California Expands Consumer Data Deletion Rights in 2027

California is expanding consumer data deletion rights from 1 January 2027. The change extends the right to request deletion to personal information obtained from third parties. It also requires online-only businesses with a direct relationship to consumers to offer an online method for submitting privacy requests. Businesses should review their data deletion processes before the new rules take effect.

What changed?

California’s Expanding Privacy Rights Act, SB 923, was signed by Governor Gavin Newsom on 27 September 2026. The California Privacy Protection Agency (CalPrivacy) announced the change and confirmed its effective date.

Under the existing framework described by CalPrivacy, businesses were not required to delete personal information obtained from a third party when responding to a consumer’s deletion request. This left information acquired from external sources outside the deletion requirement described in the announcement.

The new law expands the deletion right to cover non-exempt personal information regardless of how a business obtained it. It also allows businesses to maintain suppression lists to help prevent deleted information from being acquired again through later third-party data purchases.

A separate change concerns how consumers submit privacy requests. Online-only businesses with a direct relationship to consumers must provide an online submission method. A webform is one example. An email address alone will no longer be sufficient for this requirement.

Before and now

The agency’s announcement describes the intended changes. Businesses should consult the enacted text to confirm the precise scope and applicable exceptions.

Who this affects

The change is relevant to businesses covered by the California Consumer Privacy Act (CCPA). The agency’s announcement does not establish that every business selling products or services to California residents is covered.

Businesses that use information from external sources should review their data practices. This may include companies that purchase customer information, supplement existing customer profiles with third-party data, or combine records from several sources.

The online submission requirement has a more specific scope. It concerns online-only businesses that have a direct relationship with consumers.

Example scenario, not a real client: A software company maintains customer profiles and supplements them with information purchased from a third-party data provider. A customer submits a deletion request. The company should review whether its process can identify the customer’s information from both its direct interactions and the external data source. It should also consider how to prevent deleted information from being reintroduced if it purchases new data later.

This example illustrates a practical issue raised by the change. It does not establish that every software company is covered by the CCPA.

When it takes effect

The law takes effect on 1 January 2027.

The California Privacy Protection Agency confirmed this date in its announcement published on 27 September 2026. The agency’s announcement also confirms that the legislation was signed by the Governor.

Businesses should use the time before the effective date to review their existing procedures. The exact changes required will depend on the business’s coverage, the information it holds and the methods it uses to respond to privacy requests.

The official materials reviewed for this article do not establish whether additional implementation guidance will be issued before the effective date.

What a business should do

Businesses should consider the following steps before January 2027.

1. Identify third-party data sources. Review whether customer information comes from data providers or other external sources, as well as directly from customers.
2. Review deletion procedures. Check whether the business can identify relevant personal information across the records it maintains and determine how deletion requests are handled.
3. Assess suppression lists. Consider how the business could prevent deleted information from being reintroduced through future third-party data acquisitions.
4. Check online request channels. Online-only businesses with a direct relationship to consumers should review whether they offer an online submission method for privacy requests.
5. Confirm the applicable requirements. Review the enacted bill text and the relevant CCPA requirements. A lawyer can help assess how the changes apply to a particular business.

These steps are preparation measures. The agency announcement does not specify every technical control or internal procedure a business will need.

Documents that may need updating

The change may require more than a wording update to a privacy policy. Businesses should review their processes as well as the documents that describe them.

These are review suggestions, not a finding that every listed document requires amendment. The agency announcement does not prescribe specific contract amendments or require every business to update all these documents.

Businesses reviewing their privacy notices can explore My Legal Pal’s privacy policy drafting service. For contractual responsibilities involving personal data, see the data processing agreement drafting service.

What is still unclear

The official announcement confirms the principal changes and the effective date. However, several details need confirmation against the enacted legislation.

First, the precise statutory scope of the expanded deletion requirement and the full set of applicable exceptions should be checked against the bill text. CalPrivacy’s earlier announcement identifies examples of existing exceptions, including fraud prevention, peer-reviewed research and compliance with legal obligations. Businesses should not assume that these examples exhaust all available exceptions.

Second, the materials reviewed do not provide a complete definition of an online-only business or explain every condition attached to a direct relationship with consumers.

Third, the announcement does not set out detailed technical requirements for suppression lists. Businesses should confirm the applicable legal conditions before deciding how to implement them.

Finally, the reviewed announcement does not establish whether additional implementation guidance will be published before January 2027.

These points should be checked before a business makes final decisions about its compliance processes.

Frequently asked questions

What is changing under California’s data deletion rights?

From 1 January 2027, the expanded deletion right will cover non-exempt personal information regardless of how a business obtained it. The law also requires online-only businesses with a direct relationship to consumers to offer an online method for submitting privacy requests.

Does the change apply to every business selling to California?

The official announcement does not say that every business selling to California consumers is covered. The change concerns rights under the CCPA. Businesses should check whether they fall within the law’s scope before deciding what changes they need to make.

What should a business do with data purchased from third parties?

Businesses should review whether their deletion processes can identify and handle covered personal information obtained from external sources. They should also consider how to prevent deleted information from being reintroduced through later acquisitions. The applicable exceptions and detailed requirements should be confirmed against the enacted legislation.

Will an email address still be enough for privacy requests?

For online-only businesses with a direct relationship to consumers, an email address alone will not satisfy the new online submission requirement. CalPrivacy identifies a webform as one possible method. The precise application of this requirement should be checked against the enacted legislation.

Does every business need to rewrite its privacy policy?

The official announcement does not require every business to rewrite its privacy policy. Businesses should review whether their current privacy notices accurately describe their deletion processes and request methods. Any changes should reflect the requirements that actually apply to the business.

Businesses preparing for the January 2027 effective date can review their privacy notices and data-handling processes with My Legal Pal. Book a consultation to discuss the requirements relevant to your business.

Last reviewed: 23 October 2026
Written by Prakhar Rai, lawyer