California Enacts SB 923, Extending CCPA Deletion Mandates to Third-Party Data
The Expanding Privacy Rights Act closes a statutory loophole to cover data brokers and enrichment services, requiring online businesses to add interactive request forms by 2027.
California Governor Gavin Newsom has signed Senate Bill 923, expanding consumer data deletion mandates under the California Consumer Privacy Act to encompass third-party sources and requiring online-only businesses to provide web-based intake forms by January 1, 2027.
According to reporting aggregated via Hacker News (https://www.getprivisy.com/blog/sb-923-ccpa-right-to-delete-signed), the measure—known as the Expanding Privacy Rights Act—was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency. The bill passed the State Assembly 49 to 14 on August 26, 2026, cleared the Senate in a 36-to-0 concurrence vote the following day, and received gubernatorial approval on September 27.
The legislation amends Section 1798.105 of the CCPA to fix a statutory loophole. Previously, consumers held the right to delete personal information collected directly from them, leaving data acquired through third-party brokers, list vendors, and profile enrichment tools outside the scope of a standard deletion request. SB 923 expands the text to cover personal details gathered "from or about the consumer," regardless of source.
To comply with deletion requests for third-party data, companies must maintain a minimal suppression list to ensure deleted records are not re-ingested during future database synchronizations or vendor refreshes. Statutory exemptions for fraud prevention, legal compliance, and research remain intact.
"Now the right to delete will finally do what people expect it to do: deletion, no matter how the business got that information in the first place," said CalPrivacy Executive Director Tom Kemp.
SB 923 also amends Section 1798.130. Businesses operating exclusively online with direct consumer relationships—which were previously permitted to accept privacy requests solely via an email address—must provide both an email contact and an online intake mechanism, such as a web portal or dedicated form, beginning in 2027.
On the same day SB 923 was signed, Governor Newsom vetoed Assembly Bill 1542, which sought to prohibit the sale or sharing of sensitive personal information. The veto leaves existing provisions that permit consumers to limit the use of sensitive data unchanged.
Sources
Written by
The Company Wire
Inside the companies building what’s next. Reporting on startups, technology, funding and the people shaping them.
