California Senator Josh Becker has introduced Senate Bill 923 (SB 923), the Expanding Privacy Rights Act – a proposed update to the state’s privacy framework that would expand consumers’ data deletion rights and add new requirements for how privacy requests by consumers are submitted.

While SB 923 is not yet law, it has already attracted attention because it is sponsored by the California Privacy Protection Agency (CPPA), the state regulator responsible for enforcing the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). This suggests that the proposal could receive serious consideration as the legislative process moves forward.

Because California’s privacy laws apply to businesses that collect personal data from California residents—regardless of where the business is located—SB 923 could affect ecommerce companies and consumers across the U.S., not just those based in California.

What SB 923 Proposes

Senate Bill 923 would make two key changes:

• Broader deletion rights: Consumers could request deletion of any personal data a business has collected about them — not just data provided by or collected directly from the consumer. This could include inferred data, analytics information, and data received from third parties.
• More structured privacy request methods: Online businesses would be required to offer clearer, more accessible ways for consumers to submit deletion and other privacy requests, such as webforms or portals.

Why Ecommerce Businesses Should Pay Attention

Ecommerce businesses rely heavily on customer data that flows across marketing platforms, analytics tools, CRM systems, and advertising partners. Expanding deletion rights could increase the scope of data that must be identified, tracked, and removed across these systems.

For brands, this may affect:

• Marketing and personalization, including segmentation, lifecycle campaigns, and product recommendations
• Analytics and measurement, such as attribution, customer lifetime value, and performance tracking
• Customer service and compliance workloads, as deletion requests increase in volume or complexity
• Operational workflows, as businesses coordinate deletion across multiple vendors and platforms
• Development overhead, particularly for building and maintaining online privacy request tools

There is also a practical challenge. Businesses must balance deleting data with retaining limited information needed to prevent re-contacting consumers or to meet legal and operational requirements.

Consumer Considerations

From a consumer perspective, supporters argue SB 923 would provide greater transparency and control over personal data, particularly data that consumers may not realize is being collected or inferred. Clearer and more accessible request mechanisms may also reduce friction and uncertainty when exercising privacy rights.

At the same time, broader deletion may lead to less personalized shopping experiences, fewer tailored offers, and less continuity across channels—tradeoffs that are increasingly part of the broader privacy conversation.

A Proposal to Watch

SB 923 is still in the early stages and could change as it moves through the California Legislature. However, CPPA sponsorship signals that expanded deletion rights and accessibility requirements are likely to remain a focus of California’s privacy enforcement agenda.

EIA will continue monitoring SB 923 and similar proposals to help ecommerce businesses understand how evolving privacy laws may affect marketing, analytics, and day-to-day operations.

Join the EIA today to help strengthen and shape policies that affect all ecommerce businesses. Together, we can continue to create the future of ecommerce. Subscribe to EIA email updates to stay informed on key developments and their impact on your business.