Law / United States / 
California
AB 2561 (2026), operating system and application privacy settings
AB 2561 (Ch. 478, Stats. 2026), Cal. Bus. and Prof. Code Sections 22710 and 22711
A data subject rights rule binding private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- If you provide an operating system, or an application that collects, processes or stores personal information about a user in California and offers privacy settings, do not undo a user's affirmative configuration of a privacy setting without the user's consent, except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding (Business and Professions Code Section 22711(a)).
- When you discontinue a service or application, stop collecting, using, retaining or sharing a user's personal information, or stop offering privacy options, make sure the change either complies with Section 22711(a) or maintains the current protections or increases privacy protection by reducing collection, use, sharing or retention (Section 22711(b)).
These lines are LexLint's reading of the law's text, as of .
What this law does
AB 2561 was chaptered on as Chapter 478 of the Statutes of 2026. It adds Chapter 23.1, commencing with Section 22710, to Division 8 of the Business and Professions Code. An operating system or an application may not undo a user's affirmative configuration of a privacy setting without the user's consent, except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding.
A privacy setting is any user-configurable option within an application's privacy, or similarly labeled, menu that governs the application's collection, use, sharing, disclosure, retention, or processing of the user's personal information.
An application is a software program, mobile app, or desktop app that collects, processes, or stores personal information about a user in the state and that provides privacy settings allowing the user to control the collection, use, sharing, or disclosure of that personal information.
The chapter does not prohibit a business from discontinuing services or applications, ceasing to collect, use, retain or share a user's personal information, or ceasing to offer privacy options, if the change complies with the chapter or maintains current protections or increases privacy protection.
Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for AB 2561 is .
When LexLint raises it
When your app profile says your app ships a mobile app or distributes a software product.