SB 923: CCPA Deletion Rights Expand and Online-Only Businesses Need a Web Request Form in 2027

What changed

SB 923 (Chapter 482, Statutes of 2026) expands the CCPA right to delete to cover personal information a business collected about a consumer, not only information collected from them. A business that operates only online and has a direct relationship with consumers must also offer an online method, such as a web form or portal, for privacy requests. It takes effect January 1, 2027.

Who it applies to

Businesses subject to the California Consumer Privacy Act, especially those that operate exclusively online and have a direct relationship with the consumers whose data they collect.

Key dates

Effective date:

January 1, 2027

New CCPA deletion-scope and online request-submission requirements take effect.

What employers may need to do

• If you operate exclusively online, add a web form or online portal for privacy requests, alongside the required email address, by January 1, 2027.
• Extend deletion procedures to all personal information collected about the consumer, including data obtained from third parties, by January 1, 2027.

Official source

Detected by RegWatch monitoring on September 29, 2026. Always confirm details against the official source above — this page is a summary, not legal advice.

Related updates

• CA LegislatureAB 1331: California Bans Workplace Surveillance in Bathrooms From January 1, 2027
• CA LegislatureAB 1883: Employers Can't Use AI to Read Employees' Emotions or Collect Neural Data From 2027
• CA LegislatureAB 1697: California's Stay-or-Pay Contract Ban Now Starts With Contracts Signed in 2027
• CA LegislatureAB 1803: Harassment Training Must Include Anti-Hate Speech Training From January 1, 2028

More CA Legislature updates · All California employer updates