California Governor Gavin Newsom has signed a law that lets consumers make businesses delete personal information bought or received from someone else, not just what the business collected directly. SB 923, the Expanding Privacy Rights Act, was signed on September 27 and takes effect January 1, 2027, according to the California Privacy Protection Agency, which sponsored it.
In the same few days, Newsom vetoed a ban on selling sensitive personal data, and the IAB opened comment on a standard contract for measurement and attribution vendors. None of the three changes an ad platform setting. All three land on the customer data stack and the contracts around it.
California's deletion right now reaches enriched data
Under the CCPA as written today, a business does not have to delete personal information it obtained from a third party rather than from the consumer. SB 923 rewrites the deletion right in Civil Code section 1798.105(a) to cover information the business "has collected from or about the consumer," which brings in data from brokers and other outside sources (CalPrivacy; Senator Josh Becker). It also requires businesses that operate only online to offer a web form or portal, alongside an email address, for access, correction and deletion requests.
What it changes: a CDP or CRM that merges first-party profiles with purchased demographic, firmographic or intent data will hold deletable data on both sides of the record. Marketing operations teams should map which profile fields came from outside vendors, confirm that a deletion request reaches those fields and any audiences already synced to ad platforms, and check whether enrichment contracts let them trace a record back to its supplier. The effective date is three months away.
The sensitive-data ban was vetoed, and the existing rules stand
AB 1542 would have replaced the CCPA's opt-out standard for sensitive personal information with a broad prohibition on selling or sharing it (Kelley Drye). The category covers precise geolocation, health information, racial or ethnic origin, biometric data and more (bill text). Consumer Reports backed the bill. Newsom vetoed it, writing that state law already requires companies to let consumers limit sharing of that information and warning of unintended consequences if consumers were removed from the decision entirely (Consumer Reports; MediaPost).
Advertising trade groups had pressed for that outcome. The Network Advertising Initiative wrote to Newsom on September 9 urging a veto, and proposed an opt-in consent standard for sensitive data instead of a ban (NAI).
What it changes: less than the headline suggests. The veto keeps current obligations in place; it does not relax them. Teams running location-based or health-adjacent targeting in California still have to honor requests to limit use of sensitive data. The more useful detail is that the ad industry's own trade body named opt-in consent as its preferred alternative to a ban. Teams planning consent flows for sensitive categories now have a documented industry position to design against, not only the legal minimum.
IAB drafts standard terms for measurement and attribution contracts
On September 22, the IAB released the Measurement Services Addendum v1.0 for public comment (IAB). It is a template contract for any company that provides, buys or uses advertising measurement, verification, attribution or analytics services. The package pairs the addendum with General Terms v1.1 and a definitions appendix. The IAB says the aim is to reduce contract fragmentation and shorten negotiations, and the framework does not prescribe a measurement methodology (The Desk).
The same day, IAB Tech Lab released AAMP 3.0, which adds a specification called OpenProposal. It gives sellers a standard, machine-readable format for describing ad products and answering briefs, so buyer-side AI agents can compare and negotiate proposals (IAB Tech Lab; MediaPost).
What it changes: nothing is binding yet. The measurement addendum does give marketing teams a reference point. Anyone renewing an attribution or analytics vendor this quarter can read the draft terms against their current contract and see which questions their own agreement leaves unanswered. It is not yet clear how many measurement providers will accept the terms as written, and a template only helps if both sides are willing to start from it.
What to watch next
Comment periods for both the Measurement Services Addendum and AAMP 3.0 close on October 22, 2026. SB 923 takes effect on January 1, 2027. Any CalPrivacy guidance before that date on how the expanded deletion right applies to enriched records would show data teams how strictly the agency intends to read it.
Sources
- California Privacy Protection Agency. "California Expands Privacy Protections by Strengthening Deletion Rights." 2026. http://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights/
- Office of Senator Josh Becker. "As Data Privacy Week Continues, Becker Moves to Expand Californians' Right to Delete Their Personal Data." 2026. https://sd13.senate.ca.gov/news/press-release/january-30-2026/data-privacy-week-continues-becker-moves-to-expand-californians
- California Legislature. "AB-1542 Sensitive personal information." 2026. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1542
- Kelley Drye & Warren. "California's 2026 Legislative Session Wraps." 2026. https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/californias-2026-legislative-session-wraps-a-wave-of-privacy-and-ai-bills-reaches-the-governor-with-key-child-safety-and-ai-measures-signed-into-law
- Consumer Reports. "California governor vetoes bill banning the sale of sensitive consumer data." 2026. https://advocacy.consumerreports.org/press_release/california-governor-vetoes-bill-banning-the-sale-of-sensitive-consumer-data/
- MediaPost. "Newsom Vetoes Ban On Sharing Sensitive Data." 2026. https://www.mediapost.com/publications/article/418344/newsom-vetoes-ban-on-sharing-sensitive-data.html
- Network Advertising Initiative. "NAI Urges Governor Newsom to Veto AB 1542, Calling for Opt-In Consent Standard Instead." 2026. https://thenai.org/nai-urges-governor-newsom-to-veto-ab-1542-calling-for-opt-in-consent-standard-instead/
- IAB. "IAB Releases Measurement Services Addendum v1.0 for Public Comment." 2026. https://www.iab.com/news/iab-releases-measurement-services-addendum-for-public-comment/
- The Desk. "IAB releases measurement services contract framework for public comment." 2026. https://thedesk.net/2026/09/iab-measurement-services-framework-public-comment-period/
- IAB Tech Lab. "IAB Tech Lab Introduces AAMP 3.0 with OpenProposal." 2026. https://iabtechlab.com/press-releases/iab-tech-lab-introduces-aamp-3-0-with-openproposal/
- MediaPost. "Tech Lab Proposes RFP-To-Buy Process For Agentic Ads, Seeks Comment." 2026. https://www.mediapost.com/publications/article/418182/tech-lab-proposes-rfp-to-buy-process-for-agentic-a.html