California SB 923: Delete Requests Reach Bought Data

California just closed a loophole in its deletion law, and the change lands on January 1, 2027. Governor Newsom signed SB 923 on September 27, 2026, which means a shopper’s request to delete their data will soon reach information you bought, matched or borrowed from someone else, not only what they typed into your checkout. If you sell to California customers, you have 81 days to get your request intake and deletion process in order.

I’m Trevor, and I run E-Commerce Paradise to help store owners handle the unglamorous parts of the business before they turn into expensive problems. This is one of those parts. Below is exactly what SB 923 changes, who it reaches, what you can still keep, and a plain checklist to work through before the new year.

Put your store inside a proper LLC before privacy rules start landing on it. Northwest Registered Agent handles the filing, backed by 25 years of reliability. Form your LLC with Northwest →

What Newsom Signed on September 27 and When It Takes Effect

SB 923 is called the Expanding Privacy Rights Act. Senator Becker authored it and CalPrivacy, the state’s privacy agency, sponsored it. According to a CalPrivacy release from August 28, the Legislature approved it and sent it to the Governor, who signed it a month later.

The bill amends two sections of the California Civil Code, 1798.105 and 1798.130, according to a Kilpatrick Townsend alert dated September 30. Both changes take effect January 1, 2027. CalPrivacy’s executive director, Tom Kemp, said the bill “will fix a loophole in the CCPA’s existing right to delete.”

The agency also framed this as catching up with other states. Its release says the change aligns California’s deletion rights with those in Delaware, Indiana, Maryland and New Jersey.

How “From” Became “From or About” and Why That One Word Matters

Under current law, a consumer can ask a business to delete personal information it collected “from” the consumer. That wording left a gap. Data you got from somewhere else, rather than from the shopper directly, sat outside the delete right.

SB 923 changes the phrase to information collected “from or about” the consumer. Kilpatrick Townsend’s reading is that this reaches information obtained from other sources, such as data brokers, marketing or business partners, and enrichment or identity-resolution services, subject to the CCPA’s existing exceptions.

A second duty rides along with it. A Nixon Peabody alert from October 8 says businesses must notify the third parties they shared or sold the data to and direct them to delete it. So a deletion is no longer a quiet cleanup in your own database. It becomes a message that travels outward to your vendors and partners.

Where Bought and Borrowed Customer Data Hides in an Online Store

Most store owners think of customer data as the name, email and address from checkout. That is the easy part. The harder part is everything layered on top of it.

If your email platform appends data to profiles, if an ad audience was built by matching a list, or if a CRM enriches contacts with details the customer never gave you, that information is “about” the shopper without coming “from” them. Those are the places SB 923 is aimed at. I’m describing common patterns here, not auditing your setup, so check what each tool in your stack actually does.

Customer support tools deserve a look too. Order notes, chat transcripts and saved replies often hold addresses, phone numbers and purchase history in one searchable pile. The more places a customer’s record lives, the more places you have to reach when a deletion request arrives, and the more places a leak can start. The ASOS breach that hit its customer messaging platforms is a good reminder of how much data sits in tools nobody thinks about.

One more spot is the store itself. Shopify now drafts policies for merchants, and I covered that in my post on Shopify writing and updating your store policies. An automated policy can describe your practices, but it cannot tell you what your email, ad and support tools are quietly storing.

Not sure what your store’s tool stack is holding? Get one-on-one help sorting out your setup and your next moves with my coaching. Book coaching with Trevor →

Whether Your Store Falls Under the CCPA in the First Place

Not every store is covered. The California Attorney General’s CCPA page says the law applies to for-profit businesses that do business in California and meet any one of three tests. They have gross annual revenue over $25 million, or they buy, sell or share the personal information of 100,000 or more California residents or households, or they derive 50% or more of annual revenue from selling California residents’ personal information.

That matters for the typical high-ticket dropshipping store. A young store with modest revenue and a small California customer base may sit below every line. But the 100,000 test counts households and residents, and it includes information you buy or share, not only what you collect. A store that buys lists or runs large matched audiences can move closer to that number than its revenue suggests.

I’m not a lawyer, and this is reported information, not legal advice. Check the thresholds on the Attorney General’s page, run your numbers, and talk to a privacy attorney if you are anywhere near a line. If you plan to grow into a larger store, build the habits now, because the work is far cheaper before you scale. My guide on how high-ticket dropshipping works explains the model if you are new to it.

The Email-Only Shortcut Ends on January 1

This is the part that changes day-to-day operations for many small stores. Today, a business that operates exclusively online and has a direct relationship with its customers can accept requests through an email address alone. The Attorney General’s page confirms that online-only option.

Starting January 1, 2027, that shortcut closes. The Kilpatrick Townsend alert puts it bluntly: “Beginning January 1, 2027, email alone will no longer be enough.” Online-only businesses with a direct consumer relationship must also offer an online method, such as a web form or portal, for access, deletion and correction requests.

The Attorney General’s page also says you cannot require an account just to submit a request. So the method has to work for a guest who bought once and never logged in. A simple, clearly labeled request page that routes to a monitored inbox or a ticket queue is the practical starting point. Confirm the exact design with counsel.

Your privacy policy has to describe whatever you build. If yours is out of date or was copied from another site, Termly is a tool built to generate policies for online stores, and I would refresh the document while you are touching the request process anyway.

What You Are Still Allowed to Keep After a Deletion

Deleting does not mean erasing every trace that a person ever existed in your system. For information obtained from a source other than the consumer, the statute lets a business keep a record of the deletion request and the minimum data needed to keep the consumer’s information deleted and stop it from being used for another purpose. That is the suppression list idea, and it is in section 1798.105(c)(2).

The law also allows a confidential record of deletion requests for purposes the CCPA permits, under section 1798.105(c)(3). Kilpatrick Townsend adds a caution: this does not let you hold on to a deleted profile for convenience. Keep the record of the request and the least data that does the job.

Existing exemptions stay in place. CalPrivacy lists fraud prevention, peer-reviewed research and legal compliance. The Attorney General’s page adds situations like completing a transaction and security uses. So a customer with an open order, a warranty claim or a pending chargeback is not a customer you delete on the same day without thinking.

The 45-Day Clock and How to Run a Request Across Your Stack

The Attorney General’s page says businesses must respond to a deletion request within 45 calendar days, and they can extend by another 45 days if they notify the consumer. A deletion request also asks the business to tell its service providers to delete the data. SB 923 widens what is in scope without changing that rhythm.

Here is the workflow I would build before January 1, written so one person can run it:

Log the request the day it arrives, with the date, the method and the email used.
Verify the requester reasonably, without demanding an account login.
Search every system that holds customer data, including the store, email platform, CRM, support desk and ad audiences.
Decide what falls under an exemption, such as an open order or a legal obligation, and note why.
Delete what is not exempt, then add the person to a minimal suppression record.
Notify the vendors and partners you shared or sold the data to, and ask them to delete it.
Reply to the customer inside 45 days, and keep proof of what you did.

Step three is where most of the time goes. A written map of where customer data lives, kept in a shared document, turns a scramble into a checklist. The same tool-stack review also helps with another January 1 change, because California is taxing SaaS from the same date and that is another reason to know exactly which tools you pay for.

A Tool-by-Tool Audit to Finish Before the New Year

Every tool in your stack needs the same three questions. Where does a customer record live, can I delete a profile and suppress it from coming back, and does the vendor have a way to pass a deletion along to its own processors. Ask the vendor and write the answer down.

Start with email, because it usually holds the most data. If you run flows and segments in Klaviyo, find out how profiles are deleted and how suppression works. The same questions apply if you use Omnisend, and I would check both for any fields that were filled in by something other than the customer.

Next, check your CRM. Contact records in HubSpot can hold enrichment data, form submissions and notes in one place. If you run a creator-style list in Kit, treat it the same way and confirm what a delete actually removes.

Then look at support. A desk like Gorgias keeps conversation history tied to orders, so your process needs to say what stays for an open order and what goes after it closes. Finally, review the store platform itself: Shopify is where the order and customer records start, so your deletion steps should begin there and fan out.

If you are running an LLC with a business address and a registered agent, keep those records in order too. A clean company file makes it easier to answer any regulator or partner who asks who is responsible for the data. Bizee is another formation service worth comparing if you have not filed yet. LegalZoom is a third.

What SB 923 Does Not Do, and How It Fits With SB 690 and AB 1542

It helps to keep the California package straight, because the signed bills arrived together and get mixed up. Nixon Peabody’s alert says SB 690 removes the private right of action for pen register and trap and trace claims under the California Invasion of Privacy Act. Only the Attorney General can enforce those claims, and it applies retroactively to suits filed in the two years before the effective date.

That is a different fight from SB 923. I broke it down in my post on how SB 690 ends pixel lawsuits while chat widget claims survive. The alert also notes that SB 690 does not legalize the underlying conduct, and wiretapping and eavesdropping claims under other sections and under federal law remain available.

AB 1542 was vetoed. It would have barred the sale or sharing of sensitive personal information, such as precise geolocation, Social Security numbers or genetic data, with third parties. Existing CCPA rights to opt out of sale or sharing and to limit use of sensitive personal information remain in place.

Selling into Europe adds another layer of consent rules on top of this. I wrote about the EU Council draft that shortens the cookie re-ask wait, and the two sets of rules pull on the same cookie banner and tracking setup. Treat privacy as one project, not three.

For a wider view of the other bills signed this session, including chatbot, age and AI rules, Wilson Sonsini’s summary of the 2026 California privacy and AI bills is a useful table to bookmark.

The 81-Day Plan I Would Follow if This Were My Store

Here is how I would spread the work between now and January 1, so it never becomes a December panic.

In the next two weeks, build the data map. List every tool that touches a customer record and note what each one stores and where the data came from. Mark anything that arrived from a source other than the shopper, because that is the new territory.

In November, build the request page and the internal workflow, and rewrite the privacy policy to match. Test the page as a guest, from your phone, with no account. Send yourself a test request and see how long it takes to find and delete the record across every system.

In December, email your key vendors and confirm how they handle a deletion notice. Update your policy, brief anyone who answers customer emails, and run one more dry run. If you are choosing platforms or hiring help this quarter, bring this checklist into those decisions.

If building and running all of this alongside a store sounds like too much, that is exactly why I built my done-for-you turnkey service. And if you are still picking products, my high-ticket niches list is where I would start.

Ready to scale the store without scaling the paperwork? Let my team help you grow with the right systems in place. Explore the scaling service →

I wish you the best of luck out there, and get that data map started this week.

Frequently Asked Questions

When does SB 923 take effect?

January 1, 2027. Governor Newsom signed it on September 27, 2026, and both the broader deletion scope and the online request method requirement start on that date.

Does SB 923 apply to a small dropshipping store?

Only if the store is covered by the CCPA, which the Attorney General’s page ties to revenue over $25 million, handling the personal information of 100,000 or more California residents or households, or earning 50% or more of revenue from selling that information. Check your numbers and ask an attorney if you are close.

Is an email address still enough to take deletion requests?

Not for online-only businesses with a direct consumer relationship after January 1, 2027. They must also offer an online method such as a web form or portal.

Can I keep any data after a deletion request?

Yes, within limits. For data from other sources, you may keep a record of the request and the minimum data needed to keep the information deleted. Existing exemptions, such as fraud prevention and legal compliance, still apply.

Does SB 923 stop pixel and tracking lawsuits?

No. That is SB 690, which removes private pen register claims under CIPA and gives enforcement to the Attorney General. Other CIPA and federal claims can still be brought.

If you found this useful, these guides go deeper on related topics:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.