California has expanded one of the core rights under the California Consumer Privacy Act (CCPA). On September 27, 2026, Governor Newsom signed SB 923, the Expanding Privacy Rights Act, authored by Senator Josh Becker and sponsored by the California Privacy Protection Agency (CalPrivacy). Starting January 1, 2027, a consumer’s request to delete will reach personal information a business bought or received from other sources, not only the information it collected directly from that consumer. The law also changes how online-only businesses must accept privacy requests.
This article explains what SB 923 changes, which businesses are affected, and practical steps to take before the new rules become operative. We also briefly note a related privacy bill, SB 690, signed a few days later.
Key takeaways
- SB 923 was signed on September 27, 2026, and takes effect January 1, 2027.
- The CCPA right to delete will cover personal information collected “from or about” a consumer, including data obtained from data brokers, partners, and other third parties.
- Businesses may keep a limited suppression record so that deleted information is not later re-acquired and used again.
- Online-only businesses with a direct consumer relationship must offer an online request method, such as a web form or portal, in addition to an email address.
- Existing deletion exceptions (for example, security and legal compliance) continue to apply.
What SB 923 changes
Deletion now reaches third-party data
Under the CCPA as originally written, the right to delete in Civil Code section 1798.105 applied to personal information a business collected from the consumer. Data a business obtained elsewhere, such as purchased marketing lists, enrichment data, or records received from a partner, generally fell outside that right. SB 923 amends section 1798.105 so the right to delete covers personal information collected from or about the consumer.
In practical terms, when a California consumer submits a verified deletion request on or after January 1, 2027, a covered business will generally need to locate and delete that person’s information regardless of how it entered the business’s systems, unless an exception applies. CalPrivacy described the goal as giving consumers the right to deletion “no matter how the business got that information” (CalPrivacy announcement).
Suppression records to keep data deleted
A common problem with third-party data is that it comes back. A business deletes a record, then receives the same person’s information in the next data purchase or partner feed. SB 923 addresses this by allowing a business to keep a record of the deletion request and the minimum information needed to make sure the deleted data stays deleted and is not used for other purposes. Building this kind of suppression process into data intake will be an important part of compliance.
Web forms for online-only businesses
SB 923 also amends Civil Code section 1798.130, which governs how businesses accept requests to know, delete, and correct. Businesses that operate exclusively online and have a direct relationship with consumers will need to offer an online submission method, such as a web form or privacy portal, rather than relying on an email address alone. Businesses with a physical presence continue to follow the existing rules on offering multiple request methods.
What stays the same
The existing CCPA exceptions to deletion remain. A business may still keep information that is reasonably necessary for purposes such as security and integrity or compliance with a legal obligation. The existing duty to notify service providers and contractors to delete, and to notify third parties to whom the business sold or shared the information, also continues, subject to the existing “impossible or disproportionate effort” limitation.
Which businesses are affected?
SB 923 applies to businesses already covered by the CCPA. Generally, that means for-profit businesses doing business in California that meet at least one of the CCPA’s thresholds, such as annual gross revenue above an inflation-adjusted amount, buying, selling, or sharing the personal information of a large number of California consumers or households, or earning a majority of revenue from selling or sharing personal information. Businesses that are not covered by the CCPA are not newly brought in by SB 923.
The change will matter most to companies that rely heavily on outside data: e-commerce and direct-to-consumer brands that buy or append marketing data, SaaS and technology companies that enrich customer records, lead-generation businesses, and companies that receive consumer data from affiliates or joint marketing partners.
A related change: SB 690 and website tracking claims
On September 30, 2026, the Governor also signed SB 690, which amends Penal Code section 637.2 of the California Invasion of Privacy Act (CIPA). For conduct on websites, online applications, and mobile applications, claims under CIPA’s pen register and trap-and-trace provision (Penal Code section 638.51) may be brought only by the Attorney General, not by private plaintiffs. This change is aimed at the wave of lawsuits over pixels, cookies, and analytics tools. SB 690 does not change private claims under CIPA’s wiretapping and eavesdropping provisions (sections 631 and 632), so website tracking practices still deserve attention. The bill also includes provisions on how it applies to recent and pending claims; businesses facing a current lawsuit should review those provisions with counsel. The text of both bills is available on the California Legislative Information website.
Practical steps before January 1, 2027
- Map your third-party data. Identify every outside source of consumer data: data brokers, list rentals, enrichment vendors, affiliates, partners, and platform integrations.
- Update deletion workflows. Make sure a verified deletion request searches all systems that hold third-party data, not only the records the consumer gave you.
- Build a suppression process. Keep only the minimum information needed to prevent deleted data from being re-imported, and limit its use to that purpose.
- Add a web form if you are online-only. If you currently accept privacy requests only by email, plan for a web form or portal.
- Review your contracts. Data purchase agreements, data processing addenda, and service provider contracts should address deletion cooperation, downstream notice, and how vendors handle suppression. Our outside general counsel services can help keep these agreements current.
- Refresh your privacy policy. Update the description of consumer rights and request methods so it matches your new process.
What this means for California business owners
For many companies, SB 923 is less about writing new policies and more about operations: knowing where outside data lives and being able to find and remove a specific person’s records on request. Starting the data mapping now leaves time to adjust systems and vendor contracts before the January 1, 2027 operative date. Building privacy terms into vendor and data agreements as they come up for renewal is usually easier than retrofitting them all at once. Information about our fee structure is on our legal fees page.
Frequently asked questions
When does SB 923 take effect?
SB 923 was signed on September 27, 2026, and takes effect on January 1, 2027.
Do I have to delete data I bought from a data broker?
If your business is covered by the CCPA, then starting January 1, 2027, a verified deletion request will generally extend to personal information about the consumer that you obtained from third parties, including data brokers, unless a statutory exception applies.
Can I keep anything after a deletion request?
Yes. The existing CCPA exceptions still apply, and SB 923 allows a business to keep a record of the request and the minimum information needed to make sure the deleted data is not re-acquired and used again.
Is an email address still enough to receive privacy requests?
For businesses that operate exclusively online and have a direct relationship with consumers, no. Under SB 923 they will need to offer an online method, such as a web form, in addition to an email address.
Talk with an attorney
If you would like help reviewing your privacy practices, request process, or data contracts before 2027, schedule a free 15-minute call or call 1 (800) 285-1140. Consultations are available in English, Romanian, and Russian; learn more about our Romanian-speaking and Russian-speaking services.
Author: Andrei Jingan
This article is general information, not legal advice. Reading it does not create an attorney-client relationship. Attorney advertising.