In a decisive blow to the shadowy $200 billion data brokerage industry, California enacted Senate Bill 923 on September 28, 2026, creating the United States' first comprehensive legal mechanism for cascading digital erasure.
Under existing provisions of the California Consumer Privacy Act (CCPA), residents could instruct online services to delete personal profiles, location breadcrumbs, and browsing history. However, once that data had been sold or syndicated to third-party data brokers, consumers were forced to submit hundreds of individual opt-out requests—an impossible logistical burden.
SB 923 radically restructures this dynamic. When a consumer submits a deletion request to any business operating in California, that entity is legally obligated to transmit a machine-readable deletion signal down its entire supply chain.
Data brokers who acquire consumer records downstream must permanently scrub those identifiers from their databases within 45 days. Crucially, the legislation explicitly defines commercial datasets utilized for training generative AI foundation models, embedding vectors, and Retrieval-Augmented Generation (RAG) pipelines as covered commercial records.
Failure to comply carries statutory penalties of up to $2,500 per consumer record per day of violation, enforced directly by the California Privacy Protection Agency (CPPA).
Because maintaining separate technological pipelines for California users versus other jurisdictions is commercially infeasible, legal analysts predict SB 923 will effectively force global data brokers to adopt automated deletion architectures nationwide.