AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
California Is Making Deletion Reach Beyond Direct Collection
California’s expanded deletion rights gave yesterday’s privacy reporting its clearest compliance deadline. KTS Law reported that SB 923, signed by Governor Gavin Newsom on September 27, will extend deletion rights to covered personal information obtained from third-party sources from January 1, 2027. The practical question is no longer just whether a business can erase information a consumer supplied, but whether its deletion processes reach information acquired elsewhere.
The other developments require different responses: a federal license-plate surveillance bill remains a proposal, September’s website-tracking rulings leave uneven litigation exposure, and casino reporting documents AI analysis of existing camera footage. These are separate developments—not evidence of a single privacy turning point.
California’s amendment reaches both data handling and request design. According to KTS Law, businesses may retain only the minimum information necessary to prevent deleted data from returning. Online-only businesses with direct consumer relationships must also offer online request submission alongside email. Covered organizations should review third-party data inventories, vendor workflows, suppression records and request interfaces before January. The reporting is a law-firm analysis; detailed scope and exceptions still warrant verification against primary sources.
Sen. Josh Hawley introduced the proposed Stop Flock Abuse Act, moving surveillance scrutiny into a specific federal legislative proposal. AOL reported provisions restricting local-government vehicle-data sharing and sales, requiring deletion within 10 days unless connected to a criminal investigation, prohibiting facial recognition, and requiring search approvals, audit logs, encryption and US-based storage. Recent briefings documented congressional scrutiny and local resistance to Flock. This adds proposed safeguards, but no binding obligations.
A Fisher Phillips roundup of six September website-tracking rulings found four defendant-favorable and two plaintiff-favorable outcomes. Several decisions required more than a failed cookie opt-out, such as sensitive information or actionable interception. In Spears, allegations of real-time tracking after cookie rejection were sufficient for claims to proceed—not a finding of liability. The roundup clarifies legal differences rather than establishing a general retreat from tracking lawsuits.
The Las Vegas Sun reported that Resorts World Las Vegas uses AI to analyze existing camera footage for dealer errors, cheating and player behavior, with deployment concentrated on high-limit tables because of cost. Panelists described potential marketing and responsible-gambling uses, but the reporting does not establish that those uses are deployed. This is operational detail about a particular deployment, not proof of an industry-wide adoption shift.
Key Points
- California’s deletion agenda is becoming more operational. Recent coverage described centralized data-broker deletion workflows; yesterday’s reporting adds a distinct expansion of CCPA deletion rights. Together, they make the handling of acquired—and potentially reacquired—data more consequential, without making the two regimes interchangeable.
- The tracking rulings expose a difference between a defective privacy control and a legally sufficient claim. Dismissals may turn on statutory elements or technical facts; they do not demonstrate that a website actually honors rejection. Legal defensibility and operational compliance need separate checks.
- The casino example shows how surveillance can become more revealing without adding cameras. Analyzing existing footage for player behavior changes what can be inferred from it. Whether those inferences are used beyond security remains an important, unanswered distinction.
Implications
For covered businesses, SB 923 deserves implementation planning now. Deletion workflows need to account for third-party information and the minimum records needed to keep deleted data from returning, rather than treating deletion as a one-time database operation.
Website operators should test what trackers actually do after rejection. The mixed rulings support jurisdiction- and claim-specific legal review, not reliance on a cookie banner or favorable dismissals elsewhere.
Surveillance operators should distinguish current practices from possible future requirements. The Hawley proposal identifies concrete retention and access controls to monitor; the casino reporting raises questions about secondary uses of behavioral analysis, but does not establish new legal duties.
Watchpoints
Watch
SB 923’s primary text and implementation guidance, especially the scope of third-party deletion and permissible suppression records.
Watch
The Stop Flock Abuse Act’s text, sponsorship and legislative progress—whether the reported safeguards advance beyond introduction.
Watch
The pending California appeal on applying the pen-register statute to websites, and subsequent rulings on tracking after cookie rejection.
Watch
Casino disclosures explaining behavioral analytics, secondary uses, retention and access, alongside independently tested accuracy rather than vendor estimates.
Fallout
The immediate compliance priority is California’s enacted amendment. Surveillance legislation, tracking litigation and AI monitoring matter too, but their legal status and operational consequences differ.
California Deletion Rights
Deletion coverage is expanding to information acquired from third-party sources.
Fresh developments
KTS Law detailed SB 923, signed September 27 and effective January 1, 2027, including expanded deletion rights, minimum-necessary retention and an additional online request method for qualifying online-only businesses.
Why we noticed
This is an enacted change with a preparation deadline. It makes data provenance, vendor coordination and prevention of reintroduction practical compliance concerns.
Watch for:
- Primary-source clarification of coverage and exceptions.
- Guidance on deletion workflows and suppression records.
License-Plate Surveillance Safeguards
Accountability pressure is moving from oversight and local opposition into proposed federal controls.
Fresh developments
AOL reported Hawley’s proposed Stop Flock Abuse Act, including limits on sharing and retention, search approvals and audit logs, and security requirements.
Why we noticed
The proposal gives previously discussed safeguards a legislative form. Its introduction does not change current obligations or establish its prospects for passage.
Watch for:
- Bill text, additional sponsors and legislative movement.
- Changes to the proposed retention, sharing and search restrictions.
Website Tracking After Rejection
Tracking litigation remains sensitive to statutory theory, jurisdiction and technical behavior.
Fresh developments
Fisher Phillips reviewed six rulings across September, with mixed outcomes and some courts requiring additional elements beyond a failed opt-out.
Why we noticed
The decisions narrow some claims without eliminating exposure. Actual tracking behavior remains more informative for compliance than the mere presence of a consent interface.
Watch for:
- The pending California pen-register appeal.
- How later decisions distinguish real-time interception and the information collected.
AI Analysis of Casino Surveillance
Existing surveillance footage is being used to analyze behavior as well as security incidents.
Fresh developments
The Las Vegas Sun described Resorts World Las Vegas’s AI camera analysis and panel discussion of possible marketing and responsible-gambling applications.
Why we noticed
The privacy significance lies in what existing footage can reveal and how those insights might be reused. Retention, sharing and deployment of secondary uses remain unestablished.
Watch for:
- Disclosures distinguishing security analysis from customer profiling.
- Retention practices and independent performance testing.
Final Thought
The useful distinction is between pressure and obligation. California has supplied a deadline; the surveillance bill supplies proposed controls; the tracking cases supply contested legal boundaries. Treating them as equivalent would obscure where action is already required.