California SB 923 Expands CCPA Deletion Rights to Third-Party Data, Requires Online Request Forms

New Law Expands Deletion Scope

On September 27, 2026, California Governor Newsom signed SB 923, known as the Expanding Privacy Rights Act. This new law, sponsored by the California Privacy Protection Agency (CalPrivacy), amends the California Consumer Privacy Act (CCPA) to broaden consumer deletion rights. The changes will take effect on January 1, 2027.

Third-Party Data Now Covered

Previously, CCPA Section 1798.105 allowed consumers to request deletion of personal information a business collected directly from them. SB 923 revises this right to cover information collected "from or about the consumer," irrespective of its source. This means data acquired from data brokers or enrichment vendors is now subject to deletion requests. For third-party data, businesses must maintain a record of the request and minimum data for suppression lists to prevent the reintroduction of deleted records.

New Requirements for Privacy Requests

The bill also amends Section 1798.130, requiring businesses that operate exclusively online and have direct consumer relationships to offer an online method, such as a web form or portal, for privacy requests (know, delete, or correct) in addition to an email address. This change also becomes effective on January 1, 2027.

Impact on Businesses

Businesses that acquire consumer data from external sources, such as lead lists or audience matching services, must update their deletion workflows to encompass these third-party data sources. They will need to build suppression steps to ensure deleted records are not re-added. Exemptions for fraud prevention, research, and legal obligations remain in place.