California Lawmakers Pass SB 923: CCPA Delete-Right Expansion, Explained

California Lawmakers Pass SB 923: CCPA Delete-Right Expansion, Explained

California's SB 923, which would let consumers demand deletion of personal information a business collected about them from third parties, has passed both the Senate and Assembly and reached Governor Newsom's desk. The Legislature enrolled the bill and presented it to the Governor on September 2, 2026, which starts the constitutional clock for him to sign or veto it.

Information last verified on September 3, 2026, directly against the California Legislature's official bill status, history, and vote records for SB 923.

Status: Awaiting the Governor's action. SB 923 passed the Assembly floor 49-14 on August 26, 2026, and the Senate concurred in the Assembly's amendments on August 27, 2026, recorded on the Senate Floor vote sheet as a 37-0 roll call with 3 members not voting. The bill's history log then records, on September 2, 2026: "Enrolled and presented to the Governor at 3 p.m." As of September 3, 2026 the log shows no entry approving, vetoing or chaptering the bill. SB 923 is not law.

Jurisdiction: This article covers California state law only, specifically a pending amendment to the California Consumer Privacy Act (Civil Code sections 1798.105 and 1798.130). It does not describe the law of any other state or country.

What Happened

Senator Josh Becker introduced SB 923 on January 28, 2026. The bill, titled "Consumer privacy requests: deletion request records and request submission methods," would amend two sections of the Civil Code that sit inside the California Consumer Privacy Act (CCPA), a law we cover in depth in our guide to California's data privacy laws.

The bill moved through its first committee stops in the Senate in the spring, was placed on the Appropriations suspense file, and then passed the full Senate floor 31-0 on May 27, 2026. It crossed to the Assembly, where it was amended twice (once in June, once in August) before clearing the Assembly Privacy and Consumer Protection Committee and Assembly Appropriations Committee.

The Assembly passed the amended bill on its floor 49-14 on August 26, 2026, and sent it back to the Senate for concurrence in those amendments. On August 27, 2026, the Senate voted to concur. The chamber's own recorded roll call for that vote lists 37 ayes and 0 noes, with 3 senators not voting, though both the Legislature's separate history log and its bill status page narrate that same action in text as a 36-0 vote, an inconsistency between two of the Legislature's own records that we are reporting rather than silently resolving in favor of one page over the other. The history log's next and, as of this writing, final entry for that date reads "ordered to engrossing and enrolling," the internal process that precedes formal enrollment and delivery to the Governor.

What the Law Says Today

The CCPA already gives California consumers a right to delete under Civil Code section 1798.105. As that section reads today, "a consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer." For background on how that right fits into the broader statute, see our explainer on what the CCPA actually requires.

The key word in the current text is "from." A business only has to delete what it collected directly from the consumer, such as information typed into an account signup form or gathered through a loyalty program. If a business instead bought or received data about that same person from a data broker, a marketing partner, or another third party, the current statute does not require deleting it in response to that consumer's request, because the business never collected it "from" the consumer.

Section 1798.105 already lists several exceptions that let a business keep data even for information it did collect directly, including data needed to complete a transaction, meet a legal obligation, or ensure security. Those exceptions are unaffected by SB 923. It is worth noting that the right to delete is a separate right from the CCPA's opt-out rights, which let a consumer stop a future sale or share of their data without erasing what a business already holds. The statute itself was substantially rewritten once before, by the 2020 ballot initiative that created the CPRA, a history explained in our CCPA vs CPRA comparison.

What SB 923 Would Change

SB 923's legislative findings describe the problem directly: the existing right to delete "allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties," and the findings call that a "gap in protection."

To close it, SB 923 would rewrite Civil Code section 1798.105(a) to read that a consumer may request deletion of personal information "which the business has collected from or about the consumer." Adding "or about" removes the requirement that the business collected the data directly from the consumer, reaching information bought or received from data brokers and other third-party sources as well.

The bill pairs that expansion with a narrower compliance option. Under a new subdivision, if a business obtained the personal information about a consumer from a source other than the consumer, the business can satisfy the deletion request by retaining only a record of the deletion request and the minimum data necessary to keep that person's information deleted and unused going forward, rather than having to track down and purge every third-party-sourced record from every system.

SB 923 separately amends Civil Code section 1798.130 to change how businesses take in privacy requests. Current law lets a business that operates exclusively online and has a direct relationship with the consumer satisfy its intake obligation with an email address alone. SB 923 would require that same category of business to also make an online method, such as a web form or an online portal, available for submitting deletion, correction, and information requests.

The bill also states that its provisions are intended to further the purposes of the 2020 California Privacy Rights Act, the ballot measure that created and empowers the California Privacy Protection Agency.

What Happens Next

Passing both houses is not the same as becoming law. After the Senate concurred on August 27, 2026, the bill went to engrossing and enrolling, the internal process in which the final, amendment-incorporated version is prepared and certified. That step is now complete: the history log records that SB 923 was "Enrolled and presented to the Governor at 3 p.m." on September 2, 2026. The decision now sits with the Governor.

Once a bill is presented, the California Constitution controls how long the Governor has to act, and article IV, section 10 sets different clocks depending on timing. For most bills the general rule in section 10(b)(3) is a 12-day return window, after which an unreturned bill becomes a statute. That is not the clock here. Section 10(b)(2) governs a bill passed by the Legislature before September 1 of the second calendar year of the biennium and in the Governor's possession on or after September 1: such a bill becomes a statute if it is not returned by September 30 of that year. SB 923 fits that description, because the Legislature passed it on August 27 and the Governor received it on September 2. The operative date is therefore September 30, 2026. We are not predicting whether the Governor will sign, veto, or allow SB 923 to become law without a signature.

If SB 923 is enacted this year, the state constitution's default rule for non-urgency statutes (this bill carries no urgency clause) would put its operative date at January 1, 2027. The event that would turn this into confirmed hard news is one of three things: the Governor's signature, the bill becoming law without a signature after the applicable window closes, or a veto. We will update this article, and its changelog below, when the official record shows any of those.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The gap SB 923 targets is a real one, and it is not hypothetical. Data brokers compile and sell consumer profiles built from public records, purchase histories, app activity, and other sources that never touch the consumer directly. Under the CCPA as written today, a person can ask every company they have ever dealt with to delete their information and still have a broker-assembled profile of them circulating, because none of the businesses holding it collected it "from" that person. Adding "or about" closes that specific gap rather than creating a new right from scratch.

The retention carve-out is the part of the bill worth reading closely. It does not require a business to prove a negative or maintain a live, ever-updated deletion registry forever. It lets a business keep a minimal record of the deletion request, essentially a suppression list, so that the same third-party data does not quietly repopulate the business's systems later. That is a narrower obligation than deleting every trace, and it is the kind of tradeoff that shows up when a consumer-protection bill is written with compliance mechanics in mind rather than a symbolic mandate.

The web-form requirement in Section 3 is smaller in scope but addresses a practical friction point. An email-only intake channel is easy for a business to under-resource or let requests get lost in. A structured web form or portal creates a record and a process on the business side, which can make it easier for the state's privacy regulator to audit compliance. The California Privacy Protection Agency has already shown it will use its enforcement powers against data brokers over CCPA violations, as detailed in our coverage of recent fines against two data brokers, so a clearer intake and retention framework matters for how enforceable this right actually is in practice, not just how it reads on paper.

None of this is enacted yet. The practical effect on any business's compliance obligations depends on the final, signed text and its operative date, neither of which exists as of this writing.

This article is for general informational purposes only and does not constitute legal advice. Laws change, and the status of pending legislation can change quickly. For advice about a specific situation involving personal information or a business's privacy obligations, consult a licensed California attorney.

Related articles

• California Data Privacy Laws: CCPA, CPRA & Consumer Rights
• What Is CCPA?
• CCPA Opt-Out Rights: Do Not Sell or Share
• CCPA vs CPRA
• CalPrivacy Fines Two Data Brokers Under CCPA and Delete Act

---

Last updated: 2026-09-03. This is a developing story; details verified as of 2026-09-03.