SB 923

California has signed SB 923 into law, extending the CCPA's right to delete personal data so that businesses must also instruct third parties, such as service providers and contractors, to delete shared consumer data. The change aims to close a long-standing gap that allowed consumer deletion requests to stop at the company that received them. Privacy professionals are now assessing how the obligation flows through data-sharing chains.

California has signed SB 923 into law, broadening the right to delete personal data under the CCPA. The move expands consumers' ability to have their information removed by businesses covered by the state's privacy regime. Discussion is focused on what the new obligations will mean for companies handling California residents' data.