Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCalifornia’s SB 923 expands the state’s deletion right to personal information a business obtained from third parties, lets businesses use a suppression list to help keep deleted information from returning, and requires online-only businesses to offer an online way to submit privacy requests. The law was signed on September 27, 2026, and takes effect January 1, 2027. For developers, the practical change is that deletion workflows need to account for data provenance and later imports—not just records collected directly from a consumer.
What SB 923 changes for deletion workflows
The California Privacy Protection Agency (CPPA) describes SB 923, the Expanding Privacy Rights Act, as closing a gap in the deletion right: previously, businesses were not required to delete personal information they obtained from a third party rather than directly from the consumer. SB 923 extends the right to that third-party-obtained information. Its effective date is January 1, 2027, according to the CPPA’s September 27, 2026 announcement.
![Information Privacy Law [Connected eBook] (Aspen Casebook)](https://m.media-amazon.com/images/I/41xPyhfV3cL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
That source-based expansion matters when a business enriches profiles, syncs partner records, imports vendor data, or otherwise acquires information outside its direct consumer relationship. A request-processing system that searches only a first-party account database may miss information now within the expanded deletion right.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Keep deletion decisions from being undone by new data
The CPPA announcement says businesses may maintain a suppression list so a consumer’s information stays deleted when additional third-party data is acquired later. The announcement does not prescribe a particular database design or retention period. A practical implementation is to make the deletion decision available to later import, enrichment, and synchronization jobs before they create or restore a consumer-linked record.
#1 Best Overall
That requires a reliable way to connect incoming records to the consumer identity used by request processing. As an engineering inference—not a technical architecture mandated by the announcement—teams should retain enough source and identity provenance to locate relevant information and apply the request across systems. They should also record which systems or processors received deletion work, whether it succeeded, and how a later import checks the suppression state.
Offer an online request route where required
SB 923 requires online-only businesses to provide an online submission option for privacy requests; the CPPA gives a webform as an example. An email address alone is not the stated online submission option. Review the paths consumers can actually use, including whether the online route is easy to find and whether requests submitted there enter the same tracking and fulfillment workflow as requests arriving through other channels.
How to adapt a privacy-request tool
SB 923 does not establish a required software architecture. The following are implementation considerations derived from the expanded deletion scope and the CPPA’s description of suppression lists, not a guarantee that any particular feature makes a business compliant.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Map data sources to systems. Identify where personal information is stored or processed, including information received from vendors, partners, and other third parties. Record enough provenance to connect those records to the consumer identity and request status used by your workflow.
- Make deletion propagate. Route approved deletion work to the relevant systems and processors, capture completion or failure, and define how a retry works. Where a business uses a suppression list, check it when later imports or enrichment jobs attempt to add information.
- Make request intake trackable. Inventory public-facing submission routes. For an online-only business, provide an online submission method such as a webform, then make sure the request can be acknowledged, routed, and tracked through resolution.
- Keep rights and request types distinct. Do not reduce every request to a generic “privacy request” action. The California Attorney General’s CCPA overview describes separate rights to know, delete, correct inaccurate information, opt out of sale or sharing, limit certain uses or disclosures of sensitive personal information, and receive non-discriminatory treatment. Exceptions apply to some rights. Intake, eligibility checks, notices, and fulfillment should preserve which right a consumer is exercising.
- Keep evidence for applicable assessments and audits. If the business is subject to the 2025 CCPA regulations, map relevant processing to the assessment and audit obligations that apply to it. The regulations provide for submissions and executive attestation, and the CPPA or Attorney General may request assessment reports.
- Plan for covered ADMT uses. If the business uses automated decision-making technology (ADMT) for a significant decision covered by the regulations, account for pre-use notices and applicable consumer rights. The California regulations distinguish pre-existing covered uses from new ones beginning on or after January 1, 2027.
When evaluating a compliance tool, ask how it handles source-aware discovery, deletion propagation and suppression state, intake and request status, records needed for applicable assessments and audits, and ADMT notice and request workflows. These are evaluation questions, not verified capabilities of any particular product.
Rank #3
How SB 923 fits with the CCPA and the 2025 regulations
SB 923 is an expansion of deletion rights, not a separate, comprehensive California privacy code. The Attorney General explains that Proposition 24, the California Privacy Rights Act (CPRA), amended the California Consumer Privacy Act (CCPA); it did not create a separate law. The CCPA framework includes several distinct consumer rights, while SB 923 changes the scope of the deletion right for third-party-obtained information.
There is also a separate set of CCPA regulations adopted in 2025. Those regulations took effect January 1, 2026, and address subjects including risk assessments, cybersecurity audits, ADMT, insurance, and updates to CCPA rules. Some duties have later compliance dates. They should not be conflated with SB 923’s January 1, 2027 effective date.
Rank #4
Key California privacy dates for developers
| Date | Requirement or milestone | Who should pay attention |
|---|---|---|
| January 1, 2026 | The 2025 CCPA regulation package took effect. | Businesses subject to the applicable regulations. |
| January 1, 2027 | SB 923 takes effect, expanding deletion to third-party-obtained personal information. ADMT requirements for significant decisions also begin for covered pre-existing uses. | Businesses handling deletion requests; businesses with covered ADMT uses. |
| January 1, 2027 onward | New covered ADMT uses beginning on or after this date must comply when used. | Businesses using ADMT for a covered significant decision. |
| April 1, 2028 | CPPA submission deadline for risk assessment information for assessments conducted in 2026 and 2027. | Businesses subject to the risk assessment submission rules. |
| April 1, 2028 | Cybersecurity audit certification deadline for specified businesses with annual revenue over $100 million. | Only businesses within the applicable audit rules and revenue bracket. |
| April 1, 2029 | Cybersecurity audit certification deadline for specified businesses with annual revenue from $50 million to $100 million. | Only businesses within the applicable audit rules and revenue bracket. |
| April 1, 2030 | Cybersecurity audit certification deadline for specified businesses with annual revenue under $50 million. | Only businesses within the applicable audit rules and revenue bracket. |
The revenue-band audit dates are the CPPA’s published deadlines for specified businesses, not a schedule that applies to every CCPA-covered organization. Confirm whether the relevant rules cover your business before planning around a date.
Free tools Windows power users keep installed
One-click scans. No signup required.
Keep data-broker duties in their own workflow
Data brokers have a separate Delete Act and DROP process. The CPPA’s data-broker instructions describe account creation, annual registration, and processing deletion lists through the DROP platform. They also state that data brokers must undergo independent audits starting January 1, 2028, and every three years thereafter. These are requirements for qualifying data brokers, not a universal registration or deletion-list process for every developer or CCPA-covered business.
Best Value
What developers should confirm before changing production workflows
The agency announcement establishes the expanded deletion scope, the permitted suppression-list approach, and the online submission requirement for online-only businesses. It does not resolve how the law interacts with every exemption, contract, retention duty, or business-specific recordkeeping situation. A developer should not treat a feature change alone as proof that an organization is covered—or compliant. Work with the organization’s privacy and legal teams to determine which obligations apply, then translate those decisions into data discovery, request handling, and operational controls.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
