California expanded the right to delete today

On September 27, 2026 Governor Newsom signed SB 923 (effective January 1, 2027), expanding California deletion rights by changing the CCPA’s language from personal information a business “collected from” consumers to information “from or about” consumers. That closes a long-standing gap so data acquired from brokers, enrichment vendors, or appended by partners falls within deletion requests. For third-party data, compliance requires retaining only the minimum records necessary to show the request was honored and to prevent the same data from being re-ingested - practically, a suppression list. The bill also amends notice and request rules so online-only businesses can no longer rely on an email address alone; they must provide an online mechanism such as a web form or portal. A companion measure to ban outright sale/share of sensitive data was vetoed, and existing exemptions for fraud prevention, research, and legal obligations remain.

Businesses should inventory where customer records originate (lead lists, CRM enrichments, audience matches), extend deletion workflows to every downstream system and vendor, and implement suppression controls that retain only the identifiers needed to block future imports. Update request intake processes and privacy policies to reflect the broader deletion right and add an online submission channel by January 1. Running a privacy audit now will reveal gaps and give time to remediate before the deadline.