California Governor Newsom signed SB 923 on September 27, 2026, expanding consumer deletion rights under the CCPA to cover data purchased from third parties, effective January 1, 2027. The law also requires online-only businesses to offer a web form or portal in addition to email for privacy requests.