{"slug": "californias-sb-923-expands-ccpa-deletion-by-2027-2026", "title": "California’s SB 923 Expands CCPA Deletion by 2027 [2026]", "summary": "California Governor Gavin Newsom signed SB 923 on September 27, 2026, expanding the CCPA right to delete to cover personal information held \"from or about\" a consumer regardless of source, effective January 1, 2027, with 77 days remaining before the bulk of the changes take effect. Newsom vetoed AB 1542 the same day, keeping California's opt-out model for sensitive personal information intact, and signed AB 1883 three days later barring employers from using AI tools that infer an employee's emotional state. SB 923, sponsored by the California Privacy Protection Agency, also requires online-only businesses with direct consumer relationships to offer a web form or portal for privacy requests, ending email-only compliance.", "body_md": "California’s privacy regulator just rewrote the rules for every business that touches a Californian’s personal data, and the clock is already running. On September 27, 2026, Governor Gavin Newsom signed **SB 923**, the Expanding Privacy Rights Act, broadening the CCPA’s right-to-delete provision to cover data “from or about” a consumer, no matter where it originated. Three days later he signed **AB 1883**, barring employers from using AI tools that infer an employee’s emotional state. With 77 days left before the bulk of these changes take effect on January 1, 2027, compliance teams at thousands of companies are scrambling to figure out what actually changed and what didn’t.\n\n## What SB 923 Actually Changes for CCPA Deletion Rights\n\nUntil now, a consumer’s right to delete under the California Consumer Privacy Act applied mainly to information a business collected directly from that consumer. That left a gap: data purchased from brokers, scraped from public records, or inferred from third-party sources could sit outside the reach of a deletion request. SB 923 closes that gap. Starting January 1, 2027, the deletion right extends to personal information a business holds “from or about” a consumer, regardless of source, according to the bill text covered in [ControlCase’s breakdown of the 2026 CCPA changes](https://www.controlcase.com/california-2026-privacy-bills-ccpa/).\n\nThe bill was sponsored by the California Privacy Protection Agency, the state body also known as CalPrivacy, which has pushed for broader deletion coverage since CCPA enforcement began. Businesses are allowed to keep a suppression list, a record of deleted identities, so that previously erased information doesn’t quietly reappear when a data broker sells the same record again. The law also adds a new operational requirement: any business that operates exclusively online and maintains a direct relationship with consumers must offer a web form or portal for privacy requests. An email inbox alone will no longer satisfy CCPA compliance once the rule kicks in.\n\nFor compliance teams, the practical headache is data lineage. A deletion workflow built around first-party databases will miss information sitting in marketing platforms, analytics tools, and data-enrichment systems fed by third-party sources. Existing CCPA obligations to notify service providers, contractors, and downstream third parties about deletion requests still apply, so the record-keeping burden grows alongside the scope of what must be deleted.\n\n## AB 1542’s Veto Keeps California’s Opt-Out Model Intact\n\nNot every privacy bill made it through. AB 1542 would have barred businesses from selling or sharing a consumer’s sensitive personal information outright, replacing today’s opt-out model with a flat prohibition. Newsom vetoed it the same day he signed SB 923, September 27, 2026. California’s existing structure survives: consumers can opt out of the sale or sharing of personal information generally, and where the statutory right applies, they can separately limit the use and disclosure of sensitive categories such as health data, precise geolocation, or immigration status.\n\nThat veto matters for ad tech and data-broker businesses that rely on selling sensitive segments. Had AB 1542 become law, entire monetization models built on health, financial, or biometric inference would have needed a rebuild. Instead, the obligation that survives is the existing privacy risk assessment requirement, which is triggered whenever a business processes sensitive personal information, subject to a narrow carve-out for certain employee and contractor data.\n\n## Five More Privacy Bills Signed in the Same September Window\n\nSB 923 and the AB 1542 veto got the headlines, but California’s legislature moved on several other fronts in the same signing window. AB 2561, signed September 27, 2026, prohibits operating systems and apps from silently reversing a privacy setting a user deliberately configured, closing a loophole where software updates could quietly re-enable tracking.\n\nAB 883 amends the state’s Delete Act, cutting the window data brokers have to process deletion requests through California’s Delete Request and Opt-out Platform (DROP) from 45 days to 30. The shorter cycle takes effect January 1, 2027, while a separate provision requiring brokers to tell elected officials and judges how to use DROP becomes operative July 1, 2027. SB 690, signed September 30, 2026 and effective January 1, 2027, strips the private right of action for certain pen-register and trap-and-trace claims tied to website and app tracking under the California Invasion of Privacy Act, leaving enforcement of those specific claims to the Attorney General. Wiretapping and eavesdropping claims under the same statute remain open to private suits.\n\nA sixth measure, AB 566, the California Opt Me Out Act, requires any business that develops or maintains a browser to build in a consumer-configurable opt-out preference signal, similar in spirit to Global Privacy Control. That requirement also lands on January 1, 2027, meaning browser vendors and the sites that process their signals both need updated handling logic before the new year.\n\n## California’s September 2026 Privacy and AI Law Signing Wave\n\n| Bill | Status / Signed | Effective Date | What It Does | \n|---|---|---|---|\n| SB 923 | Signed Sept. 27, 2026 | Jan. 1, 2027 | Expands CCPA deletion right to data from any source, not just the consumer directly | \n| AB 1542 | Vetoed Sept. 27, 2026 | N/A | Would have banned selling/sharing sensitive personal information outright | \n| AB 2561 | Signed Sept. 27, 2026 | Jan. 1, 2027 | Bars apps/OS from silently undoing a user’s privacy setting | \n| AB 883 | Signed Sept. 27, 2026 | Jan. 1, 2027 (July 1, 2027 for officials/judges) | Shortens data-broker DROP deletion cycle from 45 to 30 days | \n| SB 690 | Signed Sept. 30, 2026 | Jan. 1, 2027 | Removes private right of action for CIPA pen-register/trap-and-trace claims | \n| AB 1883 | Signed Sept. 30, 2026 | Upon signing | Bars AI tools that infer employee emotional state or collect neural data | \n| SB 947 (“No Robo Bosses Act”) | Signed Sept. 30, 2026 | July 1, 2027 | Bars solely-automated discipline or termination decisions without human review | \n| AB 1331 | Signed Sept. 30, 2026 | Upon signing | Bars workplace surveillance inside bathrooms | \n| AB 566 (“Opt Me Out Act”) | Signed 2025 | Jan. 1, 2027 | Requires browsers to ship a built-in opt-out preference signal | \n\n## AB 1883 and the New Limits on AI Workplace Surveillance\n\nThe privacy story isn’t only about CCPA deletion rights. AB 1883, signed September 30, 2026, bars employers from deploying AI-powered workplace surveillance tools that recognize or infer an employee’s emotional state, and it restricts the collection of neural data outright, carving out exceptions tied to safety and specific defense-related uses. The law responds to a wave of “sentiment scoring” features baked into call-center analytics platforms, productivity-monitoring software, and camera-based attention tracking that became common in corporate environments over the past two years.\n\nFor HR and IT teams, the practical move is auditing every vendor contract that touches employee monitoring, call analytics, or camera-based behavior tracking, and asking a blunt question: does any feature score sentiment, engagement, or emotional state? If the answer is yes, that feature needs to come offline inside California or be rebuilt to strip the emotional-inference layer. AB 1331, signed the same day, closes a narrower gap by barring workplace surveillance equipment inside bathrooms outright, regardless of AI involvement.\n\n## No Robo Bosses: SB 947 Curbs Automated Firing Decisions\n\nPerhaps the most consequential of the AI-adjacent bills is SB 947, nicknamed the “No Robo Bosses Act.” Effective July 1, 2027, it prohibits California employers from relying solely on an automated decision system to discipline or terminate a worker. Human corroboration becomes mandatory, and employees must receive post-use notice when an automated system played a role in the outcome.\n\nThat nine-month runway, longer than the January 1 deadline most of the other bills share, gives employers extra time to build the documented human-review step the law requires. But it also means HR software vendors selling automated performance-management and termination-recommendation tools now have a hard compliance deadline baked into their product roadmaps, not just a policy suggestion.\n\n## Why January 1, 2027 Is the Date Every Compliance Team Is Watching\n\nStrip away the individual bill numbers and a single date dominates California’s 2026 privacy calendar: January 1, 2027. That’s when SB 923’s expanded deletion right kicks in, when AB 566’s browser opt-out signal becomes mandatory, when automated decision-making technology (ADMT) rules requiring pre-use notices and opt-out rights take effect, and when the first CCPA cybersecurity audit period opens for businesses that cleared $100 million in annual gross revenue during 2026. Audit reports and certifications for that first group are due April 1, 2028.\n\n| Requirement | Deadline | Who It Applies To | Key Detail | \n|---|---|---|---|\n| SB 923 deletion right | Jan. 1, 2027 | All CCPA-covered businesses | Covers data from any source, not just direct collection | \n| AB 566 browser opt-out signal | Jan. 1, 2027 | Browser developers/maintainers | Must ship a built-in, consumer-configurable signal | \n| ADMT pre-use notice & opt-out | Jan. 1, 2027 | Businesses using automated decisions on consumers | Covers lending, housing, employment, healthcare decisions | \n| First cybersecurity audit cycle | Jan. 1, 2027 – Jan. 1, 2028 | Businesses with >$100M 2026 revenue meeting audit criteria | Report and certification due April 1, 2028 | \n| AB 883 DROP deletion cycle | Jan. 1, 2027 | Registered data brokers | Cuts processing window from 45 to 30 days | \n| CalPrivacy inflation adjustment | January 2027 (odd years) | All CCPA-covered businesses | Revenue threshold and fine amounts adjusted for inflation | \n\n## Market Impact: Data Brokers, Ad Tech, and the Cost of Compliance\n\nCCPA compliance already carries a revenue threshold most mid-size companies brush against without realizing it. A business falls under the law if it clears $26,625,000 in annual gross revenue, buys, sells, or shares personal information on 100,000 or more California consumers or households, or derives at least half its revenue from selling or sharing personal data, according to the threshold summary cited in [Kanerika’s CCPA and GDPR compliance-gap analysis](https://kanerika.com/blogs/gdpr-and-ccpa-compliance/). SB 923’s broadened deletion scope raises the cost of compliance for exactly the companies most exposed under that third trigger: data brokers and the ad-tech firms that buy from them.\n\nThe shortened 30-day DROP cycle under AB 883 compounds that pressure. Data brokers that previously had 45 days to locate and purge a record across every system now have a third less time, which pushes toward automated, continuously-synced deletion pipelines rather than manual quarterly sweeps. Expect compliance and legal-tech vendors selling CCPA deletion-workflow automation to see a bump in enterprise demand heading into the new year, since manual processes simply can’t hit a 30-day cycle at data-broker scale.\n\nOn the AI side, AB 1883 and SB 947 hit HR-tech and workplace-analytics vendors directly. Any product marketed around “sentiment analysis,” “engagement scoring,” or AI-assisted performance reviews now needs a California-specific carve-out or a full feature redesign, adding engineering cost to what had been a growth category for enterprise software companies.\n\n## How California Compares: Connecticut, the FTC, and the EU’s GDPR Enforcement Push\n\nCalifornia isn’t legislating in isolation. Connecticut’s AI law, the CART Act, along with companion amendments to the Connecticut Data Privacy Act, began phasing in October 1, 2026, adding data-broker oversight, a ban on selling precise geolocation data, consent requirements for direct-to-consumer genetic testing, and restrictions on facial recognition and surveillance pricing, per coverage in the [National Law Review’s October 2026 privacy briefing](https://natlawreview.com/article/privacy-filter-briefing-privacy-law-and-policy-october-2026). Additional Connecticut provisions stagger through January 2028, including an October 2027 deadline for employers using automated employment decisions to have a disclosure framework ready.\n\nAt the federal level, the FTC rescinded its 2021 policy statement on health-app [data breaches](https://shattered.io/category/security/) on September 9, 2026, calling it obsolete now that 2024 amendments to the Health Breach Notification Rule address connected devices directly. That’s a narrowing of federal guidance even as state rules expand, underscoring how much of the US privacy rulemaking burden is now falling on states rather than Washington.\n\nAcross the Atlantic, the European Data Protection Board adopted new guidelines on September 17, 2026 for when national regulators should impose fines, laying out a five-step methodology covering legal basis, liability, intent or negligence, aggravating factors, and whether a fine would be proportionate and effective. Public comments on those guidelines are due November 13, 2026. For multinational companies, the net effect is a widening patchwork: California tightens deletion scope and AI workplace rules, Connecticut adds geolocation and genetic-data restrictions, and the EU formalizes how its regulators decide when to fine at all.\n\n## From CCPA to CPRA to SB 923: A Short History of California Privacy Law\n\nCalifornia’s privacy regime didn’t arrive fully formed. The original CCPA took effect in 2020, giving residents baseline rights to know, delete, and opt out of the sale of their personal information. Voters then approved the California Privacy Rights Act (CPRA) as a ballot initiative, which created the California Privacy Protection Agency, the first dedicated privacy regulator of its kind in the US, and layered in sensitive-data categories and the right to correct inaccurate information.\n\nSB 923 is best read as the next iteration in that same lineage: CalPrivacy, now established and enforcing, is using its sponsorship power to push the deletion right further than the original statute’s drafters anticipated, specifically to close the data-broker loophole that enforcement experience exposed. Each cycle has followed a similar pattern, a gap identified through enforcement, a legislative fix sponsored by the agency itself, and a roughly 12-to-15-month runway before the new rule takes effect.\n\n## What VPNs, Browsers, and Privacy Tools Need to Do About the Opt Me Out Act\n\nAB 566’s mandatory browser opt-out signal lands in a market that has already been building toward standardized signals like Global Privacy Control for years. Browser makers now have a hard California deadline to ship a built-in, consumer-configurable version rather than relying on third-party extensions, and businesses that sell or share personal information must treat a qualifying signal as a valid opt-out request the moment it arrives, not as an optional courtesy.\n\nThe privacy-tool market has been moving in a parallel direction on its own. Independent no-logs audits have become a competitive differentiator among VPN providers: one tracking effort cited in [SoftDecider’s VPN jurisdiction and logging matrix for 2026](https://softdecider.com/articles/vpn-jurisdiction-logging-matrix-2026) notes that a leading VPN provider has passed six independent no-logs assurance engagements, with its most recent round announced in February 2026, while a rival service has passed five annual audits and reports it could not comply with more than four hundred legal data requests. That audit arms race mirrors what AB 566 is trying to force at the browser level: a baseline, verifiable opt-out signal rather than a patchwork of trust-me claims.\n\nFor everyday users, the practical upshot is that a correctly configured browser signal paired with CCPA’s expanded deletion right gives Californians two complementary tools in 2027: one that blocks new data sales going forward, and one that reaches back to erase what’s already been collected about them from any source.\n\n## Predictions: What Comes Next for US Privacy Regulation\n\n- **More states copy the data-broker deletion fix.** SB 923’s “from or about” language closes a loophole that exists in most other state privacy statutes too, and state legislatures tend to borrow language that survives a veto fight elsewhere.\n- **HR-tech vendors quietly strip sentiment features from California SKUs first.** Expect product changelogs referencing AB 1883 compliance months before the broader feature gets redesigned for other markets.\n- **Data broker consolidation accelerates.** Smaller brokers that can’t build an automated 30-day DROP-compliant deletion pipeline under AB 883 become acquisition targets for compliance-ready platforms.\n- **Litigation shifts toward AB 2561’s anti-reversal clause.** Silent privacy-setting overrides via app updates are common enough that plaintiffs’ firms are likely to test this provision early in 2027.\n- **CalPrivacy’s January 2027 inflation adjustment nudges more mid-size firms into CCPA scope.** Each upward revenue-threshold adjustment still pulls in companies that grew past the prior cutoff during the two-year gap between adjustments.\n\n## What Businesses Should Do Before the Deadline\n\nWith 77 days left on the clock, the priority list is short but not easy. First, map every system that holds third-party or enriched personal data, not just first-party collection points, since SB 923’s deletion right now reaches all of it. Second, if the business operates exclusively online with a direct consumer relationship, stand up a web form or portal for privacy requests before January 1. Third, test opt-out signal handling end to end, including how site tags and ad pixels respond when a Global Privacy Control-style signal arrives from a browser compliant with AB 566.\n\nFourth, inventory every automated decision system touching lending, housing, education, employment, or healthcare outcomes, and prepare the pre-use notices and opt-out processes ADMT rules require. Fifth, confirm whether the business clears the $100 million revenue threshold that triggers the first cybersecurity audit cycle, and if so, start that audit period planning now rather than in Q4 2027. Finally, any company running AI-assisted employee monitoring should audit vendor contracts specifically for sentiment-scoring or emotional-inference features before AB 1883 enforcement begins.\n\n## Frequently Asked Questions\n\n**Does SB 923 only cover data collected after January 1, 2027?**\n\nNo. The expanded deletion right isn’t limited to newly collected data. A deletion request received on or after the effective date can reach personal information the business already holds about a consumer from any source, including data acquired before the law took effect, subject to CCPA’s existing exceptions.\n\n**Did California ban selling sensitive personal information?**\n\nNo. AB 1542, which would have imposed that ban, was vetoed on September 27, 2026. The existing opt-out and right-to-limit framework for sensitive personal information remains in place.\n\n**What is the current CCPA revenue threshold?**\n\nAs of this writing, a business falls under CCPA coverage at $26,625,000 in annual gross revenue, among other triggers such as handling data on 100,000 or more California consumers or households. CalPrivacy adjusts this figure for inflation every odd-numbered January, with the next adjustment due in January 2027.\n\n**Who has to comply with the new browser opt-out signal rule?**\n\nAB 566, the Opt Me Out Act, applies to any business that develops or maintains a web browser. Those businesses must build in a consumer-configurable opt-out preference signal by January 1, 2027, and any business that sells or shares personal information must honor a qualifying signal as a valid opt-out request.\n\n**Does AB 1883 ban all workplace AI monitoring?**\n\nNo. It specifically bars AI tools that recognize or infer an employee’s emotional state and restricts neural-data collection, with exceptions for safety and certain defense-related uses. General productivity or attendance monitoring that doesn’t score emotional state isn’t covered by this particular restriction.\n\n**When does the first CCPA cybersecurity audit requirement kick in?**\n\nFor businesses meeting the audit criteria with more than $100 million in 2026 annual gross revenue, the first audit period runs from January 1, 2027 to January 1, 2028, with the audit report and certification due by April 1, 2028.\n\n**How does this compare to GDPR enforcement in Europe?**\n\nThe two frameworks remain structurally different: GDPR applies to any organization that targets or monitors people in the EU regardless of revenue, while CCPA uses the revenue and data-volume thresholds described above. Separately, the European Data Protection Board adopted new guidelines on September 17, 2026 standardizing how national regulators decide when to issue a fine, with public comments open until November 13, 2026.", "url": "https://wpnews.pro/news/californias-sb-923-expands-ccpa-deletion-by-2027-2026", "canonical_source": "https://shattered.io/california-sb-923-ccpa-deletion-expansion-2026/", "published_at": "2026-10-16 04:08:07+00:00", "updated_at": "2026-10-16 05:05:21.112715+00:00", "lang": "en", "topics": ["ai-policy"], "entities": ["Gavin Newsom", "California Privacy Protection Agency", "SB 923", "AB 1542", "AB 1883", "CCPA", "California"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/californias-sb-923-expands-ccpa-deletion-by-2027-2026", "markdown": "https://wpnews.pro/news/californias-sb-923-expands-ccpa-deletion-by-2027-2026.md", "text": "https://wpnews.pro/news/californias-sb-923-expands-ccpa-deletion-by-2027-2026.txt", "jsonld": "https://wpnews.pro/news/californias-sb-923-expands-ccpa-deletion-by-2027-2026.jsonld"}}