SACRAMENTO, CA — As we observe Data Privacy Week and following the successful implementation of the Delete Act and the launch of the popular DROP tool, Senator Josh Becker (D-Menlo Park) today announced new legislation to further strengthen privacy protections for Californians, building on his previous work on consumer privacy.
Sponsored by the California Privacy Protection Agency, the Expanding Privacy Rights Act (EPRA), or SB 923, reinforces consumers’ rights under the California Consumer Privacy Act (CCPA) by expanding the right to delete personal information to cover information that a business collects and holds on a consumer from a third-party, and it requires businesses who operate exclusively online to provide consumers with an both an email address and an online method, such as a webform or online portal, for Californians to access, correct, or delete their personal information.
“Californians have been very clear that they want to reclaim control over their personal information, and this bill gives them a new tool to do that,” said Becker. “The incredible success of the Delete Act and DROP demonstrates that strong privacy laws are practical, popular, and effective. They show that if we make it easier, people will take advantage and delete their data. SB 923 makes it easier for Californians to delete their personal information that businesses collect and hold on them. If a business is using your data to make decisions that impact you, then you should have the right to delete it.”
“This bill ensures Californians have true control over their data – the ability to request that all personal information be deleted, no matter the source, using a method that is practical and accessible. We thank Senator Becker for authoring this bill that will make California’s privacy rights more meaningful.” – Tom Kemp, Executive Director, California Privacy Protection Agency
Under current law, the CCPA allows consumers to request deletion of personal information that a business collects directly from them, but it does not require deletion of personal data obtained from third parties such as data brokers. Businesses routinely supplement their own customer data by purchasing information from third parties, including demographic data and purchasing histories to be used for targeted advertising, pricing decisions, and profiling often without consumers knowledge or without a practical way to remove it.
SB 923 builds on the Delete Act by empowering consumers to delete their personal information from businesses who quietly add third-party data purchased by data brokers to detailed consumer profiles to target them for commercial purposes.
California has led the nation on consumer protection and privacy, and SB 923 represents the next evolution of that leadership. Building on Senator Becker’s Delete Act and the successful rollout of DROP, the bill reinforces a core principle: Californians have a right to control their data.