GoKawiilCalifornia enacts SB 923, extending CCPA deletion rights to third-party data
Governor Newsom signed SB 923 on September 27, 2026, amending the CCPA so consumer deletion requests cover personal information a business acquired from brokers or other third parties, not just data collected directly. The law also requires online-only businesses to offer a web form or portal for privacy requests, not just an email address, by January 1, 2027. The same day, Newsom vetoed a separate bill, AB 1542, that would have banned outright sales of sensitive personal information.
GoKawiil's interpretation of the reporting above, not reported fact.
Businesses that rely on purchased or appended data will need new processes, such as suppression lists, to ensure deleted records don't reappear in future data refreshes, according to CalPrivacy. The change closes what the agency's executive director described as a longstanding gap in the CCPA, potentially raising compliance costs for data brokers and companies that enrich consumer profiles with third-party sources.
- SB 923 extends CCPA deletion rights to cover data obtained from third parties, not just directly collected data.
- Online-only businesses must add a web form or portal for privacy requests by January 1, 2027.
- Newsom vetoed AB 1542, which would have banned sales of sensitive personal information outright.
Source: getprivisy.com, 2026-09-28
Published there as: “SB 923 is Law: CCPA deletion rights now reach third-party data”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.