California's new law forces businesses to delete data they bought about you
California expanded the right to delete today
Governor Newsom signed SB 923 on September 27, 2026, closing a CCPA loophole: deletion requests now cover personal information collected from or about a consumer, regardless of source. Starting January 1, 2027, online-only businesses must also offer an online request method, not just an email. The law requires suppression lists to keep deleted data from reappearing. The same day, the Governor vetoed AB 1542, which would have banned selling sensitive data.
Now the right to delete will finally do what people expect it to do: deletion, no matter how the business got that information in the first place.