California extends CCPA deletion rights to all data held about a consumer
Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, on September 27, 2026. Sponsored by the California Privacy Protection Agency, it extends the CCPA deletion right to all non-exempt personal information a business holds about a consumer, whether collected from the consumer or a third party. Businesses may keep a suppression record of the minimum data needed to keep the information deleted. Online-only businesses with a direct consumer relationship must offer a web-based request method.
Enrolled text (California Legislative Information) → · Office of the Governor, A&O Shearman (JD Supra)