Law / United States / 
California
SB 923 (2026), CCPA right to delete personal information collected about the consumer, and online request methods
SB 923 (Ch. 482, Stats. 2026), Cal. Civ. Code Sections 1798.105 and 1798.130
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- If you are a business under the California Consumer Privacy Act, honor a verifiable consumer request to delete any personal information about the consumer that you collected from or about the consumer, including information you obtained from a source other than the consumer: delete it from your records, notify your service providers and contractors to delete it, and notify all third parties to whom you sold or shared it to delete it, unless that proves impossible or involves disproportionate effort (Civil Code Section 1798.105(a), (c)(1)).
- Where you obtained a consumer's personal information from a source other than the consumer, keep only a record of the deletion request and the minimum data necessary to ensure the information remains deleted from your records and is not used for any other purpose (Section 1798.105(c)(2)).
- If your business operates exclusively online and has a direct relationship with the consumers from whom it collects personal information, provide an email address and also make an online method, such as a web form or online portal, available for submitting requests for information, deletion or correction (Section 1798.130(a)(1)(A)).
These lines are LexLint's reading of the law's text, as of .
What this law does
SB 923 was chaptered on as Chapter 482 of the Statutes of 2026. It amends Sections 1798.105 and 1798.130 of the Civil Code. It expands the consumer's right under the California Consumer Privacy Act to request deletion from personal information the business collected from the consumer to any personal information the business has collected from or about the consumer.
A business that receives a verifiable consumer request to delete must delete the consumer's personal information from its records, notify its service providers and contractors to delete it, and notify all third parties to whom it sold or shared the information to delete it, unless that proves impossible or involves disproportionate effort.
A business that obtained the personal information from a source other than the consumer is deemed in compliance with a deletion request if it retains a record of the request and the minimum data necessary to keep the information deleted from its records and unused for any other purpose.
A business that operates exclusively online and has a direct relationship with the consumer must provide an email address and also make an online method, such as a web form or online portal, available for submitting requests. The Legislature declared that the act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for SB 923 is .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings or processes biometric data.