AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
California CCPA Deletion Rights
Coverage from The National Law Review, Wilson Elser, and others
California’s Consumer Privacy Act gives consumers a right to request deletion of covered personal information.
SB 923 extends that right to information collected from or about a consumer, including data obtained from third parties. Covered businesses must pass deletion instructions to service providers, contractors, and certain recipients, subject to exceptions, while online-only businesses with direct consumer relationships must offer both email and an online request method. The rules also address limited retention of suppression information so deleted data is not restored or reused.
If you read one thing
It clearly explains SB 923’s expanded deletion right, downstream duties, and new request channels in one timely overview.
The evidence
It adds the distinct operational safeguard that businesses may retain minimum data to prevent deleted information from returning or being reused.
Deletion rights reach indirectly sourced information
Enacted SB 923 extends CCPA deletion rights to covered personal information collected about consumers from third-party or other indirect sources, subject to existing exceptions. Key requirements take effect January 1, 2027.
Deletion must persist across downstream systems
Businesses must carry deletion requests into relevant service-provider, contractor, and third-party workflows, except where notice is impossible or involves disproportionate effort. Limited request records and minimum data may be retained to keep indirectly sourced information deleted and prevent its reuse.
Online-only businesses must add an online request channel
Covered online-only businesses with a direct consumer relationship must provide an online method, such as a form or portal, in addition to email for privacy requests. This requirement takes effect January 1, 2027.
$15,000 USD
maximum penalty per intentional violation per affected child
“They must provide high-privacy default settings for identified children, limit collection, sale, sharing, and retention of children’s personal information, provide specified transparency and privacy-rights tools, and take reasonable steps to prevent specified harms. The law restricts default profiling and collection, sale, or sharing of a child’s precise geolocation, and prohibits dark patterns that induce children to provide unnecessary personal information or give up privacy protections. The attorney general or public prosecutors may seek penalties of up to $5,000 per negligent violation and $15,000 per intentional violation, per affected child.”
two years
retroactive application period
“Effective January 1, 2027, it applies retroactively for two years, potentially allowing businesses to seek dismissal or withdrawal of pending or recently filed claims within that period, including claims in arbitration.”
July 1, 2028
effective date of SB 354
“Effective July 1, 2028, it governs how insurers, reinsurers, producers, and certain service providers collect, use, share, retain, and delete consumers’ personal information.”
30 days
data-broker deletion-request processing interval
“Data brokers must access the portal and process deletion requests every 30 days, rather than every 45 days.”
$1,500 dollars
maximum fine per violation
“Violations could carry a fine of up to $1,500 per violation, up to one year in county jail, or both. The bill states that it would create no private right of action.”
SB 923 spells out downstream deletion duties and limited retention
New implementation details specify that businesses must direct service providers and contractors to delete covered information and notify certain recipients, except when notice is impossible or disproportionate. Businesses may retain only the minimum information needed to keep deleted data from returning or being reused.
Previously
California's 2026 laws expand CCPA deletion rights to information obtained from third parties and shorten data brokers' processing interval for state opt-out requests. The package also adds requirements concerning children, AI, surveillance, and sector-specific data; several provisions take effect in 2027 or later. Governor Gavin Newsom vetoed a proposal to restrict sales and sharing of sensitive personal information.
The current version adds SB 690, which assigns enforcement of specified pen-register and trap-and-trace claims to the attorney general. It also clarifies that SB 923 requires notifying certain data recipients and sets January 1, 2027, as the start date for key requirements.