Privacy Rights Bill authored by Sen. Josh Becker signed by Governor Newsom

Governor Gavin Newsom has signed SB 923, the Expanding Privacy Rights Act, by Senator Josh Becker (D–Menlo Park), which strengthens Californians’ ability to reclaim control over their personal information under the California Consumer Privacy Act (CCPA).

SB 923 expands consumers’ right to delete personal information to include data that businesses obtain from third parties, including data brokers. It passed the Legislature with bipartisan support.

“Californians have a right to have real control over their personal information,” said Senator Becker. “If a business has your data, you should have the right to delete it, regardless of whether you gave it to them directly or they bought it from somewhere else. With the Governor’s signature, we are expanding California’s privacy law and giving people greater control over how their personal information is used.”

“Most Californians assume that when they get a business to delete their data, it is gone,” said Emory Roane, Associate Director of Privacy Rights Clearinghouse. “In reality, the right only reaches what they handed over themselves, not the far larger trove companies assemble by buying information about them. SB 923 matches the right to delete to what people already expect it to mean and brings California in line with the vast majority of states that have already closed this gap.”

Businesses today routinely supplement the information they collect directly from consumers with data purchased from third parties. That can include detailed demographic information, purchasing histories, health information, geolocation, biometric data, and behavioral information used to create consumer profiles for marketing, personalization, targeting, and pricing decisions. It can also be used for scamming and spamming individuals.

With SB 923 now law, a consumer’s right to delete will apply to personal information a business has collected from or about that consumer, regardless of where the business obtained it. It also makes California’s existing privacy rights easier to exercise. Under current law, certain online-only businesses are required to provide only an email address for consumers to submit requests to access, correct, or delete their information. SB 923 requires those businesses to also provide an accessible online method, such as a webform or online portal, for submitting privacy requests.

With the Governor’s signature, the Expanding Privacy Rights Act takes effect on January 1, 2027.

Photo supplied by Magnific