California enacted SB 923, expanding CCPA deletion to third-party information
SB 923 was signed on September 27, 2026 and takes effect January 1, 2027. For covered businesses, the CCPA deletion right can extend to personal information obtained from or about the consumer, including certain information obtained from third parties. The law also affects the mechanisms online-only covered businesses use for deletion requests.
- Official source
- California Legislative Information ↗
- Jurisdiction
- California
- Publication date
- September 27, 2026
- Legacy Core review
- September 30, 2026 · Christopher Green
- Source checked
- September 30, 2026
- Affected sectors
- Accounting and Tax, Medical and Dental, Legal, Financial Services, Insurance, General Professional Services
- Effective date
- January 1, 2027
Summary
SB 923 was signed on September 27, 2026 and takes effect January 1, 2027. For covered businesses, the CCPA deletion right can extend to personal information obtained from or about the consumer, including certain information obtained from third parties. The law also affects the mechanisms online-only covered businesses use for deletion requests.
Why it matters
This matters for CCPA-covered businesses that use purchased lead data, CRM enrichment, third-party marketing data, demographic enrichment, or other third-party personal information sources. It does not apply to every small business. A Legacy Core credential does not demonstrate compliance with SB 923, and this item is not a credential requirement.
Recommended action
Read the chaptered text. If the CCPA covers your business, ask whether you obtain customer or prospect information from third parties, whether a valid deletion request can be honored across both directly collected and third-party sourced information, and whether deleted information could be reintroduced. Confirm the answer with qualified counsel.