California Lawmakers Pass SB 923: CCPA Delete-Right Expansion, Explained

California Lawmakers Pass SB 923: CCPA Delete-Right Expansion, Explained

California's SB 923, which would let consumers demand deletion of personal information a business collected about them from third parties, has passed both the Senate and Assembly. The Senate concurred in Assembly amendments on August 27, 2026, and the bill has not yet reached Governor Newsom's desk.

Information last verified on August 28, 2026, directly against the California Legislature's official bill status, history, and vote records for SB 923.

Status: SB 923 passed the Assembly floor 49-14 on August 26, 2026. The Senate then concurred in the Assembly's amendments on August 27, 2026, recorded on the Senate Floor vote sheet as a 37-0 roll call with 3 members not voting. The bill's own history log shows that same day's action ending with "ordered to engrossing and enrolling." As of August 28, 2026, the Legislature's bill status page does not show SB 923 as enrolled or presented to Governor Newsom. The bill is not yet law.

Jurisdiction: This article covers California state law only, specifically a pending amendment to the California Consumer Privacy Act (Civil Code sections 1798.105 and 1798.130). It does not describe the law of any other state or country.

What Happened

Senator Josh Becker introduced SB 923 on January 28, 2026. The bill, titled "Consumer privacy requests: deletion request records and request submission methods," would amend two sections of the Civil Code that sit inside the California Consumer Privacy Act (CCPA), a law we cover in depth in our guide to California's data privacy laws.

The bill moved through its first committee stops in the Senate in the spring, was placed on the Appropriations suspense file, and then passed the full Senate floor 31-0 on May 27, 2026. It crossed to the Assembly, where it was amended twice (once in June, once in August) before clearing the Assembly Privacy and Consumer Protection Committee and Assembly Appropriations Committee.

The Assembly passed the amended bill on its floor 49-14 on August 26, 2026, and sent it back to the Senate for concurrence in those amendments. On August 27, 2026, the Senate voted to concur. The chamber's own recorded roll call for that vote lists 37 ayes and 0 noes, with 3 senators not voting, though both the Legislature's separate history log and its bill status page narrate that same action in text as a 36-0 vote, an inconsistency between two of the Legislature's own records that we are reporting rather than silently resolving in favor of one page over the other. The history log's next and, as of this writing, final entry for that date reads "ordered to engrossing and enrolling," the internal process that precedes formal enrollment and delivery to the Governor.

What the Law Says Today

The CCPA already gives California consumers a right to delete under Civil Code section 1798.105. As that section reads today, "a consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer." For background on how that right fits into the broader statute, see our explainer on what the CCPA actually requires.

The key word in the current text is "from." A business only has to delete what it collected directly from the consumer, such as information typed into an account signup form or gathered through a loyalty program. If a business instead bought or received data about that same person from a data broker, a marketing partner, or another third party, the current statute does not require deleting it in response to that consumer's request, because the business never collected it "from" the consumer.

Section 1798.105 already lists several exceptions that let a business keep data even for information it did collect directly, including data needed to complete a transaction, meet a legal obligation, or ensure security. Those exceptions are unaffected by SB 923. It is worth noting that the right to delete is a separate right from the CCPA's opt-out rights, which let a consumer stop a future sale or share of their data without erasing what a business already holds. The statute itself was substantially rewritten once before, by the 2020 ballot initiative that created the CPRA, a history explained in our CCPA vs CPRA comparison.

What SB 923 Would Change

SB 923's legislative findings describe the problem directly: the existing right to delete "allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties," and the findings call that a "gap in protection."

To close it, SB 923 would rewrite Civil Code section 1798.105(a) to read that a consumer may request deletion of personal information "which the business has collected from or about the consumer." Adding "or about" removes the requirement that the business collected the data directly from the consumer, reaching information bought or received from data brokers and other third-party sources as well.

The bill pairs that expansion with a narrower compliance option. Under a new subdivision, if a business obtained the personal information about a consumer from a source other than the consumer, the business can satisfy the deletion request by retaining only a record of the deletion request and the minimum data necessary to keep that person's information deleted and unused going forward, rather than having to track down and purge every third-party-sourced record from every system.

SB 923 separately amends Civil Code section 1798.130 to change how businesses take in privacy requests. Current law lets a business that operates exclusively online and has a direct relationship with the consumer satisfy its intake obligation with an email address alone. SB 923 would require that same category of business to also make an online method, such as a web form or an online portal, available for submitting deletion, correction, and information requests.

The bill also states that its provisions are intended to further the purposes of the 2020 California Privacy Rights Act, the ballot measure that created and empowers the California Privacy Protection Agency.

What Happens Next

Passing both houses is not the same as becoming law. Under the bill's own history log, the last recorded step is "ordered to engrossing and enrolling" on August 27, 2026, the internal process in which the final, amendment-incorporated version of the bill is prepared and certified before it is formally presented to the Governor. As of August 28, 2026, the Legislature's bill status page does not show SB 923 as enrolled or as presented to the Governor.

Once a bill is presented, the California Constitution controls how long the Governor has to act. Article IV, section 10 sets different clocks depending on timing. For most bills presented to the Governor, the general rule is a 12-day return window; if the Governor does not sign or veto within that period, the bill becomes law without a signature. But a bill passed by the Legislature before September 1 of the second year of a two-year session, like SB 923, and then held by the Governor on or after September 1, instead falls under a rule that runs through September 30 of that year. Which clock applies to SB 923 depends on the date it is actually presented to the Governor, a date the record does not yet show. We are not predicting whether the Governor will sign, veto, or allow SB 923 to become law without a signature.

If SB 923 is enacted this year, the state constitution's default rule for non-urgency statutes (this bill carries no urgency clause) would put its operative date at January 1, 2027. The event that would turn this into confirmed hard news is one of three things: the Governor's signature, the bill becoming law without a signature after the applicable window closes, or a veto. We will update this article, and its changelog below, when the official record shows any of those.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The gap SB 923 targets is a real one, and it is not hypothetical. Data brokers compile and sell consumer profiles built from public records, purchase histories, app activity, and other sources that never touch the consumer directly. Under the CCPA as written today, a person can ask every company they have ever dealt with to delete their information and still have a broker-assembled profile of them circulating, because none of the businesses holding it collected it "from" that person. Adding "or about" closes that specific gap rather than creating a new right from scratch.

The retention carve-out is the part of the bill worth reading closely. It does not require a business to prove a negative or maintain a live, ever-updated deletion registry forever. It lets a business keep a minimal record of the deletion request, essentially a suppression list, so that the same third-party data does not quietly repopulate the business's systems later. That is a narrower obligation than deleting every trace, and it is the kind of tradeoff that shows up when a consumer-protection bill is written with compliance mechanics in mind rather than a symbolic mandate.

The web-form requirement in Section 3 is smaller in scope but addresses a practical friction point. An email-only intake channel is easy for a business to under-resource or let requests get lost in. A structured web form or portal creates a record and a process on the business side, which can make it easier for the state's privacy regulator to audit compliance. The California Privacy Protection Agency has already shown it will use its enforcement powers against data brokers over CCPA violations, as detailed in our coverage of recent fines against two data brokers, so a clearer intake and retention framework matters for how enforceable this right actually is in practice, not just how it reads on paper.

None of this is enacted yet. The practical effect on any business's compliance obligations depends on the final, signed text and its operative date, neither of which exists as of this writing.

This article is for general informational purposes only and does not constitute legal advice. Laws change, and the status of pending legislation can change quickly. For advice about a specific situation involving personal information or a business's privacy obligations, consult a licensed California attorney.

Related articles

• California Data Privacy Laws: CCPA, CPRA & Consumer Rights
• What Is CCPA?
• CCPA Opt-Out Rights: Do Not Sell or Share
• CCPA vs CPRA
• CalPrivacy Fines Two Data Brokers Under CCPA and Delete Act

---

Last updated: 2026-08-28. This is a developing story; details verified as of 2026-08-28.