California SB 923: Marketing Finds the Consumer but Deletion Does Not

California’s expanded California’s expanded California Consumer Privacy Act (CCPA) deletion right arrives January 1, 2027. The question we hear from general counsel is “When a consumer requests deletion, can the workflow reach the records tied to that person?”

GC skim

What changes under the law. California’s SB 923 was signed September 27, 2026, and takes effect January 1, 2027. It amends the CCPA deletion right to cover personal information a business has collected “from or about” the consumer, so purchased profiles and data from other companies are now in scope. Deleting only what the consumer handed over directly may not be enough, subject to statutory exceptions. SB 923 also amends Civil Code Section 1798.130(a)(1)(A): A business that operates exclusively online and has a direct relationship with consumers will need a web form or portal, not just an email address, for requests to know, delete, and correct.

What is at stake? The common failure is a quiet one: The company tells the consumer deletion is complete while a linked marketing profile stays in use. Each unfulfilled request may be treated as a separate violation subject to administrative fines under Section 1798.155(a), currently up to $2,663 per violation and $7,988 per intentional violation (the agency’s inflation-adjusted figures; the next adjustment is due January 2027). And because the error lives in the design rather than in any one request, it may repeat across multiple workloads.

What counsel should do now. Before January 1, ask the privacy and engineering teams to demonstrate how a deletion request reaches third-party records associated with a consumer, how the workflow handles uncertain matches, and how the company identifies and documents information retained under a statutory exception. Turn what you learn into specific fixes with owners and dates. What you are after is evidence that the response the company sends the consumer matches what its systems did.

The deletion gap

Consider a hypothetical retailer. Its customer platform connects an email address to a loyalty account and to a vendor’s profile identifier. Marketing uses that connection to select audiences from purchased enrichment data. The deletion service searches by email only. It removes the account record, reports success, and leaves the enrichment profile available for marketing.

The search is too narrow. Sequencing can make it worse. If the workflow first deletes the table connecting loyalty accounts to vendor identifiers, it may destroy the route to purchased profile data that it still needs to address. Each database job succeeds, and the response is still incomplete.

The questions for engineering are how a verified request becomes a defined list of purchased profiles, vendor identifiers, and other records to act on and what is left when the job is done.

Identity symmetry applied to deletion

Our two alerts earlier this year examined the opt-out side of the same design problem. In February 2026, the California attorney general announced a $2.75 million settlement with Disney, alleging that a consumer’s opt-out applied only to the streaming service, and often only to the device, where the request was made. Our alert on that settlement asked whether an opt-out reaches the linked systems a company uses for advertising. The following month, the California Privacy Protection Agency announced a $375,703 stipulated order resolving findings that Ford required consumers to verify their email addresses before it would process their opt-out requests. Our alert on that order focused on the friction consumers face when exercising the right. Both come down to the same question: If a company can connect identities well enough to market to someone, can it connect them well enough, with appropriate safeguards, to honor that person’s privacy rights? We call that test identity symmetry.

SB 923 brings the same test to deletion: Can the company find and address third-party records it already associates with the requester? There is one difference that matters. Overshoot on an opt-out and the company uses less data. Overshoot on a deletion and it may erase someone else’s information, so reliable attribution carries more weight here. The statute sets no matching algorithm, threshold, or screening frequency, so the business will need to make and document those choices.

Verification and attribution are different questions

Verifying who is asking and deciding which records are theirs are two different steps. Logging in to an account proves the first. It says nothing about whether each association a vendor supplied is accurate. The CCPA regulations require reasonable verification, and they call for a more stringent process where unauthorized deletion carries a greater risk of harm (11 CCR §§ 7060(c)(3)(B) and 7062(d)).

Suppose marketing associates a purchased profile with the requester based on a shared household address. Automatically deleting each record linked through that address could erase someone else’s information. Excluding uncertain matches altogether could leave much of the requester’s profile untouched. The workflow needs a documented method for resolving that tension. The regulations offer a starting point. When records are maintained without being associated with a named person, a business may verify the consumer by requiring the consumer to demonstrate that they are the sole person associated with the identifying information (11 CCR § 7062).

Implementation decisions for legal, privacy, and engineering

There are four decisions counsel, privacy operations, and engineering should make together, ideally in the same room.

1.  Determine which records the request should reach.

Ask for a representative account’s identifier map: the email address, the account number, vendor identifiers, and the connections among them. Identify which connections rest on authenticated account activity and which depend on estimates or shared attributes.

Ask for a short written spec of which records the workflow will consider and why, and hold it up against the systems that use those same records to sell. If marketing can retrieve a vendor profile through an existing account connection, engineering should explain why the deletion workflow cannot.

2.  Specify how uncertain associations will be handled.

Counsel’s job is to name the distinction that matters legally; engineering’s is to say what the evidence can support. A wrong attribute inside the requester’s own purchased profile is one problem. A separate record that belongs to someone else is another.

Document when automated action is justified, when human review is needed, and who resolves uncertainty. Review should finish within the 45-day response period or within the single 45-day extension where the business gives the consumer notice (Civil Code § 1798.130(a)(2)(A); 11 CCR § 7021(b)).

Collecting more identity data should be a last resort. The regulations direct businesses to avoid requesting additional verification information when the information they already hold can verify the consumer (11 CCR § 7060(d)). Record whether each disputed association was deleted, retained, or referred for review, and why, without keeping an unnecessary copy of the purchased profile.

3.  Design deletion order and permitted retention together.

The legal point is simple: The workflow must not destroy the links it still needs to complete the request. The sequence below is one way engineering can achieve that.

A workable sequence resolves the full identifier set, writes it to a deletion manifest, sends downstream notices, deletes the underlying records, removes the linkage tables last, and then reduces the manifest to a suppression entry and the request record. Deletion jobs should be built so a retry does not fail on records that are already gone.

The response also triggers notices under Civil Code § 1798.105(c)(1) to service providers, contractors, and third parties to which the business sold or with which it shared the information, unless that proves impossible or involves disproportionate effort; the regulations call for a detailed explanation when a business relies on that exception (11 CCR § 7022(b)). The vendor that sold the enrichment data is a source, not a recipient, so it generally sits outside that notice duty, and the business’s own deletion will not reach the vendor’s copy. The consumer response should not imply otherwise. Enrichment contracts are worth a look for deletion-cooperation and redelivery terms; where the vendor is a registered data broker, the consumer’s route to that copy is the Delete Act and the agency’s DROP platform.

SB 923 leaves the Section 1798.105(d) exceptions in place and adds Section 1798.105(c)(2). Under that provision, a business that obtained information from a source other than the consumer is “deemed in compliance” with a deletion request when it retains a record of the request and the minimum data necessary to keep the information deleted and prevent any other use. In plain terms, that is a narrow suppression record, enough to keep the deleted information from coming back. It is not a license to keep the enrichment profile itself for ordinary business use. The statute sets no retention period for the suppression record, so the business will need to select and document one. The suppression record is distinct from the record of requests and responses that businesses must retain for at least 24 months under 11 CCR § 7101(a).

The suppression mechanism must recognize the identifiers that future vendor feeds contain. An email-only suppression record misses the next import that carries only the vendor’s identifier. One design that works is a restricted table of hashed identifiers reliably linked to the requester, checked against each incoming feed before records reach marketing. Hashing helps with matching and limits exposure if the table leaks, but it does not take the data outside the CCPA; the hashes likely remain personal information, and FTC technology staff have cautioned that hashed identifiers can still identify and track people. The table should be treated as a purpose-limited record within SB 923’s minimum-data allowance, with access and use restrictions to match. Engineering should show where the check runs, what happens on a match, and how restored backups are handled (11 CCR § 7022(d)).

Counsel signs off on why identifiers are kept and how far that goes; engineering confirms the fields can do the job. Decide in advance how the suppression record treats a requester who later returns as a customer, and document the reasoning. New first-party data collected under a new notice is a different matter from re-appending purchased enrichment to the same person, and SB 923 does not say how the two interact.

4.  Define completion through observable results.

Run an acceptance test through the real workflow with controlled test records. Confirm it reaches a reliably linked vendor profile, protects an unrelated household member’s record, and applies the intended treatment to a later data import. Test failed jobs and retries as well as the successful path.

For production requests, consider recording the matching-rule version applied, the systems addressed, exception decisions, downstream notices sent, and unresolved failures. These are implementation records we recommend, proportionate to the system and the risk.

The consumer’s response should trace back to those results. Retention under an exception, a failed job, and a record that could not be reliably attributed are different outcomes, and the evidence should keep them distinguishable.

The evidence question

With less than three months to go, it may not be possible to complete full remediation in time. A documented demonstration can. Pick one representative deletion flow, include a disputed match and the next data import, and watch it run before January 1. Agree on what the law expects before you start, and then compare that with what the systems do.

Each discrepancy becomes a specific implementation decision with an owner and a date. The dated record of that work serves as evidence of good faith compliance, which the California Privacy Protection Agency may consider in deciding whether to pursue an investigation (11 CCR § 7301(b)). That is the record we would want to see if a regulator asked how the company knew its deletion responses were accurate.

How we can help

We are glad to help scope a review of one deletion flow. We work with counsel to define the expected legal outcomes, sit with engineering while the workflow runs, and deliver a findings list with owners and dates. We can also review enrichment vendor contracts and deletion-response templates against SB 923.