California Legislature Advances Bill to Strengthen Deletion Rights

August 28, 2026

SACRAMENTO, CA — The California Privacy Protection Agency (CalPrivacy) applauds the California State Legislature for approving the Expanding Privacy Rights Act (SB 923), which will expand the California Consumer Privacy Act’s (CCPA) right to delete to cover all non-exempt personal information collected about them. It will also make it easier for consumers to submit privacy requests. The bill, authored by Senator Becker and sponsored by CalPrivacy, will now go to the Governor for consideration.

As it is currently crafted, the CCPA’s deletion right does not require a business to delete a consumer’s personal information if that information was collected from a third party. Yet businesses regularly supplement their consumer records with data purchased from third parties. The CCPA’s current right to delete leaves this portion of a consumer’s personal information vulnerable to security incidents like data breaches even after a consumer has taken steps to protect the privacy and security of their information by requesting deletion.

“The bill will fix a loophole in the CCPA’s existing right to delete by enabling Californians to ask a business to delete all of the covered personal information collected about them,” said Tom Kemp, CalPrivacy’s Executive Director. “When a consumer asks a business to delete their data, consumers deserve to know that their personal information will be deleted regardless of how the business collected the information.”

This bill will bring the CCPA’s deletion rights in line with those provided in other states. It mirrors language adopted in Delaware, Indiana, Maryland, and New Jersey that requires deletion of all non-exempt personal information concerning an individual. It also explicitly allows businesses to retain a suppression list so that information can stay deleted.

“We thank the Legislature for recognizing that consumers deserve privacy protections that are just as strong as those in other states,” said Maureen Mahoney, Deputy Director of Policy & Legislation.

Businesses already respond to access, correction, and opt-out of sale requests with respect to information collected from third parties. Businesses would still be able to retain personal information pursuant to the existing exemptions in the CCPA, including for fraud prevention, peer-reviewed research purposes, and to comply with legal obligations.

The bill will also make it easier for consumers to exercise their privacy rights. It requires online-only businesses with a direct relationship to the consumer to provide an online method, such as a webform, for consumers to submit privacy requests, such as access, deletion, and correction requests. Currently, these businesses are only required to provide email addresses for consumers to submit these requests. Alternative methods, like webforms, will help streamline the process, making it easier for anyone to submit a request.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.