California Just Expanded Your Deletion Obligations — Here's the New Scope
California Governor Gavin Newsom signed SB 923 in late September 2026, and it changes something fundamental about how a deletion request under California's privacy law actually has to be fulfilled.
What Changed
Previously, when a California consumer requested deletion of their personal information, the obligation generally covered data your business had collected directly from them. SB 923 expands this: businesses must now delete all personal information held about a consumer upon request, not only the data collected directly from that consumer. This closes a real gap that let data obtained through other means, third-party sources, inference, enrichment, sit outside the deletion requirement.
Why This Distinction Actually Matters
A business that only ever deleted what a customer directly typed into a form, while retaining data purchased, inferred, or appended from other sources about that same person, was previously on defensible ground. That's no longer the case. A deletion request now has to reach further than it did before.
One Thing That Didn't Change — Worth Knowing Specifically
In the same legislative session, Newsom vetoed a separate, broader bill that would have banned the sale of sensitive personal information outright, citing existing consumer opt-out mechanisms and budget constraints around enforcement. California has not joined Maryland and New Jersey, which have banned sales of all sensitive data outright. This is worth knowing precisely, since it's easy to assume every state is converging toward the same strict standard when California specifically chose not to this time.
What to Actually Check
If your deletion process currently only touches data collected directly from the requesting consumer, it's worth confirming whether any other personal information about that person, purchased, appended, or inferred, exists elsewhere in your systems and needs to be included going forward.
Check Your California Exposure
All information in this article is sourced from California Senate Bill 923 and reporting from Bloomberg Law. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks California as part of its ongoing state-by-state privacy coverage.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's California privacy readiness at getregulens.com
Further Reading
Four States Now Ban Selling Your Customers' Exact Location — Is Yours Next
Virginia, Connecticut, Maryland, and Oregon have each independently banned the sale of precise geolocation data within the same general stretch of time. A pattern like this rarely stays confined to four states for long.
Utah's New Tax Has Nothing to Do With Nexus Thresholds — And That's the Point
As of this month, Utah taxes a specific category of digital content at 2%, tied to age-verification requirements. It's a genuinely different kind of obligation than the nexus thresholds most sellers are used to tracking.