California Legislature passes bill expanding CCPA deletion rights

On August 28, 2026, the California Privacy Protection Agency (CalPrivacy) announced that the California Legislature had approved Senate Bill 923, the Expanding Privacy Rights Act. The bill, authored by Senator Becker and sponsored by CalPrivacy, now goes to the Governor. It is not law yet. Until the Governor signs it and it takes effect, today’s California Consumer Privacy Act (CCPA) deletion rules remain in force.

What would change

Today, the CCPA right to delete generally covers personal information a business collected from the consumer. Many businesses also buy or otherwise receive personal information about consumers from third parties. CalPrivacy says that gap leaves third-party data vulnerable even after a consumer asks for deletion.

SB 923 would amend Civil Code section 1798.105 so consumers can ask a business to delete personal information collected from or about them, covering non-exempt data regardless of source. Existing CCPA exemptions (for example fraud prevention, certain research, and legal obligations) would still apply. If the business obtained the information from someone other than the consumer, the bill would let it keep a record of the deletion request and the minimum data needed to keep that information deleted and unused for other purposes.

The bill would also change how online-only businesses take privacy requests. Businesses that operate exclusively online and have a direct relationship with the consumer currently must provide an email address for requests such as access, deletion, and correction. SB 923 would also require an online method, such as a web form or portal.

CalPrivacy notes the deletion language mirrors approaches already used in Delaware, Indiana, Maryland, and New Jersey. This item is adjacent to earlier Delete Act / DROP coverage on this site: DROP governs data brokers’ platform deletion duties, while SB 923 would change CCPA deletion and request channels for covered businesses more broadly.

What to do now

1. Inventory where personal information about California consumers comes from, including brokers, partners, and enrichment vendors, not only first-party collection.
2. Map how a verified deletion request flows through systems that hold third-party-sourced records, and how you would keep a suppression-style record without reusing that data.
3. If you operate exclusively online with a direct consumer relationship, plan a web form or portal for access, deletion, and correction requests in addition to email.
4. Do not treat SB 923 as effective until it is signed and an effective date is clear. Watch the Governor’s action and CalPrivacy follow-up.
5. Follow CCPA on this site for signature, effective-date, and implementation updates.