By Compliance Week Staff
In a landmark shift for digital privacy, California is once again setting the pace for the United States’ regulatory landscape. Governor Gavin Newsom signed SB 923 into law this past Sunday, marking a significant expansion of the California Consumer Privacy Act (CCPA). Under the new statute, businesses will soon be legally obligated to honor requests from California residents to delete personal data, regardless of whether the business was the original entity that collected the information.
This legislative development, which takes effect on January 1, 2027, addresses a long-standing "blind spot" in data privacy: the ecosystem of data brokers, aggregators, and secondary purchasers who traffic in personal information often without the consumer’s direct knowledge or consent. By closing this loop, California is forcing a radical reassessment of how data flows through the digital economy.
The Core Mandate: Understanding SB 923
At its heart, SB 923 is designed to empower the consumer in an era where data is the primary currency of the internet. Previously, a consumer’s right to request the deletion of their data was often hampered by the complex web of third-party sharing. If a consumer requested deletion from Company A, but Company A had already sold or shared that data with Company B, the consumer often found it impossible to force Company B to purge that information.
SB 923 effectively pierces this corporate veil. Once the law takes effect, businesses that receive a deletion request must not only purge their own records but must also ensure that the request propagates downstream. The burden of compliance shifts from the consumer—who previously had to track down every entity holding their data—to the businesses, which must now maintain better governance over their data sharing agreements and downstream partners.
Chronology: The Road to Expanded Privacy Rights
The evolution of California’s privacy regime has been a multi-year effort to modernize legal protections for the digital age.
- 2018: The Birth of CCPA. California passed the original California Consumer Privacy Act, giving residents the right to know what data was collected, the right to opt-out of the sale of data, and the right to request deletion of data held by the collector.
- 2020: The CPRA Amendment. The California Privacy Rights Act (CPRA) expanded these rights, establishing the California Privacy Protection Agency (CPPA) as the nation’s first dedicated privacy regulator.
- 2025–2026: The Legislative Push for SB 923. Recognizing that the "deletion" requirement was insufficient in a fragmented data market, lawmakers introduced SB 923 to address the limitations of the existing framework.
- September 2026: Gubernatorial Approval. Governor Newsom signs SB 923 into law, setting the implementation clock for January 2027.
- January 1, 2027: Effective Date. Compliance becomes mandatory, and enforcement actions by the CPPA may commence thereafter.
Supporting Data: The Scope of the Digital Data Brokerage Industry
The necessity for SB 923 is underscored by the sheer scale of the data brokerage industry. According to industry analysis, the average American consumer’s digital profile is sold or shared dozens of times per month.
Recent studies indicate that the "shadow" data market—entities that collect data without a direct relationship with the user—accounts for billions of dollars in annual revenue. Because these entities often operate without the consumer’s direct awareness, they have historically been the most difficult to police.
Data from the California Privacy Protection Agency (CPPA) suggests that since the inception of the CCPA, "Right to Delete" requests have been among the most common consumer actions. However, the efficacy of these requests has been hampered by technical and legal hurdles when data is transferred between multiple controllers. SB 923 is projected to reduce the "data footprint" of the average Californian by an estimated 40% over the first two years of implementation, as companies are forced to prune inactive or unnecessary datasets to mitigate their compliance liability.
Official Responses and Stakeholder Perspectives
The passage of SB 923 has elicited a wide range of responses from privacy advocates, corporate counsel, and industry lobbyists.
The Regulator’s View
The California Privacy Protection Agency (CPPA) has positioned this bill as a necessary correction to the marketplace. "Privacy rights are hollow if they stop at the doorstep of the first company a consumer interacts with," noted a spokesperson for the CPPA. "Data is fluid; the law must be equally fluid to protect the fundamental rights of Californians."
The Industry Perspective
Business advocacy groups, including several chambers of commerce, have expressed concern regarding the technical feasibility of the new mandate. "Tracing data downstream is an enormous logistical challenge," says an industry analyst specializing in data compliance. "Many companies do not have the technological infrastructure to verify that a third party has actually deleted data. This will require a complete overhaul of vendor management and data processing agreements."
Privacy Advocates
Consumer rights groups have lauded the law as a "victory for transparency." By forcing companies to take responsibility for the entire lifecycle of the data they handle, proponents argue that California is creating a "chain of custody" for digital information that will make the entire internet safer and less prone to mass-data breaches.
Implications for Compliance and Governance
For organizations operating in California—or serving California residents—the next 15 months will be a period of intensive preparation. The implications of SB 923 are multifaceted and require a coordinated approach across legal, IT, and marketing departments.
1. Data Mapping and Inventory
The most immediate task for businesses is to conduct a comprehensive data audit. Companies must know exactly where their data flows. If a firm sells data to a third party, it now needs a mechanism to communicate deletion requests to that party and, ideally, a way to confirm that the deletion has occurred.
2. Updating Vendor Contracts
Standard data processing agreements (DPAs) will need to be rewritten. Contracts must now include explicit clauses that mandate third-party deletion upon receipt of a forwarded consumer request. Without these contractual teeth, businesses may find themselves legally liable for the failures of their partners.
3. Technical Infrastructure
Manual processing of deletion requests will no longer suffice. Organizations will need to invest in automated data-governance platforms that can tag data by origin and destination, allowing for "cascading deletions" that trigger across a network of vendors simultaneously.
4. The "Liability Gap"
A significant concern for general counsel is the potential for liability. If a company requests that a third party delete data and that third party fails to do so, is the original collector liable? The text of SB 923 implies a duty of care. Companies will need to perform rigorous due diligence on their vendors, effectively treating them as extensions of their own internal compliance infrastructure.
The Road Ahead: A New Standard for the Nation
While SB 923 is a California law, it is widely expected to exert influence far beyond the state’s borders. Historically, California’s privacy standards have functioned as a de facto national benchmark. As companies look to streamline their operations, many will likely adopt the California standard globally to avoid the cost of managing a fragmented compliance map.
The enactment of this law marks the end of the "siloed" era of data privacy. As the digital economy becomes increasingly interconnected, the legal requirement to treat data as a temporary, revocable asset—rather than a permanent commodity—will force businesses to innovate.
For the consumer, the promise of 2027 is a internet where personal data is not an indelible mark, but a manageable entity. For the business community, it is a new era of accountability, where the value of data is finally weighed against the operational cost of its lifecycle management.
As January 2027 approaches, the message from Sacramento is clear: the right to be forgotten is no longer a suggestion—it is a requirement that follows the data wherever it travels. Companies that fail to adapt their infrastructure to this reality risk not only significant regulatory fines but also the loss of consumer trust in an increasingly privacy-conscious marketplace.
Adrianne Appel covers regulatory news, policy, and trends for Compliance Week. She previously reported on policy developments for Bloomberg Law and Bloomberg Government.
