California has amended the California Consumer Privacy Act (CCPA) to expand the right to delete, closing a gap in protection for consumers. On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923, which takes effect on January 1, 2027.
The new law amends two provisions of the CCPA: the right to delete (Civil Code § 1798.105) and the methods for submitting consumer requests (Civil Code § 1798.130). This change allows consumers to request deletion of personal information that a business collected from third parties, not just from the consumer directly.
Expanding Deletion Rights
Under the prior CCPA text, consumers could only request deletion of information a business collected “from the consumer.” The California Legislature found that this created a gap in protection, as businesses often enrich their records with third-party data. The new law requires businesses to honor deletion requests for personal information collected from any source.
CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” The amended law aims to align California’s deletion rights with those in other states, such as Delaware, Indiana, Maryland, and New Jersey.
Read Also: FTC seeks to curb scam ads through new rule
The amended Section 1798.105(a) provides that “a consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” For data obtained from other sources, businesses must retain a record of the deletion request and the minimum data necessary to ensure the consumer’s personal information remains deleted.
Implementation and Compliance
Online-only businesses with a direct relationship with consumers must offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with a brick-and-mortar presence must continue to offer at least two methods for consumer requests, including a toll-free telephone number.
Businesses will need to comply with the new requirements, which include mapping where personal information sourced from third parties resides in their systems, extending deletion workflows to those systems, and building or checking their suppression records workflow.
