Consumers’ Right to Delete Personal Information

What it requires

Consumers have the right to request deletion of personal information a business has collected from them. The privacy policy must describe this right and explain how to submit a deletion request. The right in force reaches only what the business collected directly from the consumer, so personal information it bought or received from a third party falls outside it. SB 923 (Becker), the Expanding Privacy Rights Act, closes that gap from January 1, 2027. The bill rewrites subdivision (a) to reach information “collected from or about the consumer”, lets a business that obtained the data from another source comply by retaining a record of the request and the minimum data necessary to keep the information deleted and unused for any other purpose, and amends § 1798.130(a)(1)(A) so a business operating exclusively online with a direct consumer relationship must offer an online method, such as a web form or portal, alongside the email address. Governor Newsom signed SB 923 on September 27, 2026, and it takes effect January 1, 2027. Until then the text quoted here, limited to information collected from the consumer, is the duty in force.

Statute text

A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.

California Consumer Privacy Act / California Privacy Rights Act, § 1798.105Read the full section from California Privacy Protection Agency (CalPrivacy)

How Privisy tests it