CAL.Regulation
California extends CCPA deletion rights to all data held about a consumer
Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, on September 27, 2026. Sponsored by the California Privacy Protection Agency, it extends the CCPA deletion right to all non-exempt personal information a business holds about a consumer, whether collected from the consumer or a third party. Businesses may keep a suppression record of the minimum data needed to keep the information deleted. Online-only businesses with a direct consumer relationship must offer a web-based request method.
Enrolled text (California Legislative Information) → · Office of the Governor, A&O Shearman (JD Supra)
Key points
- CalPrivacy characterized the pre-bill rule as a "loophole": third-party-sourced data survived deletion requests.A&O Shearman (JD Supra)
- The suppression-record allowance covers only the minimum data needed to keep the information deleted and not reacquired.A&O Shearman (JD Supra)
- Online-only businesses with a direct consumer relationship must add a web form or portal alongside an email address.California Legislative InformationA&O Shearman (JD Supra)
- Amends Civil Code 1798.105 and 1798.130; 45-day response duty with one 45-day extension on notice; account-creation ban preserved.California Legislative Information
- Existing CCPA exemptions, including for fraud prevention, research, and legal obligations, are preserved.A&O Shearman (JD Supra)
- Non-urgency measure effective January 1, 2027; chapter number still pending on LegInfo.California Legislative Information
Sources3 articles across 3 outlets
A&O Shearman (JD Supra)
California Legislative Information
Office of the Governor
Filed under
RegulationCal.SB 923 — Consumer privacy requests (Expanding Privacy Rights Act)ComplianceData protectionFor practitionersFor governance