SB 923 is Law: CCPA deletion rights now reach third-party data
3 hours ago
- SB 923 expands the California deletion right to cover personal information collected 'from or about' a consumer, including third-party data bought or enriched from vendors.
- Businesses must implement a suppression list to prevent re-import of deleted data from data partners.
- Online-only businesses with only an email address for privacy requests must also offer an online method (e.g., web form or portal) by January 1, 2027.
- The bill fixes a gap in the CCPA that previously allowed companies to ignore deletion requests for data obtained from brokers or enrichment services.
- Website owners should audit data sources, build deletion workflows covering all systems, and update request intake mechanisms to comply.