California is expanding one of the California Consumer Privacy Act’s core consumer rights.

Governor Gavin Newsom has signed Senate Bill 923, the Expanding Privacy Rights Act, which broadens the CCPA’s right to delete so that it generally applies to personal information a business has collected from or about a consumer — regardless of where that information originated. The new requirements take effect January 1, 2027.

For ecommerce businesses, that could mean taking a closer look at customer information obtained through data enrichment, advertising and marketing partners, third-party data providers, and other outside sources.

And importantly, this is not just an issue for businesses located in California.

Does the CCPA Apply to Your Business?

An ecommerce business does not have to be based in California to be covered. The CCPA generally applies to for-profit businesses that do business in California and meet at least one of several thresholds involving annual revenue, the volume of California consumer data they buy, sell or share, or revenue derived from selling or sharing personal information.

Under the current thresholds, that includes businesses with annual gross revenue of at least $26.625 million, those that buy, sell or share personal information of 100,000 or more California consumers or households, or those deriving 50% or more of annual revenue from selling or sharing consumers’ personal information.

Not sure whether your business qualifies? The California Privacy Protection Agency provides an official guide: Does My Business Need to Comply With the CCPA?

Deletion Requests Will Reach More Data

Under the current CCPA, the right to delete generally focuses on personal information a business collected directly from the consumer.

SB 923 closes that gap by extending the right to information collected “from or about” the consumer, including applicable information obtained from third parties.

That matters because ecommerce customer profiles frequently combine information supplied directly by the customer with information obtained elsewhere.

A retailer might collect an email address and purchase history through its own website while also receiving demographic information, audience attributes, identity-resolution data, or other information through outside vendors.

Beginning in 2027, covered businesses will need to ensure their deletion processes account for applicable personal information across those sources — not just information submitted directly through a website or checkout process.

The practical question becomes: Where does a customer’s information exist, where did it come from, and which systems or vendors are involved when a deletion request arrives?

Preventing Deleted Data From Coming Back

SB 923 also addresses another practical issue with third-party data.

A business could delete a consumer’s information only to receive the same information again through a data provider, enrichment service, or future database update.

The new law allows businesses to retain the minimum information necessary to document a deletion request and prevent that deleted information from being reintroduced. Existing CCPA exceptions allowing information to be retained for certain purposes, including fraud prevention and legal obligations, also remain.

Online-Only Businesses Cannot Require Consumers to “Email” Their Deletion Requests 

SB 923 includes another provision particularly relevant to ecommerce businesses that operate exclusively online (i.e., do not have physical stores) . Beginning January 1, 2027, covered online-only businesses must provide an online method, such as a web form or portal, for consumers to submit privacy requests rather than relying solely on an email address. Ecommerce businesses currently directing California consumers only to a privacy email address should therefore review their request process before the new requirements take effect.

What Ecommerce Businesses Should Review

For businesses covered by the CCPA, SB 923 makes data mapping and deletion workflows increasingly important.

Businesses should understand:

• what customer information they collect directly;
• what information they obtain from third parties;
• which systems and vendors contain that information;
• how deletion requests flow through those systems;
• whether deleted information could later be reintroduced; and
• whether consumers have the required methods for submitting privacy requests.

For many businesses, this may not require an entirely new privacy program. It may instead require making sure existing deletion processes reach all the places where customer information is actually stored and used.

Businesses — including those located outside California —  have until January 1, 2027, to review third-party data sources, deletion workflows, vendor relationships, and consumer request mechanisms before the expanded requirements take effect.

Join the EIA today to help strengthen and shape policies that affect all ecommerce businesses. Together, we can continue to create the future of ecommerce. Subscribe to EIA email updates to stay informed on key developments and their impact on your business. 

Ecommerce Innovation Alliance provides members with analysis of litigation and regulatory developments affecting online commerce and digital marketing. This post is for informational purposes only and does not constitute legal advice.