SB 923 expands CCPA deletion controls for nonexempt personal information
Oct 4, 2026 edition · GC-2026-0160 · Published 2026-10-04 · Version 2 · Final
SB 923 closes the CCPA deletion gap for personal information obtained from third parties and requires an online request method for qualifying online-only businesses. The final law permits narrowly retained suppression data and keeps existing deletion exceptions and downstream coordination requirements.
What happened
California enacted SB 923 on September 27 to expand the California Consumer Privacy Act right to delete from information collected from a consumer to information collected from or about that consumer. CalPrivacy’s contemporaneous announcement states that the law takes effect January 1, 2027. Amended Civil Code section 1798.105 requires a business responding to a verifiable deletion request to delete covered information from its records, notify service providers and contractors, and notify third parties to which it sold or shared the information, subject to the stated impossibility or disproportionate-effort qualification. A qualifying business operating exclusively online with a direct consumer relationship must offer an online submission method, such as a web form or portal, as well as an email address.
For information obtained from another source, the final text permits retaining the deletion request and the minimum data necessary to ensure the information stays deleted and is not used for another purpose. That provision supports suppression when new third-party data arrives; it is not permission to continue ordinary use of a deleted profile. The statute retains specified exceptions where keeping information is reasonably necessary, including legal obligations, security and integrity, completing a requested transaction, and qualifying research. It also retains service-provider and contractor cooperation duties. The change therefore requires tracing the source and destination of covered information while documenting any applicable retention exception.
Scope and timing
- Authority status
- Final
- Applicability
- Operationally relevant
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Third-party enrichment can repopulate a profile after a deletion request. A healthcare or health-technology business should identify its CCPA-covered information and applicable exemptions before deciding which records must be deleted or retained. Suppression and downstream requests need to work with lawful clinical, security and other retention obligations.
Recommended action
Map covered third-party data ingestion and deletion propagation, and test that suppression prevents deleted information from returning to ordinary use. For each retained category, document the applicable exception and purpose. Review whether an online-only business with a direct consumer relationship needs to add a web form or portal before January 1, 2027.
Sources
- California expands privacy protections by strengthening deletion rightsOfficial · California Privacy Protection Agency · 2026-09-27 · Source review 2026-10-04
- SB923 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →