Bill Full Text
Home
-
Bills
-
Bill
-
Authors
-
Dates
-
Locations
-
Analyses
-
Organizations
<?xml version="1.0" ?>
<ns0:MeasureDoc xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ns0="http://lc.ca.gov/legalservices/schemas/caml.1#" xmlns:ns3="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.0" xsi:schemaLocation="http://lc.ca.gov/legalservices/schemas/caml.1# xca.1.xsd">
<ns0:Description>
<ns0:Id>20250SB__092399INT</ns0:Id>
<ns0:VersionNum>99</ns0:VersionNum>
<ns0:History>
<ns0:Action>
<ns0:ActionText>INTRODUCED</ns0:ActionText>
<ns0:ActionDate>2026-01-28</ns0:ActionDate>
</ns0:Action>
</ns0:History>
<ns0:LegislativeInfo>
<ns0:SessionYear>2025</ns0:SessionYear>
<ns0:SessionNum>0</ns0:SessionNum>
<ns0:MeasureType>SB</ns0:MeasureType>
<ns0:MeasureNum>923</ns0:MeasureNum>
<ns0:MeasureState>INT</ns0:MeasureState>
</ns0:LegislativeInfo>
<ns0:AuthorText authorType="LEAD_AUTHOR">Introduced by Senator Becker</ns0:AuthorText>
<ns0:Authors>
<ns0:Legislator>
<ns0:Contribution>LEAD_AUTHOR</ns0:Contribution>
<ns0:House>SENATE</ns0:House>
<ns0:Name>Becker</ns0:Name>
</ns0:Legislator>
</ns0:Authors>
<ns0:Title> An act to amend Sections 1798.105 and 1798.130 of the Civil Code, relating to privacy.</ns0:Title>
<ns0:RelatingClause>privacy</ns0:RelatingClause>
<ns0:GeneralSubject>
<ns0:Subject>Consumer privacy requests: deletion request records and request submission methods.</ns0:Subject>
</ns0:GeneralSubject>
<ns0:DigestText>
<html:p>Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants to a consumer various rights with respect to personal information that is collected by a business. Among those rights, the CCPA includes the right to request that a business delete personal information that the business has collected from the consumer.</html:p>
<html:p>This bill would expand that right to include requesting the deletion of any personal information that the business has collected about the consumer. If the business did not obtain the personal information from the consumer, the bill would allow the business to retain a record of the deletion request and the minimum data necessary to ensure the consumer’s personal information remains deleted from its records and is not being used for any other purpose.</html:p>
<html:p>Existing law generally requires
businesses to make certain methods of communication available for consumers to submit personal information requests, including requests for deletion and correction. If a business operates exclusively online and has a direct relationship with the consumer from whom it collects personal information, existing law requires the business to provide consumers an email address for submitting personal information requests.</html:p>
<html:p>This bill would also require that business to make an online method, such as a web form or online portal, available to consumers for submitting personal information requests.</html:p>
<html:p>Existing law, the California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.</html:p>
<html:p> This bill would declare that its provisions further the purposes and intent of the
California Privacy Rights Act of 2020.</html:p>
</ns0:DigestText>
<ns0:DigestKey>
<ns0:VoteRequired>MAJORITY</ns0:VoteRequired>
<ns0:Appropriation>NO</ns0:Appropriation>
<ns0:FiscalCommittee>YES</ns0:FiscalCommittee>
<ns0:LocalProgram>NO</ns0:LocalProgram>
</ns0:DigestKey>
<ns0:MeasureIndicators>
<ns0:ImmediateEffect>NO</ns0:ImmediateEffect>
<ns0:ImmediateEffectFlags>
<ns0:Urgency>NO</ns0:Urgency>
<ns0:TaxLevy>NO</ns0:TaxLevy>
<ns0:Election>NO</ns0:Election>
<ns0:UsualCurrentExpenses>NO</ns0:UsualCurrentExpenses>
<ns0:BudgetBill>NO</ns0:BudgetBill>
<ns0:Prop25TrailerBill>NO</ns0:Prop25TrailerBill>
</ns0:ImmediateEffectFlags>
</ns0:MeasureIndicators>
</ns0:Description>
<ns0:Bill id="bill">
<ns0:Preamble>The people of the State of California do enact as follows:</ns0:Preamble>
<ns0:BillSection id="id_11364BB5-B092-4081-954F-BE711AA56B35">
<ns0:Num>SECTION 1.</ns0:Num>
<ns0:ActionLine action="IS_AMENDED" ns3:href="urn:caml:codes:CIV:caml#xpointer(%2Fcaml%3ALawDoc%2Fcaml%3ACode%2Fcaml%3ALawHeading%5B%40type%3D'DIVISION'%20and%20caml%3ANum%3D'3.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'PART'%20and%20caml%3ANum%3D'4.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'TITLE'%20and%20caml%3ANum%3D'1.81.5.'%5D%2Fcaml%3ALawSection%5Bcaml%3ANum%3D'1798.105.'%5D)" ns3:label="fractionType: LAW_SECTION" ns3:type="locator">
Section 1798.105 of the
<ns0:DocName>Civil Code</ns0:DocName>
is amended to read:
</ns0:ActionLine>
<ns0:Fragment>
<ns0:LawSection id="id_44406243-1F5A-448C-BABD-D002F48D69F7">
<ns0:Num>1798.105.</ns0:Num>
<ns0:LawSectionVersion id="id_EB777D7B-4366-46F8-B462-81B607312E4F">
<ns0:Content>
<html:p>Consumers’ Right to Delete Personal Information</html:p>
<html:p>
(a)
<html:span class="EnSpace"/>
A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s rights to request the deletion of the consumer’s personal information.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
A business that
receives a verifiable consumer request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records, notify any service providers or contractors to delete the consumer’s personal information from their records, and notify all third parties to whom the business has sold or shared the personal information to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal
information remains deleted from the business’s records and is not being used for any other purpose.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
The business may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a consumer who has submitted a deletion request from being sold, for compliance with laws or for other purposes, solely to the extent permissible under this title.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
A service provider or contractor shall cooperate with the business in responding to a verifiable consumer request, and at the direction of the business, shall delete, or enable the business to delete and shall notify any of its own service providers or contractors to delete personal information about the consumer collected, used, processed, or retained by the service provider or the contractor. The service provider or contractor shall notify any service providers, contractors, or third parties who may have accessed personal information from or through the service provider or contractor, unless the information was accessed at the direction of the business, to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort. A service provider or contractor shall not be required to comply with a deletion request submitted by the consumer directly to the service provider or contractor to the extent that the service provider or contractor has
collected, used, processed, or retained the consumer’s personal information in its role as a service provider or contractor to the business.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
A business, or a service provider or contractor acting pursuant to its contract with the business, another service provider, or another contractor, shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is reasonably necessary for the business, service provider, or contractor to maintain the consumer’s personal information in order to:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer, or reasonably anticipated by the consumer within the context of a business’ ongoing business relationship with the
consumer, or otherwise perform a contract between the business and the consumer.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Debug to identify and repair errors that impair existing intended functionality.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
</html:p>
<html:p>
(5)
<html:span class="EnSpace"/>
Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
</html:p>
<html:p>
(6)
<html:span class="EnSpace"/>
Engage in public or peer-reviewed
scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’ deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.
</html:p>
<html:p>
(7)
<html:span class="EnSpace"/>
To enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.
</html:p>
<html:p>
(8)
<html:span class="EnSpace"/>
Comply with a legal obligation.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:Fragment>
</ns0:BillSection>
<ns0:BillSection id="id_A997B185-F380-4129-A4D7-4453CFFD0058">
<ns0:Num>SEC. 2.</ns0:Num>
<ns0:ActionLine action="IS_AMENDED" ns3:type="locator" ns3:href="urn:caml:codes:CIV:caml#xpointer(%2Fcaml%3ALawDoc%2Fcaml%3ACode%2Fcaml%3ALawHeading%5B%40type%3D'DIVISION'%20and%20caml%3ANum%3D'3.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'PART'%20and%20caml%3ANum%3D'4.'%5D%2Fcaml%3ALawHeading%5B%40type%3D'TITLE'%20and%20caml%3ANum%3D'1.81.5.'%5D%2Fcaml%3ALawSection%5Bcaml%3ANum%3D'1798.130.'%5D)" ns3:label="fractionType: LAW_SECTION">
Section 1798.130 of the
<ns0:DocName>Civil Code</ns0:DocName>
is amended to read:
</ns0:ActionLine>
<ns0:Fragment>
<ns0:LawSection id="id_CE85D860-6DB6-4F69-95D9-F9BCF5A9D5CC">
<ns0:Num>1798.130.</ns0:Num>
<ns0:LawSectionVersion id="id_D507F3BF-70A7-48EA-A43E-4305AF9FBB52">
<ns0:Content>
<html:p>Notice, Disclosure, Correction, and Deletion Requirements</html:p>
<html:p>
(a)
<html:span class="EnSpace"/>
In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
(A)
<html:span class="EnSpace"/>
Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall
be required to provide an email address and make an online method, such as a web form or online portal, for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
(A)
<html:span class="EnSpace"/>
Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete
a consumer’s personal information, based on the consumer’s request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’ duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumer’s request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer
does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
The disclosure of the required information shall cover the 12-month period preceding the business’ receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (8) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the
12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumer’s right to request required information beyond the 12-month period, and a business’ obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
(A)
<html:span class="EnSpace"/>
A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumer’s authorized agent, pursuant
to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business’ response to a verifiable consumer request, including, but not limited to, by providing to the business the consumer’s personal information in the service provider or contractor’s possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100,
taking into account the nature of the processing.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
For purposes of subdivision (b) of Section 1798.110:
</html:p>
<html:p>
(i)
<html:span class="EnSpace"/>
To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
</html:p>
<html:p>
(ii)
<html:span class="EnSpace"/>
Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumer’s personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumer’s personal information; and the categories of third parties to whom the business
discloses the consumer’s personal information.
</html:p>
<html:p>
(iii)
<html:span class="EnSpace"/>
Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
For purposes of subdivision (b) of Section 1798.115:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
Identify the
consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumer’s personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
Identify by category or
categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumer’s personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
</html:p>
<html:p>
(5)
<html:span class="EnSpace"/>
Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on
its internet website, and update that information at least once every 12 months:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
A description of a consumer’s rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
For purposes of subdivision (c) of Section 1798.110:
</html:p>
<html:p>
(i)
<html:span class="EnSpace"/>
A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
</html:p>
<html:p>
(ii)
<html:span class="EnSpace"/>
The categories of sources from which consumers’ personal information is collected.
</html:p>
<html:p>
(iii)
<html:span class="EnSpace"/>
The business or commercial purpose for collecting, selling, or sharing consumers’ personal information.
</html:p>
<html:p>
(iv)
<html:span class="EnSpace"/>
The categories of third parties to whom the business discloses consumers’ personal information.
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
</html:p>
<html:p>
(i)
<html:span class="EnSpace"/>
A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers’ personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
</html:p>
<html:p>
(ii)
<html:span class="EnSpace"/>
A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers’ personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
</html:p>
<html:p>
(6)
<html:span class="EnSpace"/>
Ensure that all individuals responsible for handling consumer inquiries about the business’ privacy practices or the business’ compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
</html:p>
<html:p>
(7)
<html:span class="EnSpace"/>
Use any personal information collected from the
consumer in connection with the business’ verification of the consumer’s request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) of Section 1798.140 and by describing the categories of
sensitive personal information using the specific terms set forth in subparagraphs (A) to (F), inclusive, of paragraph (1), and subparagraphs (A) to (C), inclusive, of paragraph (2), of subdivision (ae) of Section 1798.140.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:Fragment>
</ns0:BillSection>
<ns0:BillSection id="id_8969614F-6F00-40BD-8636-FB612E267AE2">
<ns0:Num>SEC. 3.</ns0:Num>
<ns0:Content>
<html:p>The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.</html:p>
</ns0:Content>
</ns0:BillSection>
</ns0:Bill>
</ns0:MeasureDoc>