What would SB 923 change if enacted?

CalPrivacy and Venable describe an expansion of the CCPA deletion right to personal information collected from or about the consumer, including third-party or indirect sources, plus an online request method (such as a webform) for online-only businesses with a direct consumer relationship. Venable says that if signed, SB 923 would take effect January 1, 2027. Confirm the enrolled text.

What is California DROP for data brokers?

DROP is CalPrivacy’s Delete Request and Opt-out Platform. The agency’s data-broker page says consumers could submit requests from January 2026 and that data brokers must begin processing DROP requests by August 1, 2026, at least once every 45 days under current rules. A later bill (AB 883) would change some DROP timelines if signed—do not treat that as law here.

Which state privacy laws took effect January 1, 2026?

Secondary trackers (for example TrustArc) describe comprehensive consumer privacy laws in Indiana (INCDPA), Kentucky (KCDPA), and Rhode Island (RIDTPPA) as effective January 1, 2026. Those statutes have their own thresholds. They are background for local advertisers—not a claim that every C-store is a “controller.”

Do Indiana, Kentucky, and Rhode Island require Global Privacy Control?

Industry explainers generally treat IN, KY, and RI as laws that do not mandate honoring a universal opt-out signal such as GPC, unlike California and several other states. Do not assume a GPC banner on a local landing page satisfies every state. Check the statute that applies to you.

Does CCPA apply to a local DOOH advertiser?

This post does not claim you are covered or CCPA-exempt. Coverage depends on the business thresholds and facts in the statute. Running a video on a public store screen does not, by itself, answer that question. Ask counsel.

Do public screen ads collect personal information?

A same-creative checkout or ATM loop typically does not need a shopper login. Instant Ads collect what the QR flow needs to fulfill a paid play (for example a photo and payment). Landing pages, pixels, and retargeting attached to a QR are a different data map. Do not hide that distinction.

What should local advertisers do while SB 923 sits on the desk?

Do not rewrite your notices as if SB 923 is enacted. Map whether you buy data-broker audiences, honor deletion/opt-out where you are already obligated, and keep in-store creatives shared rather than personalized prices. Recheck LegInfo before you brief a client that the Governor has acted.

What would SB 923 change if enacted?

CalPrivacy and Venable describe an expansion of the CCPA deletion right to personal information collected from or about the consumer, including third-party or indirect sources, plus an online request method (such as a webform) for online-only businesses with a direct consumer relationship. Venable says that if signed, SB 923 would take effect January 1, 2027. Confirm the enrolled text.

What is California DROP for data brokers?

DROP is CalPrivacy’s Delete Request and Opt-out Platform. The agency’s data-broker page says consumers could submit requests from January 2026 and that data brokers must begin processing DROP requests by August 1, 2026, at least once every 45 days under current rules. A later bill (AB 883) would change some DROP timelines if signed—do not treat that as law here.

Which state privacy laws took effect January 1, 2026?

Secondary trackers (for example TrustArc) describe comprehensive consumer privacy laws in Indiana (INCDPA), Kentucky (KCDPA), and Rhode Island (RIDTPPA) as effective January 1, 2026. Those statutes have their own thresholds. They are background for local advertisers—not a claim that every C-store is a “controller.”

Do Indiana, Kentucky, and Rhode Island require Global Privacy Control?

Industry explainers generally treat IN, KY, and RI as laws that do not mandate honoring a universal opt-out signal such as GPC, unlike California and several other states. Do not assume a GPC banner on a local landing page satisfies every state. Check the statute that applies to you.

Does CCPA apply to a local DOOH advertiser?

This post does not claim you are covered or CCPA-exempt. Coverage depends on the business thresholds and facts in the statute. Running a video on a public store screen does not, by itself, answer that question. Ask counsel.

Do public screen ads collect personal information?

A same-creative checkout or ATM loop typically does not need a shopper login. Instant Ads collect what the QR flow needs to fulfill a paid play (for example a photo and payment). Landing pages, pixels, and retargeting attached to a QR are a different data map. Do not hide that distinction.

What should local advertisers do while SB 923 sits on the desk?

Do not rewrite your notices as if SB 923 is enacted. Map whether you buy data-broker audiences, honor deletion/opt-out where you are already obligated, and keep in-store creatives shared rather than personalized prices. Recheck LegInfo before you brief a client that the Governor has acted.

State Privacy Laws 2026 for Local Advertisers: SB 923 on the Desk, DROP Live

Q: Is California SB 923 law in 2026?

Not in this article. CalPrivacy announced on August 28, 2026 that the Legislature approved the Expanding Privacy Rights Act (SB 923) and that it would go to the Governor. California LegInfo lists the bill as enrolled August 30 and presented to the Governor on September 2, 2026, still in the Governor’s house location. Do not say it is signed.

At a Glance

The 2026 privacy headline for California local advertisers is status, not a signed statute.

On August 28, 2026, the California Privacy Protection Agency (CalPrivacy) said the Legislature had approved the Expanding Privacy Rights Act (SB 923) and that the bill would go to the Governor. California LegInfo lists it as a non-urgency enrolled bill, enrolled August 30, 2026, presented to the Governor on September 2, 2026, house location Governor. As of this writing we do not treat SB 923 as signed law.

Venable (September 4, 2026) confirms the same desk status and says that if signed, SB 923 would take effect January 1, 2027. Venable also lists companion privacy and AI bills on the same desk. This slug stays on SB 923 + DROP. It is not a full California privacy roundup.

Meanwhile, CalPrivacy’s DROP for data brokers page says data brokers must begin processing deletion requests August 1, 2026. That program is live in a way SB 923 is not.

Indiana, Kentucky, and Rhode Island comprehensive privacy laws are widely described as effective January 1, 2026. They are background, not a claim that a two-store advertiser is automatically in scope.

This is a practitioner briefing for US local screen advertisers and hosts—not legal advice. Do not write “CCPA-exempt” in a media kit because you booked a C-store loop.

Who This Is For

Audience	Why this briefing matters
Local brands and agencies	Deletion and opt-out duties follow your data map, not the fact that a video played in a store.
Hosts	Shared creatives stay media. Loyalty, cameras, and QR pixels are where privacy work shows up.
Anyone buying broker audiences	DROP is the live California data-broker track.
Not for	A declaration that SB 923 is law, or that DOOH is outside every state statute.

Planned flights: self-serve. QR minutes: Instant Ads. Personalized prices are a different pile: retail media privacy on in-store screens.

SB 923: On the Governor’s Desk

CalPrivacy’s August 28 release describes the bill’s intent in plain language:

Today’s CCPA deletion right, as CalPrivacy describes it, does not require a business to delete personal information collected from a third party.
SB 923 would let Californians ask a business to delete covered personal information collected about them regardless of how the business collected it (subject to existing CCPA exemptions).
CalPrivacy says the language mirrors deletion approaches in Delaware, Indiana, Maryland, and New Jersey, and that businesses could retain a suppression list so deleted information stays deleted.
Online-only businesses with a direct relationship to the consumer would need an online method (CalPrivacy names a webform) for access, deletion, and correction requests—not email-only.

Venable’s September 4 note phrases the deletion expansion as information collected “from or about” the consumer, including third-party or indirect sources, and repeats the extra online request method. It also states the January 1, 2027 effective date if signed.

LegInfo’s last history row in the page we checked: September 2, 2026 — enrolled and presented to the Governor at 3 p.m. Recheck that page before you tell a client the bill was signed or vetoed.

Do not say signed. Do not implement “SB 923 workflows” as if they are already obligatory. Non-urgency plus Venable’s January 1, 2027 line is the planning assumption if it becomes law—not a promise of enactment.

DROP Is Already a Data-Broker Calendar

DROP lets California residents submit one deletion request to active data brokers. CalPrivacy’s page, as fetched for this draft, states:

Consumers could submit DROP requests from January 2026.
Data brokers must begin processing requests August 1, 2026.
Processing cadence described there: at least once every 45 days (download lists, match, report status).
Registration and daily penalty figures appear on that page ($200/day registration failure; $200/day per deletion request for processing failures). Use the live page for current fees and fine text.

If you are a data broker under Civil Code § 1798.99.80, DROP is operational homework. If you buy segments from brokers, ask vendors how they handle DROP matches. If you only run a same-creative store loop and never touch broker files, do not invent a DROP obligation.

Venable describes AB 883 as a possible shortening of DROP access/processing from 45 days to 30 days if signed, with a January 1, 2027 effective date and some provisions later. Do not treat AB 883 as law in this post.

January 2026 Background: Indiana, Kentucky, Rhode Island

TrustArc’s 2026 note describes three comprehensive laws effective January 1, 2026:

Indiana Consumer Data Protection Act (INCDPA)
Kentucky Consumer Data Protection Act (KCDPA)
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

TrustArc summarizes familiar controller-style rights (access, correction, deletion, opt-out of sale / targeted advertising) and different thresholds (Indiana and Kentucky described as 100,000 consumers or 25,000 plus 50% revenue from data sales; Rhode Island described as a lower 35,000 / 10,000-with-revenue-percentage test). Those summaries are secondary. The statutes control.

Industry GPC explainers generally list IN, KY, and RI among states that do not require honoring a universal opt-out mechanism, while California and several other states do. That is a signal-recognition distinction—not permission to ignore manual opt-outs where a law already applies.

Do not tell a local HVAC advertiser they “must honor GPC in Kentucky” or “never honor GPC in Kentucky” from this blog. Use it as a reminder that 2026 added more state laws, and that thresholds exist.

What This Means for Local Screen Campaigns

Local DOOH is mostly venue-level media: a video on a checkout or ATM that everyone in front of the glass can see. Privacy work shows up at the edges.

Practice	Privacy-shaped question
Same-creative self-serve flight	Usually a media booking. Still mind landing-page pixels if the creative sends people online.
Instant Ads QR	You collect what the flow needs (photo, payment, device). Moderate UGC. Do not add silent tracking the buyer did not expect.
Retargeting from a store QR	That is website/app data, not “the screen watched you.” Follow the rules that already apply to that site.
Buying data-broker audiences to “match” walk-ins	DROP and broker contracts matter. Do not pretend a public loop is the collection event.
Personalized shelf or app prices	Wrong article—see surveillance pricing vs screen ads.

Practical list for a local advertiser this month:

Recheck SB 923 status on LegInfo before any “new CCPA deletion” client memo.
Do not claim CCPA-exempt because you are small, local, or “just DOOH.”
Map vendors (agency, DSP, broker, payment, Instant flow).
Keep in-store creatives shared. Personalized prices are a different legal product.
Honor existing opt-outs you already owe under laws that already apply to you.
If you are a broker, follow the live DROP page—not a blog cadence.
Book screens the ordinary way: self-serve for flights, Instant for minutes. No invented CPM.

What This Article Is Not

Not a statement that SB 923 is signed.
Not a full list of 2026 California privacy bills. Venable’s companions stay off this slug.
Not legal advice and not a coverage determination.
Not a claim that Take 10 or its advertisers are CCPA-exempt.
Not a rate card and not a GSC or impression statistic.

Sources

CalPrivacy — California Legislature Advances Bill to Strengthen Deletion Rights (August 28, 2026; SB 923 to the Governor).
California LegInfo — SB-923 bill status (enrolled August 30, 2026; presented to the Governor September 2, 2026; non-urgency).
Venable — State Quick Hits: California Privacy Law Update (September 4, 2026; desk status; January 1, 2027 if signed).
CalPrivacy — DROP for data brokers (processing from August 1, 2026).
TrustArc — New in 2026: state privacy laws in Indiana, Kentucky, and Rhode Island (January 1, 2026 effective dates; secondary summary).

Next Steps

Counsel and privacy leads should watch LegInfo for a signature or veto and read the enrolled text before changing deletion runbooks.

Media teams can keep booking shared C-store and ATM screens on self-serve and keep consumer QR moments on Instant Ads.