SB 923 expands CCPA deletion controls for nonexempt personal information
Oct 11, 2026 edition · GC-2026-0160 · Published 2026-10-11 · Version 3 · Final
SB 923 expands California consumer deletion requests to personal information collected about a consumer from third parties. The September 27 law preserves narrow suppression records and existing exceptions, and requires qualifying exclusively online businesses to offer an online request method as well as email.
What happened
California chaptered SB 923 on September 27 as Chapter 482. Amended Civil Code section 1798.105 extends the deletion right to information collected from or about a consumer, closing the identified gap for third-party information. On a verifiable request, the section addresses deletion from the business's records and notification to service providers, contractors, and parties receiving sold or shared information, subject to its stated limits. For third-party data, a business may retain the deletion record and minimum data needed to keep the information deleted, without using it for another purpose.
Existing retention exceptions remain, including reasonably necessary contractual performance, security and integrity, debugging, specified research, and legal obligations. The amendment also changes request channels for a business operating exclusively online with a direct relationship with the consumer: it must provide email and an online method such as a form or portal. These are changes within the CCPA framework; the act does not itself make every health record subject to deletion or replace the analysis of applicable statutory exemptions. Its suppression permission is purpose-limited rather than a basis to continue general use of deleted third-party information.
Scope and timing
- Authority status
- Final
- Applicability
- Operationally relevant
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Covered health businesses and health-tech vendors need to map CCPA-covered data rather than assume all information is exempt because the business operates in healthcare.
Recommended action
Review third-party data ingestion, deletion propagation, suppression design and online request channels for applicable nonexempt information.
Sources
- California expands privacy protections by strengthening deletion rightsOfficial · California Privacy Protection Agency · 2026-09-27 · Source review 2026-10-04
- SB923 chaptered operative textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-11
- California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →