SB 923 is Law: CCPA deletion rights now reach third-party data
Source Entity
Hacker News
California Governor Newsom has signed SB 923, which expands CCPA deletion rights to include third-party data. Businesses must comply with these new requirements by January 1, 2027, including providing accessible request forms.
The Evolution of California Privacy Law: SB 923 Explained
On September 27, 2026, California Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, into law. Sponsored by the California Privacy Protection Agency (CalPrivacy) and authored by Senator Josh Becker (D-Menlo Park), this legislation represents a significant expansion of the California Consumer Privacy Act (CCPA). By passing the Assembly with a 49-14 vote and the Senate with a unanimous 36-0 concurrence, the state has signaled a unified commitment to closing long-standing loopholes in consumer data protection.
Closing the Third-Party Data Gap
For years, the CCPA has allowed consumers to request the deletion of personal information collected directly from them. However, a critical gap existed: businesses could often circumvent these requests regarding data acquired from third parties. SB 923 directly addresses this by explicitly extending deletion rights to include personal information that a business buys, licenses, or appends from external sources. This change ensures that the consumer's 'right to be forgotten' is not limited to the original point of collection, but follows the data trail through the modern data brokerage ecosystem.
Operational Compliance Deadlines
The legislative mandate is clear, with all provisions set to take effect on January 1, 2027. Beyond the expansion of scope, the law introduces specific operational requirements for businesses. Notably, companies that currently rely solely on email addresses for processing privacy requests will be required to implement more robust, accessible forms by the deadline. This shift is designed to standardize the user experience and ensure that consumers have a verifiable, streamlined method to exercise their rights.
Broader Implications for Data Brokers
The passage of SB 923 marks a turning point for the data economy. By forcing companies to account for third-party data, the state is effectively increasing the compliance burden on any business that purchases or appends consumer profiles. Organizations that rely on data enrichment to power their marketing or analytical tools will now need to maintain far more rigorous records of data provenance to ensure they can fulfill deletion requests across their entire data supply chain.
Future Trends in Digital Privacy
This legislation reflects a growing trend of legislative tightening in California, which continues to act as the primary incubator for privacy standards in the United States. As the California Privacy Protection Agency continues to refine enforcement mechanisms, businesses should anticipate that the definition of 'personal information' and the scope of consumer rights will only continue to broaden. The move toward requiring standardized submission forms suggests a future where regulatory bodies prioritize ease of access for the consumer over the operational convenience of the data holder.
Conclusion
SB 923 is a logical evolution of the CCPA, transforming it from a collection-focused regulation into a comprehensive data-lifecycle mandate. As January 1, 2027, approaches, companies must audit their data acquisition practices and update their privacy request infrastructure. Failure to align with these new standards risks not only legal exposure but also a misalignment with the increasingly stringent expectations of California regulators and consumers alike.