California's Right to Delete Will Cover Third-Party Data. What Changes?

What Did SB 923 Change?

SB 923 expands the right to delete by adding two words to the statute. The current statute covers personal information "which the business has collected from the consumer." The amended statute covers personal information "which the business has collected from or about the consumer."

The Legislature found that, under current law, a business can "maintain and use a consumer's personal information if it was collected from a third party," even after the consumer submits a deletion request. California's privacy agency sponsored the bill to close that gap and announced its signing. The table compares the current requirements with the new ones.

Based on SB 923 and Civil Code sections 1798.105 and 1798.130, as of September 2026.

What Counts as Third-Party Data?

Third-party data is personal information that a business obtained from a source other than the consumer. According to the agency, businesses routinely add it to the records they already hold. Common examples include purchased marketing lists, details supplied by a data enrichment vendor, and audience data from advertising partners.

Under current law, a business can leave this data in place after a deletion request. Starting January 1, 2027, it has to be deleted along with the information the consumer provided. Third-party data is often stored apart from the customer account, in a marketing platform or an analytics tool, so the deletion process may need to reach systems it does not reach today.

How Does a Business Keep Deleted Data from Coming Back?

A business that obtains data from third parties usually receives updates on a regular basis, such as a new marketing list each month. A business that deletes a consumer's information today may receive the same information again in the next update. If the business deleted everything it held, it would have no way to recognize that consumer and keep the information out.

SB 923 addresses this by allowing what the agency calls a suppression list. A business may retain "a record of the deletion request and the minimum data necessary" to ensure that the information remains deleted. The law does not explicitly define that minimum data. It is likely to involve a single identifier, such as an email address, that the business can compare against each update it receives.

I recommend keeping a suppression list apart from marketing systems, because the law does not allow the data in it to be used for any other purpose.

What Changes for Online-Only Businesses?

Current law allows a business that operates exclusively online to accept privacy requests through an email address alone. SB 923 requires two methods, which are the email address and "an online method, such as a web form or online portal." The statute lists email separately, so the second method has to be something other than email.

The change brings online-only businesses closer to the rules that apply to every other business. Other businesses already have to offer at least two methods, including a toll-free telephone number, and accept requests through their websites. Starting in 2027, online-only businesses will have to accept requests through their websites as well. The one remaining difference is that they do not need a toll-free telephone number.

A web form that accepts more than one type of request has to treat each type differently. Requests to delete, correct, or access personal information require identity verification, and opt-out requests do not. California's privacy agency fined Honda in part because its form required the same information for every type of request.

What Stays the Same?

The exceptions to the right to delete are unchanged. A business may still retain personal information that it needs to complete a transaction, maintain security, or comply with a legal obligation. A business still has to verify a deletion request, and still has to notify its service providers and contractors to delete the information.

I recommend identifying every source of third-party data before January 1, 2027, and confirming that the deletion process reaches each one. The privacy notice should also be reviewed, because it has to describe the right to delete accurately.