California expands consumer deletion rights to third-party data

California Governor Gavin Newsom signed SB 923 on September 27, extending consumer deletion requests under the state's privacy law to personal information businesses collect from or about a person, including data obtained from third parties. The changes take effect January 1, 2027. Businesses handling third-party data may retain only the minimum information needed to keep deleted records from returning through later data updates. The law also requires businesses that operate exclusively online and have a direct consumer relationship to offer an online request method alongside email. Existing exemptions for uses such as fraud prevention and legal obligations still apply.