SB 923 would require businesses to delete personal information collected about a consumer from any source, and would require online-only businesses to offer a web form for privacy requests.
Under the Delete Act, registered data brokers must access CalPrivacy DROP at least every 45 days and process consumer deletion requests beginning August 1, 2026.
California's privacy agency launched its first formal sectoral audit, focusing on whether gig economy platforms honor CCPA access rights for consumers and workers.
The Office of Administrative Law approved the California Privacy Protection Agency's regulations on September 23, 2025. Effective January 1, 2026, they add mandatory risk assessments, annual independent cybersecurity audits for larger data processors, and notice and opt-out rights for automated decision-making, phased in through 2030.
