The Privacy Bills That Are Becoming Law in California

The 2025-2026 legislative session has officially concluded in California. Here is a recap of key privacy bills that made it out of the legislature and across the gubernatorial finish line, along with those that faltered in the final days of September.

• Senate Bill (SB) 690 becomes law but is unlikely to materially change the litigation landscape for California Invasion of Privacy Act website wiretap claims.
• SB 923 expands California Consumer Privacy Act (CCPA) deletion requests to include personal information that a business does not collect directly from the consumer.
• SB 354 imposes many CCPA-like requirements on insurance licensees and reinsurers.
• Assembly Bill (AB) 2246 is California's second try at the Age-Appropriate Design Code Act.
• Gavin Newsom vetoed AB 1542, which would have restricted sales of sensitive personal information under CCPA.

Becoming Law

SB Bill 690: The governor signed SB 690, one of the most-watched privacy bills this cycle, on its final day before him for review. SB 690 removes the private right of action for some claims under the California Invasion of Privacy Act's pen register/trap and trace provision, Cal. Penal Code § 638.51, by restricting enforcement to the California Attorney General for conduct occurring on a website or mobile application. It takes effect January 1, 2027. View a deeper discussion on SB 690.

SB 354: SB 354 amends California's Insurance Information and Privacy Protection Act to impose many CCPA-like requirements on insurance licensees, reinsurers and service providers – even with respect to personal information subject to the Gramm-Leach-Bliley Act, which is exempt from CCPA. Under the law, covered businesses must meet new standards for the processing and sharing of consumers' personal information, provide clear and conspicuous privacy notices, and honor consumers' rights to request access, correction, amendment or deletion of personal information held by the business. The law takes effect July 1, 2028.

SB 923: The governor signed SB 923, the Expanding Privacy Rights Act, which expands CCPA deletion rights to align California with requirements in other states. Specifically, the amended law allows state residents to request that a covered business delete not just personal information collected directly from the consumer, but also information obtained about the consumer from other sources, such as data brokers. The law also requires businesses that operate only online to provide consumers with an online method to submit requests to exercise their rights, not simply an email address. It takes effect January 1, 2027.

AB 2246: AB 2246 repeals and replaces the California Age-Appropriate Design Code Act (the Act), which was partially enjoined in court challenges. The revised Act applies to businesses that offer online services, products or features likely to be accessed by children under 18. Similar to laws passed in states such as Colorado, Virginia and Maryland, the new law requires those companies to take reasonable steps to prevent specified risks of harm to children, including implementing limits on profiling, restricting use of children's personal information, configuring appropriate privacy settings and prohibiting dark patterns. However, the new California law removes the requirement to conduct child-specific risk assessments, which had been criticized by California courts. The law takes effect January 1, 2027, subject to potential new legal challenges.

Vetoed

AB 1542: AB 1542 would have expanded protections in the CCPA around the sale of sensitive personal information, such as precise geolocation and biometric and health information. The CCPA presently requires covered businesses to provide consumers with an option to "limit" use of their sensitive personal information and opt out of the sale and sharing of all personal information. AB 1542 would have revised the Act to generally prohibit businesses and service providers from selling or sharing any sensitive personal information to a third party.

In his veto message, the governor cited potentially "unintended consequences if consumers are removed entirely from the decision process" around whether to restrict the disclosure of sensitive information. A similar ban on selling sensitive personal information was enacted in Maryland this year, and multiple states have banned the sale of precise geolocation data.