Governor Newsom signed the Expanding Privacy Rights Act (SB 923), sponsored by CalPrivacy. Until now, a deletion request in California did not reach personal information a business had obtained from third parties rather than from the consumer; the new law closes that gap and lets businesses keep a suppression list so deleted records stay deleted. Online-only businesses must also offer an online way to submit privacy requests, such as a webform, not just an email address. The law takes effect on 1 January 2027.
California widens the right to delete to data a business got from third parties
Regulatory updateWhy it matters for your siteA deletion request has to reach every copy of a person’s data, including data bought or enriched from elsewhere, and an online store needs a request form, not just an inbox.
Data rights requestsSource: California Privacy Protection Agency
Each summary is ours, drawn from the public announcement it links to. Allegations are the regulator’s own, and a settlement usually comes without any admission. This page reports what was announced. It is not legal advice, and it says nothing about any site we audit.
Find these problems before anyone else does
The digital compliance problems behind actions like these are the ones we look for. We find them on your site and show you exactly where each one sits.