Last updated: October 2026
California is strengthening consumer privacy rights once again. On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (SB 923), known as the Expanding Privacy Rights Act. The legislation amends the California Consumer Privacy Act (CCPA) to expand consumers’ right to delete personal information and make it easier to submit privacy requests.
The changes take effect January 1, 2027, giving businesses a limited window to review their privacy policies, deletion workflows, vendor relationships, and consumer request procedures.
For businesses subject to the CCPA, the message is straightforward: deletion processes must account for personal information obtained from third parties, not just information collected directly from consumers.
Here is what compliance teams need to understand and how to prepare.
What Is Changing Under SB 923?
SB 923 introduces two key changes to California’s existing privacy framework:
- An expanded right to delete: Consumers can request deletion of personal information a business has collected from or about them, including information obtained from third-party sources.
- An additional online submission requirement: Certain online-only businesses must offer an online method, such as a web form or online portal, for privacy requests in addition to providing an email address.
These amendments address gaps in the existing framework, particularly when businesses enrich customer profiles with information from data providers, marketing platforms, analytics services, and other third parties.
The legislation is available through the California Legislature’s official SB 923 bill text. The California Privacy Protection Agency also published an overview of the new law.
1. The Right to Delete Now Extends Beyond Information Collected Directly From Consumers
Under the previous framework, businesses could face uncertainty about whether a deletion request covered personal information obtained from third parties rather than directly from the consumer.
SB 923 clarifies that the right to request deletion applies to personal information collected from or about a consumer, regardless of its source.
Why this matters
Consider an online retailer that collects a customer’s name, email address, and purchase history directly. The retailer also supplements its customer database with information from marketing partners, advertising platforms, data providers, or other external sources.
When the customer submits a valid deletion request, the business must consider the personal information it obtained indirectly as well as the information it collected directly.
A deletion workflow limited to the primary customer database may no longer be sufficient if personal information remains in connected systems, enrichment databases, or other relevant records.
What businesses should review
Compliance teams should map where personal information is stored and how it moves through their organizations. This review should include:
- Customer relationship management (CRM) systems.
- Marketing automation and advertising platforms.
- Third-party data enrichment services.
- Customer analytics and profiling tools.
- Service providers, contractors, and other relevant third parties.
- Internal databases and business applications containing personal information.
The objective is to establish a reliable process for identifying the information associated with a consumer and carrying out applicable deletion obligations across the relevant systems.
2. Businesses Need a More Comprehensive Deletion Process
SB 923 requires businesses responding to a verifiable consumer deletion request to delete applicable personal information from their records and notify service providers, contractors, and relevant third parties to delete the information, subject to the law’s limitations.
This means deletion should be treated as an operational process rather than a one-time action performed in a single database.
Recommended compliance steps
Step 1: Identify the consumer’s records.
Use appropriate identifiers and verification procedures to locate personal information across relevant systems.
Step 2: Identify the data sources.
Determine whether the information was collected directly, obtained from a third party, or processed by a service provider or contractor.
Step 3: Execute the deletion workflow.
Delete the information covered by the request in accordance with the law, including applicable downstream notification requirements.
Step 4: Document the response.
Maintain appropriate records showing when the request was received, how it was handled, and whether any legally permitted retention applies.
Step 5: Prevent unnecessary reacquisition or reuse.
Review data imports, enrichment processes, and vendor feeds to reduce the risk of deleted information being reintroduced into active business systems.
The final step deserves particular attention for organizations that regularly refresh customer information from external databases.
3. Businesses May Retain Limited Records to Prevent Reintroduction of Deleted Information
Deletion does not necessarily mean that every record associated with a consumer must disappear without exception.
SB 923 permits a business that obtained personal information from a source other than the consumer to retain a record of the deletion request and the minimum data necessary to ensure the information remains deleted from its records and is not used for another purpose.
The law also permits a confidential record of deletion requests for specified purposes, including preventing personal information from being sold, where otherwise permitted by law.
This creates an important distinction between retaining information to honor a deletion request and retaining information for unrelated commercial purposes.
What does this mean in practice?
Businesses should consider maintaining a narrowly scoped suppression record or deletion-control mechanism.
Such a record might contain only the minimum identifiers needed to recognize a previously submitted deletion request and prevent the affected information from being reintroduced or sold.
Compliance teams should establish clear controls around these records:
- Limit the information retained to what is necessary.
- Restrict access to authorized personnel and systems.
- Prohibit unrelated marketing or profiling uses.
- Document the purpose and retention rules.
- Review the process with privacy counsel to confirm that it complies with applicable requirements.
The goal is to preserve the consumer’s deletion choice without turning a suppression record into another general-purpose customer database.
4. Online-Only Businesses Must Provide an Online Request Method
SB 923 also changes how certain consumers can submit privacy requests.
Previously, an exclusively online business with a direct relationship with the consumer from whom it collects personal information could satisfy the relevant submission-method requirement by providing an email address.
Beginning January 1, 2027, these businesses must also make an online method available, such as a web form or online portal.
What should businesses do?
Organizations that rely exclusively on a privacy email address should review their request submission process before the effective date.
An online request form should be easy to locate and use, accessible to consumers, and connected to an internal workflow that routes requests to the appropriate personnel.
A well-designed form may capture the information necessary to identify the type of request, initiate verification where appropriate, record the submission date, and track the request through completion.
Businesses should also test the process to ensure that submissions are received, assigned, and handled within applicable response deadlines.
Important: The new online-method requirement does not mean every business must provide the same set of request channels. The applicable requirements depend on the business’s circumstances and the statutory language.
5. Existing CCPA Deletion Exceptions Still Matter
Although SB 923 expands the right to delete, it does not eliminate all existing exceptions.
The law continues to permit certain information to be retained when reasonably necessary for specified purposes. These include, subject to the applicable legal conditions, completing transactions, fulfilling contractual obligations, maintaining security and integrity, debugging, complying with legal obligations, and other permitted uses.
Businesses should therefore avoid treating every deletion request as an instruction to erase every record immediately and without review.
Instead, they should establish a documented decision process that distinguishes:
- Information that must be deleted.
- Information that must be deleted from service providers’ or other relevant records.
- Information that may be retained under a valid statutory exception.
- Limited information retained to prevent deleted personal information from being reintroduced or used for another purpose.
Where an exception applies, the organization should document its rationale and ensure that retained information is not used beyond the permitted purpose.
6. A Practical Compliance Checklist for January 1, 2027
Businesses should use the remaining preparation period to evaluate whether their privacy operations are ready for the changes.
| Compliance area | Recommended action |
|---|---|
| Data inventory | Map personal information held in internal systems and obtained from third parties. |
| Deletion procedures | Update workflows to cover information collected from or about consumers. |
| Third-party relationships | Review contracts, deletion instructions, and cooperation procedures with service providers and contractors. |
| Suppression records | Establish a restricted mechanism to prevent deleted information from being reintroduced or sold, where appropriate. |
| Consumer request channels | Confirm that required request methods are available, including an online submission method for businesses covered by the new requirement. |
| Privacy policy | Review descriptions of deletion rights and instructions for submitting requests. |
| Request tracking | Maintain records of receipt, verification, processing, completion, and applicable exceptions. |
| Staff training | Train privacy, customer service, IT, marketing, and other relevant personnel. |
| Testing | Test deletion requests across connected systems and third-party data flows. |
Businesses should also confirm that their processes continue to meet existing CCPA requirements, including applicable verification procedures and response timelines.
7. Another January 1, 2027 Development: Browser-Based Opt-Out Signals
SB 923 is not the only California privacy development scheduled for January 1, 2027.
California’s Opt Me Out Act, AB 566, establishes requirements for browser developers to provide configurable functionality that enables browsers to send opt-out preference signals. These signals communicate a consumer’s choice to opt out of the sale and sharing of personal information.
This is distinct from SB 923’s expanded deletion rights. Businesses should review their handling of opt-out preference signals separately, including whether their privacy management technology recognizes and appropriately processes applicable signals.
The California Privacy Protection Agency provides additional information in its official privacy law resources.
How Privacy Technology Can Help
As privacy requirements evolve, businesses need processes that connect consumer requests with the systems, teams, and service providers responsible for personal information.
Privacy management technology can help organizations centralize requests, maintain records, route tasks, and monitor completion. Depending on the platform and configuration, automation may also help coordinate actions across connected systems.
However, technology alone does not establish compliance. Businesses must ensure that their workflows reflect their actual data practices, that integrations cover relevant systems, and that legal exceptions are handled appropriately.
Organizations should evaluate privacy solutions based on their ability to support the full request lifecycle, including discovery, verification, deletion, downstream coordination, documentation, and ongoing prevention of inappropriate reuse.
Conclusion: Prepare Before January 1, 2027
SB 923 expands California consumers’ deletion rights to cover personal information collected from or about them, including information obtained from third parties. It also requires certain online-only businesses to provide an online method for submitting privacy requests.
For businesses subject to the CCPA, preparation should begin with a practical review of data inventories, third-party relationships, deletion workflows, suppression controls, privacy notices, and consumer request channels.
Organizations that already maintain comprehensive deletion processes may need fewer operational changes. Businesses that rely heavily on third-party data enrichment or email-only request procedures may need a more substantial review.
The key takeaway: A deletion request must be evaluated across the relevant personal information a business holds, not just the information a consumer originally provided.
Taking time now to assess processes, test workflows, and document responsibilities can help businesses prepare for the January 1, 2027 effective date.
Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. The applicability of the CCPA and its amendments depends on the facts and circumstances of each business. Organizations should consult qualified legal counsel regarding their specific compliance obligations.
About Optacy
Optacy helps businesses navigate privacy compliance and manage evolving data protection requirements. As privacy laws develop, organizations need clear processes, appropriate technology, and practical controls to manage consumer requests and protect personal information.