely, sometimes shared with marketing partners you never agreed to. Many of those partners are data brokers, a trade we cover in do data brokers really sell your phone number.

The risk isn’t hypothetical: the more places your number sits, the more it’s exposed if any one of those companies has a breach. Erasure requests can clean up the past, but they don’t stop you re-creating the same exposure with the next signup.

Avoiding the problem at the source

The more direct fix is not giving your real number to services where you don’t need long-term access tied to it. A temporary number receives a one-time code directly, typically for 15 to 20 minutes, so you can complete a signup without your personal number touching that company’s database at all.

Say you’re setting up a Discord account while based in Germany and just need to confirm you’re a real person. You request a temporary number, choose Discord as the service, and receive the OTP (one-time passcode) straight on that temp number, not forwarded from your real phone, since the temp number is the one receiving it. Once the code arrives and you’re verified, that number’s job is done. Fewer companies hold your real digits, which means fewer places to send erasure requests to later. For accounts you plan to keep long-term and need to receive codes on again, a long-term rental fits better, since a short-term number expires and can’t be reused for that account.

What to expect when you submit a deletion request

For accounts where your real number is already on file, submitting a request is usually straightforward:

• Find the company’s privacy policy or account settings page and look for a “data request,” “privacy,” or “delete my data” option.
• State clearly that you’re requesting erasure of your personal data under GDPR (or CCPA, if you’re a California resident) and specify the phone number involved.
• Keep a copy of the request and the date you sent it, since response deadlines are tied to when the company received it.
• Expect confirmation within about a month under GDPR. CCPA timelines follow applicable state law and can differ.

What these laws can’t do

GDPR and CCPA cover data a business already holds. They can’t retroactively stop a data broker you’ve never contacted from having compiled your number from public records. They also can’t undo a breach that happened before your request. And they don’t apply to companies with no legal presence in the regulated jurisdiction, so a request to an obscure overseas app may simply go unanswered. Erasure rights are a cleanup tool, not a shield against future exposure. That part is on how you handle new signups going forward.

The bottom line

Your phone number is protected data under both GDPR and CCPA, and you have a real, usable right to ask for its deletion from most companies that hold it, backed by billions in fines for those that mishandle it. But rights you exercise after the fact only fix what’s already happened. The more durable habit is deciding, before you hand over your real number, whether a signup actually needs it, and using a temporary number for the ones that don’t.

Frequently Asked Questions

Does GDPR require companies to delete my phone number if I ask?

In most cases, yes. GDPR’s right to erasure covers phone numbers as personal data, and a company must generally delete it within about a month unless a legal exception applies, such as an active fraud-prevention record.

Is CCPA the same as GDPR for phone number deletion?

No, they’re separate laws with different scopes and timelines, but both give residents (EU/UK under GDPR, and California under CCPA) a comparable right to request deletion of personal data, including phone numbers, from covered businesses.

Can a temporary number help me avoid needing to request deletion later?

Yes. Using a temporary number for one-time signups means your real number never enters that company’s database in the first place, so there’s nothing to ask them to erase.

Does a temporary number forward the code to my real phone?

No. The temporary number receives the verification code directly on its own; it does not forward or relay anything to your personal phone number.

What if a company ignores my GDPR deletion request?

You can escalate to your country’s data protection authority, which oversees enforcement. This is general information and not a substitute for legal advice if the dispute becomes serious.