On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch.

Reasons Behind the Amendment
Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026).

With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement).

CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available.

What the Statute Now Says

• Broader Deletion Right

Amended Section 1798.105(a) provides:

“A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.”

• Suppression Records for Third-Party Data
  
  For data obtained from other sources, the law gives businesses a defined way to comply:

“A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.”

• Expanded Downstream Obligations

The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records.

• Preserved Exceptions 

Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.”

• New Online Request Requirement

Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice.

What Is Required, From Whom, and When
Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same. 

Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number.

Practical Steps to Take Before January 1, 2027
Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions. 

Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.