California Expands Privacy Protections by Strengthening Deletion Rights

September 27, 2026

SACRAMENTO, CA — Today, Governor Newsom signed the Expanding Privacy Rights Act (SB 923, Becker), closing a loophole in the California Consumer Privacy Act’s (CCPA) right to delete and making it easier for consumers to exercise their privacy rights. The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency.

Under the CCPA as currently written, a business is not required to delete a consumer’s personal information if that information was obtained from a third party rather than collected from the consumer. Yet businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete. A meaningful share of a consumer’s personal information could be retained by a business and exposed to breach or misuse, even after the consumer has taken the time to submit a deletion request.

“We are grateful to Governor Newsom for signing this crucial bill into law,” said Tom Kemp, CalPrivacy’s Executive Director. “Now the right to delete will finally do what people expect it to do: deletion, no matter how the business got that information in the first place.”

California’s deletion right will now match the stronger standard already enjoyed by consumers in Delaware, Indiana, Maryland, and New Jersey, without creating new burdens on businesses who already delete all non-exempt personal information concerning an individual upon request in those other states. Additionally, the legislation allows businesses to maintain a suppression list so that consumer information remains deleted even as new third-party data is acquired.

The law also makes it easier for consumers to submit privacy requests, like requests for deletion. Online-only businesses must now offer an online submission method, like a webform, rather than solely providing an email address.

“The webform option will make it simpler for consumers to submit privacy requests while also encouraging more Californians to exercise the rights they already have,” said Maureen Mahoney, Deputy Director of Policy & Legislation. “CalPrivacy is laser-focused on making privacy easier for all Californians, and this sponsored legislation is another example of our efforts in this area.”

The law takes effect January 1, 2027.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.