Compliance Radar · Privacy and consent
California widens the CCPA deletion right and requires online request forms
California will require online privacy request forms and a broader right to delete.
- Status
- Enacted
- Takes effect
- Expected January 1, 2027
- Announced
- September 2026
- Type
- law
What changed
SB 923 extends deletion to data collected 'from or about' a consumer. Online-only businesses must offer an email address and a webform or portal. AB 883 shortens DROP cycles to 30 days.
Who it affects
CCPA businesses; the form rule covers online-only businesses.
What to do
- Online-only? Add a request webform or portal.
- Extend deletion to data partners gave you.
- Update your policy's request methods.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- California Legislature: SB 923 (2025-2026) (opens in a new tab)
- Covington Inside Privacy: new California laws (opens in a new tab)
- National Law Review: 2026 session wrap-up (opens in a new tab)
Summary of public sources, not legal advice.