California

This chapter regulates AI auditors, meaning any person, partnership, or corporation that assesses an AI system or model on behalf of a third party, and does not impose duties on the AI system's own developer or deployer unless that developer or deployer also offers covered AI audit services to others.

Beginning January 1, 2029, a person may not offer, sell, or conduct a covered AI audit (an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law) unless registered with the Government Operations Agency, which must itself establish the AI Auditor Registry, fix registration fees, and stand up a misconduct-reporting mechanism no later than that same date.

An auditor who registers must give the agency its business name and contact information, a list of the California laws or regulations it audits under, any relevant certifications, a description of its services, and a standard operating procedure describing the standards it applies and the basis for its accuracy and reliability claims; the agency then publishes that registration information, including the list of laws audited under, on its own website.

A registered auditor may not conduct a covered AI audit of a system, process, control, assessment, or other subject matter it materially designed, developed, implemented, or operated for the auditee, and must otherwise maintain independence, objectivity, and competence throughout the engagement.

For each covered audit, the auditor must give the auditee a report covering the audit's scope and objectives, its results and the documentation behind them, each deficiency found and what could reasonably address it, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations and any material gaps in the evidence available, and a signed and dated statement that the audit met this chapter's requirements.

The auditor must retain the information it gave the auditee and the documentation behind its results for at least 10 years, display its registration number on advertising for its audit services, and may not retaliate against an employee who reports suspected noncompliance.

A licensed CPA or accounting firm performing the audit under applicable AICPA and California Board of Accountancy standards is deemed to satisfy the reporting and independence requirements without separately meeting every listed element, and a violation by such an accountant is referred to the California Board of Accountancy rather than handled solely by the agency.

Executive Order N-5-26 is an order of the Governor of California, dated March 30, 2026. Paragraph 1 has the Department of General Services and the Department of Technology submit recommendations to the Governor for new certifications that may be incorporated into state contracting processes.

The certifications would allow entities seeking to do business with the state to attest to and explain their policies and safeguards to protect public safety while preventing the misuse of their technologies. The Order names exploitation or distribution of illegal content such as child sexual abuse material and non-consensual intimate imagery, models that display harmful bias or lack governance to reduce the risk of such bias, and violation of civil rights and civil liberties.

Paragraph 2 has the State Chief Information Security Officer review any new designation of a company as a supply chain risk by the federal government. If the State Chief Information Security Officer concludes that the designation is improper, the Department of General Services and the Department of Technology will jointly issue guidance ensuring that departments and agencies can continue to easily procure from that company.

Paragraph 3 has the Government Operations Agency submit recommendations on reforms to contractor responsibility provisions, including suspension and ineligibility authorities. Paragraph 4 has the Government Operations Agency and the bodies it names publish a data minimization toolkit for departments and agencies with best practices, templates, special contract provisions and program review checklists.

Paragraph 5 has the Department of Technology issue best practice guidance for departments and agencies to appropriately watermark AI-generated or significantly manipulated images or video. The Order does not create any rights or benefits, substantive or procedural, enforceable at law or in equity against the State of California or any other person.

SB 813 was chaptered on 9 September 2026 and carries no urgency clause, so it takes effect on 1 January 2027 under California's default operative date.

It directs the California Government Operations Agency to develop, by January 1, 2028, application requirements, suspension and termination procedures, and designation criteria for independent verification organizations (IVOs), private AI auditors the agency designates as qualified to assess the risks posed by an AI system or model, but the chapter does not require any person, partnership, or corporation that develops, deploys, or operates an AI system or model to engage an IVO or undergo a covered AI audit.

A designated IVO must submit an annual report on its standards, methodology, governance, and conflicts of interest to the agency and the Legislature, starting no sooner than 12 months after its designation, and if an audit performed to the chapter's standards is later invoked in a civil action alleging that an AI system or model caused harm, the chapter makes it relevant to, but not conclusive of, that action.

California's Transparency in Frontier Artificial Intelligence Act (TFAIA) was added by SB 53, chaptered as Stats 2025 Chapter 138, and is effective 1 January 2026 per the code's own history note.

A large frontier developer (a frontier developer whose group had annual gross revenues over $500,000,000 in the preceding year) to write, implement and publish on its website a frontier AI framework describing how it defines and assesses catastrophic-risk thresholds for its frontier models (foundation models trained using more than 10^26 integer or floating-point operations) and applies mitigations, and to review that framework at least annually.

The framework must also describe the developer's cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties. Before or when deploying a new or substantially modified frontier model, every frontier developer must publish a transparency report with baseline model information, and a large frontier developer must add summaries of its catastrophic-risk assessments and any third-party evaluator involvement.

A large frontier developer must also transmit summaries of internal-use catastrophic-risk assessments to the Office of Emergency Services on a quarterly or agreed schedule, and every frontier developer must report a critical safety incident to the Office within 15 days of discovering it, or 24 hours if it poses an imminent risk of death or serious injury.

A frontier developer may not make a materially false or misleading statement about catastrophic risk or, for a large frontier developer, about its framework compliance, and a companion whistleblower chapter (Lab.

Code Section 1107 et seq.) bars a frontier developer from retaliating against a covered employee who reports a reasonable belief of catastrophic-risk danger or a TFAIA violation, arming that employee with a private civil action and attorney's fees, separate from the chapter's own civil penalty which the Attorney General alone may bring.

SB 1159 was chaptered on 30 September 2026 as Chapter 863 of the Statutes of 2026. A person shall not knowingly use artificial intelligence to falsely represent that a natural person appeared before, submitted information to, or otherwise engaged with a governmental agency.

For purposes of the California Public Records Act, the Bagley-Keene Open Meeting Act, the Brown Act, the Legislative Open Records Act, the Administrative Procedure Act, the California Coastal Act of 1976, and the California Environmental Quality Act, person, interested person, participant, member of the public, and similar terms do not include artificial intelligence systems, autonomous agents, or robots, whether physical or digital.

The Public Records Act provision does not prohibit a natural person from using artificial intelligence, autonomous agents, or robots to facilitate the person's own engagement with a governmental agency, including through the use of assistive technologies, provided the volume and frequency of the engagement are reasonably consistent with ordinary participation by a natural person.

A public agency may use a disclosure verification tool that meets the criteria of Business and Professions Code section 22757.2 to determine if artificial intelligence is present.

SB 1276 was chaptered on 10 September 2026 as Chapter 192 of the Statutes of 2026. It amends Sections 311.3 and 11165.1 of the Penal Code.

Section 311.3 makes a person guilty of sexual exploitation of a child if the person knowingly develops, duplicates, prints, downloads, streams, accesses through electronic or digital media, or exchanges any representation of information, data or image that contains or incorporates any film, filmstrip, or any digitally altered or artificial-intelligence-generated matter that depicts a person under 18 years of age engaged in an act of sexual conduct, knowing that the matter depicts such a person.

It is not necessary to prove that the matter is obscene to establish a violation. Subdivision (a) does not apply to the activities of law enforcement and prosecution agencies in the investigation and prosecution of criminal offenses, to legitimate medical, scientific or educational activities, or to lawful conduct between spouses.

It does not apply to an employee of a commercial film developer acting within the scope of employment and in accordance with the employer's instructions, provided the employee has no financial interest in the developer. It does not apply to matter that is unsolicited and is received without knowledge or consent through a facility, system or network over which the person or entity has no control.

A violation is punishable by a fine of not more than $2,000, by imprisonment in a county jail for not more than one year, or by both, and a person previously convicted of a violation of subdivision (a) or any section of the chapter is punished by imprisonment in the state prison.

Section 11165.1 is amended so that sexual exploitation under the Child Abuse and Neglect Reporting Act includes a person who knowingly develops, duplicates, prints, downloads, streams, accesses through any electronic or digital media, or exchanges digitally altered or artificial-intelligence-generated matter that depicts a person under 18 years of age engaged in an act of sexual conduct.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

AB 1836 was chaptered on 17 September 2024 as Chapter 258 of the Statutes of 2024. Civil Code Section 3344.1, as amended by AB 1836, is effective 1 January 2025 per the code's own history note.

A person who produces, distributes, or makes available the digital replica of a deceased personality's voice or likeness in an expressive audiovisual work or sound recording without prior consent from a person specified in subdivision (c) is liable to any injured party for the greater of $10,000 or the actual damages suffered by a person controlling the rights to the deceased personality's likeness.

A digital replica is a computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual that is embodied in a sound recording, image, audiovisual work, or transmission in which the actual individual either did not actually perform or appear, or did perform or appear but the fundamental character of the performance or appearance has been materially altered.

A digital replica may be used without consent in connection with news, public affairs, or sports broadcasts or accounts, for comment, criticism, scholarship, satire, or parody, as a representation of the individual as the individual's self in a documentary or in a historical or biographical manner, where the use is fleeting or incidental, or in an advertisement or commercial announcement for such a work.

The consent is exercisable by the person or persons to whom the right of consent has been transferred or, if no transfer has occurred, to whom it has passed under the section's succession rules.

The section also makes a person who uses a deceased personality's name, voice, signature, photograph, or likeness on or in products, merchandise, or goods, or for advertising or selling, without prior consent liable for damages, including the greater of $750 or the actual damages and the profits attributable to the use.

The section does not apply to the owners or employees of any medium used for advertising by whom an advertisement or solicitation in violation of the section is published or disseminated, unless it is established that they had knowledge of the unauthorized use. A successor in interest or licensee cannot recover damages for a use that occurs before it registers a claim of the rights with the Secretary of State.

No action may be brought for a use occurring after the expiration of 70 years after the death of the deceased personality.

AB 621 was chaptered on 13 October 2025 as Chapter 673 of the Statutes of 2025. Civil Code Section 1708.86, as amended by AB 621, is effective 1 January 2026 per the code's own history note.

A depicted individual has a cause of action against a person who creates and intentionally discloses digitized sexually explicit material portraying the individual, or intentionally discloses such material the person did not create, when the person knows or reasonably should know that the individual did not consent or was a minor when the material was created.

Digitized sexually explicit material is any portion of a visual or audiovisual work created or substantially altered through digitization, including an image, that shows the depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct. The cause of action also reaches a person who knowingly facilitates or recklessly aids or abets that conduct.

A deepfake pornography service is an internet website, mobile application, or other service the primary purpose of which is to create digitized sexually explicit material. A person that owns, operates, or controls a deepfake pornography service is treated as creating and intentionally disclosing the material and is presumed to have known that the depicted individual did not consent, unless the person produces evidence of the depicted individual's express written consent.

A person that provides a service that enables the ongoing operation of a deepfake pornography service is presumed to be in violation of the facilitation provision if a depicted individual or public prosecutor provides the person with evidence sufficient to demonstrate that it is providing services that enable the ongoing operation of a deepfake pornography service that engages in conduct that violates the section.

The presumption applies only if the person fails to take all necessary steps to stop providing those services within 30 days of receiving that evidence. A court may extend the 30 days if it finds that additional time is needed to conduct an ongoing law enforcement investigation or operation. A disclaimer in the material, or a statement by a deepfake pornography service that users are prohibited from generating such material without consent, is not a defense.

The section does not apply to conduct protected by federal law, including Section 230 of Title 47 of the United States Code. An internet service provider is not held liable under the section for the mere transmission, routing, or provision of access to third-party content over its network.

A prevailing depicted individual may recover an amount equal to the monetary gain made by the defendant from the creation and disclosure of the material, together with economic and noneconomic damages, including damages for emotional distress. On request, the plaintiff may instead recover statutory damages with respect to any one work of not less than $1,500 and not more than $50,000, increased to a maximum of $250,000 if the act was committed with malice.

A public prosecutor may bring a civil action to enforce the section. A prevailing public prosecutor is entitled to a civil penalty of $25,000 per violation, or $50,000 per violation for a violation committed with malice.

SB 1111 was chaptered on 30 September 2026 as Chapter 862 of the Statutes of 2026. Civil Code section 3344 makes a person who knowingly uses another's name, voice, signature, photograph, or likeness on products, merchandise, or goods, or for advertising or selling, without prior consent liable for the greater of $750 or the actual damages, plus the profits attributable to the use. SB 1111 provides that, for purposes of that section, a voice or likeness includes a digital replica.

A digital replica is a computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual in which the actual individual either did not actually perform or appear, or did perform or appear but the fundamental character of the performance or appearance has been materially altered.

SB 1111 also removed the rebuttable presumption that failure to obtain an employee's consent was not a knowing use where the employee's photograph or likeness appears incidentally in an advertisement or other publication. New Penal Code section 540 provides that, for any provision of the Penal Code in which false impersonation of another is a required element, including Sections 528.5, 529, and 530, false impersonation includes the use of a digital replica with the intent to impersonate another.

SB 867 was chaptered on 10 September 2026 as Chapter 189 of the Statutes of 2026. Section 22604.5 of the Business and Professions Code bars a person from manufacturing, selling or exchanging, possessing with intent to sell or exchange, or exposing or offering for sale or exchange to a retailer a toy that includes a companion chatbot. A toy is a physical product designed, marketed, or manufactured for use in play by children under 16 years of age.

A companion chatbot is an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user's social needs, and the definition excludes a bot used only for customer service or similar business purposes, a limited video game bot and a stand-alone voice-command speaker.

The act makes a violation subject to the same civil liability as a violation of the provisions applicable to operators of companion chatbots. A person who suffers injury in fact as a result of a violation of that chapter may recover injunctive relief, damages equal to the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs. The section remains in effect only until January 1, 2031, and is repealed on that date.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

AB 1883 was chaptered on 30 September 2026 as Chapter 853 of the Statutes of 2026. An employer shall not use a workplace surveillance tool that uses artificial intelligence on employees to recognize, or make inferences or predictions about, an individual's emotional state, or to collect neural data. Neural data is information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information.

An employer is a person or governmental entity that directly or indirectly employs or exercises control over the wages, hours, or working conditions of any person, and includes state and local government bodies and labor contractors. The prohibition does not stop an employer from using a workplace surveillance tool to ensure safety, or otherwise if it does not meet those specifications.

The Labor Commissioner may enforce the part, including by issuing a citation or filing a civil action, and a public prosecutor may also enforce it. An employer who violates the part may be subject to a penalty of up to $500 for each violation.

The part does not prohibit use of a workplace surveillance tool relating to the development of aircraft for use in the national airspace or of products or services for national security, military, space, or defense purposes, and only where the use is reasonably necessary to comply with a federal statute, federal regulation, or binding federal contract.

Article 11 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on 24 July 2025, approved by the Office of Administrative Law and filed with the Secretary of State on 22 September 2025, and effective 1 January 2026 per the Agency's own regulations page, governs a business's use of automated decisionmaking technology (ADMT) to make a 'significant decision' about a consumer, defined as a decision granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services.

A business using ADMT for a significant decision must give consumers a Pre-use Notice describing the use and the consumer's rights to opt out of and access information about that use (Section 7220), must let a consumer opt out of that use except where the business offers an appeal to a human reviewer empowered to overturn the decision or another listed exception applies (Section 7221), and must respond to a consumer's request to access ADMT with a plain-language explanation of the specified information about that use (Section 7222).

A business using ADMT for a significant decision before 1 January 2027 has until that date to come into compliance with this article; a business beginning such use on or after 1 January 2027 must already be in compliance. Confirmed against the Agency's own approved regulation text, which places the automated-decisionmaking-technology article at Sections 7200 to 7222, not the 7040-to-7057 range sometimes cited for it.

SB 503 was chaptered on 30 September 2026 as Chapter 857 of the Statutes of 2026. Developers and deployers of an AI clinical decision support system must make reasonable efforts to identify systems known or reasonably foreseeable to carry a risk of biased impacts in health programs or activities. Developers must make reasonable efforts to mitigate that risk.

Developers must also make available to deployers a statement of intended uses and risks and documentation of training data, evaluation, and recommended monitoring. Deployers must regularly monitor the systems and take reasonable and proportionate steps to mitigate the risk. A deployer is a health facility, clinic, physician's office, or office of a group practice. Compliance cannot be used as a defense to a claim of unlawful discrimination.

SB 1120 was chaptered on 28 September 2024 as Chapter 879 of the Statutes of 2024. Health and Safety Code Section 1367.01, as amended by SB 1120, is effective 1 January 2025 per the code's own history note. Insurance Code Section 10123.135, as amended by SB 1120, is effective 1 January 2025 per the code's own history note.

A health care service plan, including a specialized health care service plan, that uses an artificial intelligence, algorithm, or other software tool for utilization review or utilization management functions based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that does, must comply with Section 1367.01 and ensure that the tool meets the conditions of subdivision (k).

The tool must base its determination on the enrollee's medical or other clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in the enrollee's record, and must not base its determination solely on a group dataset.

The tool must not supplant health care provider decisionmaking, must not discriminate, directly or indirectly, against enrollees in violation of state or federal law, and must be fairly and equitably applied, including in accordance with applicable regulations and guidance of the federal Department of Health and Human Services.

The tool must be open to inspection for audit or compliance reviews, its performance, use, and outcomes must be periodically reviewed and revised to maximize accuracy and reliability, and disclosures about its use and oversight must appear in the plan's written policies and procedures.

Patient data must not be used beyond its intended and stated purpose, consistent with the Confidentiality of Medical Information Act and the federal Health Insurance Portability and Accountability Act, as applicable, and the tool must not directly or indirectly cause harm to the enrollee.

The tool must not deny, delay, or modify health care services based, in whole or in part, on medical necessity, and a determination of medical necessity may be made only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved.

Artificial intelligence means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. The subdivision applies to utilization review or utilization management functions that prospectively, retrospectively, or concurrently review requests for covered health care services.

Section 1367.01 itself binds a health care service plan and any entity with which it contracts for services that include utilization review or utilization management functions. A disability insurer, including a specialized health insurer, that uses such a tool, or contracts with or otherwise works through an entity that does, must comply with Insurance Code Section 10123.135 and ensure that the tool meets the parallel conditions of subdivision (j).

If the director determines that a health care service plan has failed to meet any other requirement of Section 1367.01, the director may assess administrative penalties by order for each failure. A person who willfully violates a provision of the chapter that contains Section 1367.01 is punishable on conviction by a fine of not more than $20,000, imprisonment, or both.

SB 574 was chaptered on 30 September 2026 as Chapter 858 of the Statutes of 2026. An attorney shall not delegate the practice of law to generative artificial intelligence.

An attorney who uses generative AI to assist in the practice of law must not enter confidential, personal identifying, and other nonpublic information into a generative AI system whose access to that information is not restricted to the attorney and persons authorized by the attorney under obligations to protect its confidentiality.

The attorney must take reasonable steps to verify the accuracy of generative AI outputs, including all case and statutory citations, and to correct any erroneous or hallucinated output in any material the attorney uses. The attorney must disclose the use of generative AI to the court for all documents submitted to the court, and consider whether to disclose its use if it is used to create content provided to the public.

A brief, pleading, motion, or other paper filed in any court shall not contain any citations that an attorney responsible for submitting it has not personally verified, including any citation provided by generative AI. An arbitrator shall not delegate any part of their decisionmaking process to any generative AI tool, and shall not rely on information generated by generative AI outside the record without making appropriate disclosures to the parties beforehand.

The Judicial Council must publicly revisit, and revise as necessary, Standard 10.80 of the California Standards of Judicial Administration to incorporate any necessary changes reflecting the further development of generative AI.

The Civil Rights Council's employment regulations on automated-decision systems were approved by the Office of Administrative Law on 27 June 2025, and the effective date of the regulations is 1 October 2025 per the Council's rulemaking page.

They amend the Council's Fair Employment and Housing Act regulations in Title 2 of the California Code of Regulations and add Section 11008.1, which defines an automated-decision system as a computational process that makes a decision or facilitates human decision making regarding an employment benefit.

It is unlawful for an employer or other covered entity to use an automated-decision system or selection criteria, including a qualification standard, employment test, or proxy, that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Act, subject to any available defense. An employer includes the State of California and any political or civil subdivision of it, counties, cities, local agencies and special districts.

Evidence, or the lack of evidence, of anti-bias testing or similar proactive efforts to avoid unlawful discrimination is relevant to any such claim or available defense. An employer or other covered entity must preserve employment records, including automated-decision system data, for four years.

A medical or psychological examination or a disability-related inquiry includes one administered through an automated-decision system, which may include a test, question, puzzle, game, or other challenge that is likely to elicit information about a disability.

AB 2602 was chaptered on 17 September 2024 as Chapter 259 of the Statutes of 2024, and Labor Code Section 927 is effective 1 January 2025 per the code's own history note.

A provision in an agreement between an individual and any other person for the performance of personal or professional services is unenforceable as it relates to a new performance, fixed on or after January 1, 2025, by a digital replica of the individual if the provision allows a digital replica of the individual's voice or likeness to be created and used in place of work the individual would otherwise have performed in person, the provision does not include a reasonably specific description of the intended uses of the digital replica, and the individual was not represented by legal counsel who negotiated the licensing of the digital replica rights or by a labor union whose collective bargaining agreement expressly addresses uses of digital replicas.

A missing description of intended uses does not make the provision unenforceable if the uses are consistent with the terms of the contract and the fundamental character of the photography or soundtrack as recorded or performed. A digital replica is a computer-generated, highly realistic electronic representation that is readily identifiable as the voice or visual likeness of an individual.

The section affects no other contract provision and states no penalty, regulator or cause of action; its consequence is that the covered provision cannot be enforced.

SB 947 was chaptered on 30 September 2026 as Chapter 859 of the Statutes of 2026. It bars an employer from relying solely on an automated decision system when making a disciplinary or termination decision. Where an employer primarily relies on the output of such a system, it must direct a human to corroborate the decision using the data behind the output or other supporting information. The employee is entitled to a written postuse notice.

On request, the employee is also entitled to a description of the employee's own data the system used. It also bars an employer from using such a system to prevent compliance with employment and civil rights laws, to infer an employee's protected status, or to predict and take adverse action against a worker for exercising legal rights. The Labor Commissioner enforces the part. An employer that violates it is subject to a civil penalty of $500 per violation. The part becomes operative on July 1, 2027.

SB 951 was chaptered on 30 September 2026 as Chapter 860 of the Statutes of 2026. An employer giving notice of a mass layoff, relocation, or termination caused in whole or in substantial part by an AI system or other automated technology replacing or automating employment positions must add the number, classification, and location of the affected layoffs, the job functions that will be automated, and the category of AI system or automating technology involved.

The notice must also carry the statement that it is for a technology displacement at the top. The Employment Development Department must publish a summary of these notices and a quarterly statewide summary of technology displacements. The act also directs the department to report to the Legislature by January 1, 2028 on artificial intelligence's effects on business hiring practices.

AB 489, Chapter 615 of the Statutes of 2025, added Sections 4999.8 and 4999.9 to the Business and Professions Code, effective January 1, 2026.

The use of a term, letter or phrase in the advertising or functionality of an AI or generative AI system, program, device or similar technology that indicates or implies that the care, advice, reports or assessments it offers are provided by a natural person who holds the appropriate license or certificate to practice as a health care professional is prohibited.

Any provision of the division that prohibits specified terms, letters or phrases implying a health care license without holding it is enforceable against a person or entity that develops or deploys a system or device that uses them in the advertising or functionality of an AI or generative AI system. Each use of a prohibited term, letter or phrase is a separate violation. A violation is subject to the jurisdiction of the appropriate health care professional licensing board or enforcement agency. The licensing board may pursue an injunction or restraining order as authorized by Section 125.5.

AB 1979 was chaptered on 30 September 2026 as Chapter 854 of the Statutes of 2026. A health facility, clinic, physician's office, or office of a group practice must take reasonable steps to ensure that a licensed health care provider keeps the ability to exercise independent professional judgment whenever care is informed by the output of a clinical decision support system.

Those providers may not use an AI tool, system, or device to independently perform a clinical function the law requires a licensed person to perform. A business that offers a health care chatbot to a consumer to manage the individual's information, or for diagnosis, treatment, or management of a medical condition, is deemed a provider of health care subject to the Confidentiality of Medical Information Act.

A violation of the clinical-function limits by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.

Chapter 2.13 of the Health and Safety Code, added by AB 3030 (Stats.

2024, Ch. 848) and effective 1 January 2025 per the code's own history note, requires a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications about clinical information to include, in each such communication, a disclaimer that it was generated by generative artificial intelligence and clear instructions for reaching a human health care provider.

The disclaimer's placement is format-specific: prominently at the start of a letter or email, displayed throughout an ongoing chat, video, or telehealth interaction, and spoken at the start and end of an audio interaction. Both duties fall away where a licensed or certified human health care provider reads and reviews the AI-generated communication before it is sent.

A violation by a licensed health facility or clinic is enforced through the same licensing-enforcement articles that already govern those facilities, and a violation by a physician falls under the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.

The duty reaches a 'health facility' as defined in Health and Safety Code Section 1250, a definition that expressly includes government-operated facilities such as a general acute care hospital operated by the State Department of Developmental Services, the Department of Corrections and Rehabilitation, or the Department of Veterans Affairs, so the duty is not limited to privately owned providers. Confirmed against leginfo's codified text of Section 1339.75.

A developer of a generative AI system made publicly available to Californians must post on its website, before making the system available and before any substantial modification, documentation describing the training data: a high-level summary of the datasets, their sources and owners, an approximate count and description of data points, whether the data includes copyrighted or personal information, and whether synthetic data generation was used.

The posting duty reaches systems first made publicly available on or after 1 January 2022, though it did not attach until the 1 January 2026 operative date, now past. This corrects the derived citation on record, Civil Code Section 22756 et seq., which does not exist in Civil Code; confirmed against leginfo, the correct codification is Title 15.2 (commencing with Section 3110), Sections 3110 and 3111.

Prohibits, with actual malice, distributing materially deceptive audio or visual election media depicting a candidate within 60 days of an election, intending to injure the candidate's reputation or deceive a voter, unless the distributor discloses that the media has been manipulated. AB 972 extended the original 1 January 2023 sunset to 1 January 2027, confirmed against FindLaw's codified-statute history note showing the section added by Stats. 2019, c. 493 (AB 730) and amended by Stats.

2022, c. 745 (AB 972), so the disclosure-exemption structure remains in force. This statute was not a party to the litigation that enjoined AB 2839 or struck down AB 2655. The 1 January 2020 effective date follows the standard non-urgency operative date for a bill approved 3 October 2019, and is independently corroborated by multiple contemporaneous legal-press sources (Davis Wright Tremaine, Akin Gump) describing AB 730 as having taken effect January 1, 2020.

Makes it unlawful to use a bot to communicate with a person in California with intent to mislead them about the bot's artificial identity, for the purpose of deceiving them to incentivize a commercial transaction or influence a vote. A safe harbor applies where the bot operator clearly and conspicuously discloses that the user is interacting with a bot.

No enacted amendment, repeal, or litigation affecting this statute was found; AB 410 (2025-2026 session), which would add AI-related definitions and tighten the disclosure duty to require upfront disclosure at first contact, was held under submission in the Senate Appropriations Committee as of 29 August 2025 and carried over to the 2026 session with no further enactment confirmed.

A covered provider must make a disclosure verification tool available at no cost to the user, one that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by the provider's generative AI system and that outputs any system provenance data detected in the content.

To the extent it is technically feasible, a covered provider must also include in that content a latent disclosure that names the provider, the system and its version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content, and that is permanent or extraordinarily difficult to remove or tamper with.

A covered provider is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. SB 1000 was chaptered on 30 September 2026 as Chapter 861 of the Statutes of 2026. It is an urgency statute and went into immediate effect.

SB 1000 deleted the user threshold from the definition of covered provider, replaced the term AI detection tool with disclosure verification tool, and deleted the requirement that a covered provider offer the user the option to include a manifest disclosure in content. A violator of the chapter is liable for a civil penalty of $5,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, and each day of violation is a discrete violation.

SB 1000 added Section 22757.4.1, which sets a civil penalty of $50,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, for a violation of Section 22757.3(d), and which is repealed on January 1, 2029. A covered provider shall not falsely represent that a generative AI system is designed to primarily function as assistive technology.

Before January 1, 2029, the chapter does not apply to a generative AI system that is designed to primarily function as assistive technology. Until 29 September 2026 the definition of covered provider carried a user-count threshold that the chapter no longer contains. AB 853 (2025) moved the chapter's operative date from 1 January 2026 to 2 August 2026.

AB 853 also added duties for large online platforms and GenAI hosting platforms from 1 January 2027 and for capture device manufacturers from 1 January 2028. AB 2713 was chaptered on 30 September 2026 as Chapter 856 of the Statutes of 2026. AB 2713 revised the duties and prohibitions applicable to a large online platform in Section 22757.3.1, which is operative on 1 January 2027.

Under AB 2713 a large online platform must detect whether any provenance data is embedded into, attached to, or otherwise associated with content distributed on the platform. It must provide a user interface that reliably indicates whether any system provenance data or digital signature associated with content identifies the content as generated or substantially altered by a GenAI system or captured by a capture device.

It must allow a user to inspect any system provenance data associated with the content in an easily accessible manner. The section does not require a large online platform to take any action with respect to provenance data, system provenance data, or digital signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body.

The version of the section that AB 853 enacted required a large online platform to detect only provenance data compliant with widely adopted specifications adopted by an established standards-setting body. The chapter is Chapter 25 (commencing with Section 22757) of Division 8 of the Business and Professions Code. A Section 22756 to 22756.6 range sometimes cited for the chapter does not exist.

Section 22757.1 defines a large online platform as a public-facing social media platform, file-sharing platform, mass messaging platform or stand-alone search engine that distributes content to users who did not create or collaborate in creating the content and that exceeded 2,000,000 unique monthly users during the preceding 12 months.

Section 22757.3.3, added by AB 853, requires a capture device manufacturer, for any capture device it first produced for sale in California on or after 1 January 2028, to provide a user the option to include a latent disclosure in captured content naming the manufacturer, the device name and version, and the time and date of creation or alteration, and to embed latent disclosures in captured content by default, only to the extent technically feasible and compliant with widely adopted specifications.

California's Companion Chatbot Safety and Accountability Act was added by SB 243, chaptered as Stats 2025 Chapter 677, and is effective 1 January 2026 per the code's own history note.

An operator of a companion chatbot platform, one providing an adaptive, human-like AI system capable of sustaining an emotionally or socially engaging relationship across multiple interactions, to issue a clear and conspicuous notification that the companion chatbot is artificially generated and not human whenever a reasonable person interacting with it could be misled otherwise.

An operator may not let a companion chatbot engage with users unless it maintains, and publishes on its website, a protocol for preventing the chatbot from producing suicidal-ideation, suicide, or self-harm content, including a crisis-service referral notification.

For a user the operator knows is a minor, Section 22602(c) requires the operator to disclose that the user is interacting with artificial intelligence, provide a break reminder by default at least every three hours, and take reasonable measures to keep the chatbot from producing sexually explicit visual material or urging the minor toward sexually explicit conduct.

The operator must also disclose, wherever a user can access the platform, that companion chatbots may not be suitable for some minors. SB 1119 was chaptered on 10 September 2026 as Chapter 190 of the Statutes of 2026. It amends Section 22602 to delete the provisions that apply to a user the operator knows is a minor.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for that amendment is January 1, 2027. It amends no other section of the companion chatbot chapter. Beginning 1 July 2027, an operator must report annually to the Office of Suicide Prevention on crisis-referral notifications issued and protocols in place.

A person who suffers injury in fact from a violation may bring a civil action for injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees and costs; the chapter excludes bots used only for customer service or internal business purposes, video-game bots limited to game-related replies, and stand-alone voice-command consumer devices that do not sustain a relationship across interactions. Confirmed against leginfo's chaptered bill text.

AB 1609 was chaptered on 28 September 2026 as Chapter 733 of the Statutes of 2026. A large private business is a business with more than $500,000,000 in gross annual revenue nationally that provides goods and services to customers.

Such a business shall not represent that a customer service chatbot is a human, and shall provide a clear and conspicuous disclosure that the chatbot is artificially generated and not human if a reasonable person interacting with it is likely to be misled to believe that the person is interacting with a human.

During at least its regular business hours it shall provide customers who require assistance with a simple customer service feature, on all platforms through which it provides customer service, that allows them to request to connect to a customer service agent.

It shall make a good faith effort to give a customer who makes that request either a connection to a customer service agent within 15 minutes or a specific appointment time within one business day at which an agent will call or connect with the customer.

It shall make a good faith effort to ensure that a customer is not placed on hold or made to wait for more than 15 minutes at any time after connection with an agent, and that cumulative hold or wait times or escalation queues do not exceed one hour total. A large private business that provides goods and services to customers in California through online platforms and has a telephonic customer service platform shall post its telephone number clearly and conspicuously on its internet website.

The chapter does not require a connection or response within 15 minutes if the request is made by electronic mail, a web-based contact form, or a voicemail message. The chapter does not apply to exclusive business lines, to a hospital's communications relating to health care services, to a consumer reporting agency, or to services provided under specified Public Utilities Commission general orders.

A public prosecutor may bring an action to enforce the chapter, a large private business that violates it is liable for a civil penalty not exceeding $5,000 for an initial violation and $10,000 for each subsequent violation, and the chapter establishes no private right of action. Use of commercially reasonable and practicable standards that are designed and intended to achieve compliance satisfies the good faith effort requirements.

An inability to comply that is due to unforeseen circumstances beyond the business's reasonable control, or to extraordinary or emergency situations, is not a violation. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

SB 1050 was chaptered on 16 September 2026 as Chapter 246 of the Statutes of 2026. It makes it unlawful to create and cause to be published in an advertising medium an advertisement that prominently includes a synthetic performer without a clear and conspicuous disclosure that the advertisement includes one.

A synthetic performer is a digital figure, voice, or representation created in whole or in part using generative AI that creates the realistic impression of a human performer who is not recognizable as any identifiable natural person. The disclosure must use wording substantially similar to "this performance features a synthetic performer" or "no human performer is depicted".

An advertising medium served with a court order finding a violation or enjoining the creator must remove or disable the advertisement and stop accepting payment for it. A violation constitutes a violation of Section 17500 and may be enforced under the Unfair Competition Law.

Labor Code section 1051 makes it a misdemeanor for a person to require, as a condition of securing or retaining employment, that an employee or applicant be photographed or fingerprinted by anyone who wants the photograph or fingerprints to furnish to another employer or third person, where they could be used to the employee's or applicant's detriment.

Under Labor Code section 1052, a person who knowingly causes, suffers or permits an agent, superintendent, manager or employee to violate sections 1050 and 1051, or who fails to take all reasonable steps to prevent a violation, is guilty of a misdemeanor. Labor Code section 1054 makes a person who violates sections 1050 to 1052 liable to the aggrieved party in a civil action for treble damages. Labor Code section 1051 was last amended by Statutes 1987, chapter 77.

Under Labor Code section 1057, section 1051 does not apply to an employee of a diversified or nondiversified management company, or its affiliates, who is required to be fingerprinted pursuant to federal law. No day on which the sections came into force has been located.

Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach. As amended by SB 446 (signed October 3, 2025), the statute now fixes that duty at 30 calendar days, replacing the prior open-ended most-expedient-time-possible standard, and requires notice to the Attorney General within 15 days of consumer notification where a breach affects more than 500 California residents.

Health and Safety Code section 1280.15 requires a clinic, health facility, home health agency or hospice licensed under the Code to prevent unlawful or unauthorized access to, and use or disclosure of, patients' medical information.

Health and Safety Code section 1280.15 requires a licensed clinic, health facility, home health agency or hospice to report unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the department no later than 15 business days after detection.

Section 1280.15(b)(2) also requires the licensee to report it to the affected patient or the patient's representative no later than 15 business days after detection, and allows email only if the patient previously agreed in writing. Under section 1280.15(a), the department may assess an administrative penalty of up to $25,000 per patient whose medical information was unlawfully or without authorization accessed, used or disclosed, and up to $17,500 per subsequent occurrence.

Under section 1280.15(d), for a failure to report the department may assess a penalty of $100 for each day the access, use or disclosure is not reported after the initial 15-day period, and the combined penalty may not exceed $250,000 per reported event.

Section 1280.15(c)(1) requires a licensee to delay reporting to the patient when a law enforcement agency states that reporting would likely impede its investigation, for no more than 60 days after a written request or 30 days after an oral request. Section 1280.15 as currently in force was amended by Statutes 2025, chapter 21 (AB 116), effective June 30, 2025.

Article 9 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on July 24, 2025 and effective January 1, 2026, requires a business whose processing of personal information meets the CCPA's revenue-from-data-sales threshold, or its revenue threshold combined with processing the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers in the preceding calendar year, to complete a cybersecurity audit using a qualified, independent auditor, who may be internal or external to the business, and to submit a written certification of that completion to the Agency each year by April 1.

The underlying audit report is not filed with the Agency; the business and auditor must retain it for five years, and it goes only to an executive with direct responsibility for the cybersecurity program.

First certifications are due on a staggered schedule starting April 1, 2028 for businesses with 2026 annual gross revenue over $100 million, then April 1, 2029 for the $50 million to $100 million tier, and April 1, 2030 for smaller covered businesses, after which every covered business audits and certifies annually.

Article 4 of the CCPA Regulations governs service providers, contractors and third parties, beginning with section 7050 on service providers and contractors. Section 7051 of the CCPA Regulations requires the contract with a service provider or contractor to prohibit it from selling or sharing the personal information it collects under the contract.

Section 7051(a)(7) of the CCPA Regulations requires the contract to oblige the service provider or contractor to notify the business after it determines that it can no longer meet its obligations under the CCPA and the Regulations. Under section 7051(b) of the CCPA Regulations, a service provider or contractor that subcontracts must have a contract with the subcontractor that complies with the CCPA and the Regulations.

Section 7053 of the CCPA Regulations requires a business that sells or shares a consumer's personal information with a third party to enter into an agreement with the third party. Under section 7053(a)(2) of the CCPA Regulations, the third-party agreement must specify that the personal information is made available only for limited and specified purposes and require the third party to use it only for those purposes. The Agency's regulations became effective on March 29, 2023.

Article 2 of the CCPA Regulations governs required disclosures to consumers, beginning with an overview of the required disclosures in section 7010. Every business that must comply with the CCPA and the Regulations must provide a privacy policy. A business that controls the collection of a consumer's personal information from the consumer must provide a notice at collection.

The privacy policy must be posted online and reached through a conspicuous link using the word privacy on the business's website homepage or on the download or landing page of a mobile application. A mobile application must also include a link to the privacy policy in the application's settings menu. The notice at collection must be made readily available where consumers will encounter it at or before the point of collection of any personal information.

A business that sells or shares personal information must provide a notice of right to opt out of sale or sharing or the alternative opt-out link. A business that offers a financial incentive or price or service difference must provide a notice of financial incentive. The Agency's regulations became effective on March 29, 2023.

Section 7002(a) of the CCPA Regulations requires a business's collection, use, retention and sharing of a consumer's personal information to be reasonably necessary and proportionate to achieve the purpose for which it was collected or processed, or another disclosed purpose compatible with the context in which it was collected.

Under section 7002(b), the purpose for which personal information was collected or processed must be consistent with the reasonable expectations of the consumers whose personal information is collected or processed. Section 7003(a) requires disclosures and communications to consumers to be easy to read and understandable to consumers.

Section 7004(a) requires a business to design and implement methods for submitting CCPA requests and obtaining consumer consent that incorporate the principles it lists. Under section 7004(a)(2), the path for a consumer to exercise a more privacy-protective option may not be longer or more difficult or time-consuming than the path to exercise a less privacy-protective option.

Under section 7004(a)(5), a business may not add unnecessary burden or friction to the process by which the consumer submits a CCPA request or provides or withdraws consent. The Agency's regulations became effective on March 29, 2023.

Article 10 of the CCPA Regulations, sections 7150 to 7157, requires a business to conduct a risk assessment before it starts processing that presents significant risk to consumers' privacy. Selling or sharing personal information and processing sensitive personal information are among the activities that present significant risk.

The risk assessment must determine whether the risks to consumers' privacy from the processing outweigh the benefits to the consumer, the business, other stakeholders and the public. A business must review and update its risk assessments at least once every three years. A business must complete a risk assessment for processing it began before January 1, 2026 and continues after that day no later than December 31, 2027.

A business must retain its risk assessments for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later. For risk assessments conducted in 2026 and 2027, a business must submit the required information to the Agency no later than April 1, 2028. The Agency's amended regulations carry an effective date of January 1, 2026.

Section 7100(a) of the CCPA Regulations requires all individuals responsible for handling consumer inquiries about a business's information practices or its compliance with the CCPA to be informed of all of the requirements in the CCPA and the Regulations and how to direct consumers to exercise their rights. Section 7101(a) requires a business to maintain records of consumer requests made under the CCPA and how it responded to them for at least 24 months.

Section 7102(a)(1) requires a business that handles the personal information of 10,000,000 or more consumers in a calendar year to compile metrics on the requests it received, complied with and denied. Section 7102(a)(2) requires a business that handles that volume of personal information to disclose the metrics by July 1 of every calendar year within its privacy policy or on its website through a link in its privacy policy. The Agency's regulations became effective on March 29, 2023.

Governs private-sector for-profit businesses that meet the CCPA's revenue or data-volume threshold and determine the purposes and means of processing a California consumer's personal information. Duties run on a notice-and-purpose-limitation model rather than a consent-gated lawful basis, and are allocated among four defined roles: business, service provider, contractor, and third party.

The original CCPA (AB 375) became operative January 1, 2020; the California Privacy Rights Act (Proposition 24) substantially expanded it, and the amended law now in force became operative January 1, 2023. AB 1008 (2024) separately expanded the personal-information definition to reach data held in AI systems capable of outputting it.

AB 883 was chaptered on 27 September 2026 as Chapter 507 of the Statutes of 2026. It amends Section 1798.99.86 of the Civil Code and adds Section 1798.99.86.5 to it. It changes the 45-day period in the data broker's deletion duties to a 30-day period.

A data broker must access the California Privacy Protection Agency's accessible deletion mechanism at least once every 30 days and, within 30 days after receiving a request, process all deletion requests and delete all personal information related to the consumers making them. A data broker that denies a deletion request because it cannot be verified must process the request as an opt-out of the sale or sharing of the consumer's personal information within 30 days of receiving it.

After deleting a consumer's data, the data broker must delete all personal information of that consumer at least once every 30 days, unless the consumer requests otherwise or deletion is not required.

The Secretary of State, certain local government officials, the Judicial Council and the State Bar of California must notify state elected officials, local elected officials and judges, as applicable, that they may submit a request to delete their personal information through the accessible deletion mechanism.

The Attorney General, a county counsel or a city attorney may bring a civil action on behalf of a judge or elected official against a data broker that violates Section 1798.99.86 with respect to that person's personal information, for declaratory relief, injunctive relief, reasonable attorney's fees and actual damages.

A court may award punitive damages if it finds a data broker willfully violated Section 1798.99.86 with respect to the personal information of a notified judge or elected official. The provisions on notice and on civil actions for elected officials and judges become operative on July 1, 2027.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for the amendments to Section 1798.99.86 is January 1, 2027.

Article 3 of the Data Broker Registration and Accessible Deletion Mechanism Regulations concerns the Delete Request and Opt-out Platform requirements, beginning with account creation in section 7610. Section 7612(a) of the Data Broker Registration and Accessible Deletion Mechanism Regulations requires a data broker to access the DROP to download its selected consumer deletion lists at least once every 45 calendar days.

Under section 7613(a)(2) of the Regulations, a data broker must delete all personal information associated with the matched identifier for every match between a consumer deletion list and its own records. For deletion requests that match nothing in its records, a data broker must save and maintain the consumer deletion list for the sole purpose of complying with section 1798.99.86(d) of the Civil Code by comparing newly collected records with deletion lists.

Section 7614(a) of the Regulations requires a data broker to report the status of every deletion request, using a response code, at each subsequent access session. Section 7616(a) of the Regulations lets a data broker use consumer personal information provided by the Agency only to comply with section 1798.99.86 of the Civil Code, and bars selling or sharing it.

Section 7616(c) of the Regulations bars a data broker from contacting a consumer to verify a deletion request submitted through the DROP. Section 7611(a)(2) of the Regulations requires a business that begins operating as a data broker after the registration period to begin accessing the DROP within 45 calendar days of commencing operation. The Agency's page on the accessible deletion mechanism carries an effective date of January 1, 2026.

Article 1 of the Data Broker Registration and Accessible Deletion Mechanism Regulations concerns annual registration fees, beginning with the annual registration fee in section 7600. Section 7600 of the Data Broker Registration and Accessible Deletion Mechanism Regulations sets the annual fee to register as a data broker at $6,000 plus an associated third-party fee for processing electronic payments not to exceed 2.99%.

Under section 7601(k) of the Regulations, the registration period is January 1 through January 31 of each calendar year. Section 7602(a) of the Regulations requires a business that independently meets the definition of data broker for any period of time during the previous calendar year to register during the registration period and create a DROP account.

Section 7602(b) of the Regulations requires the person who registers the data broker to certify under penalty of perjury that the information submitted is true and correct. Under section 7604(a) of the Regulations, a data broker may not be removed from the public registry after the registration period closes, except where it was erroneously registered.

The Agency lists the consolidated Data Broker Registration and Accessible Deletion Mechanism Regulations with an effective date of January 1, 2026. The Agency's Data Broker Registration Regulations took effect on December 26, 2024.

A data broker is a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship, excluding an entity to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers it, or to the extent its processing is exempt under Civil Code section 1798.146.

Each data broker must register with the California Privacy Protection Agency on or before January 31 following each year in which it meets that definition, and pay a registration fee.

The registration states the broker's contact details; whether it collects minors' personal information, precise geolocation, biometric data, reproductive health care data and other listed categories; whether in the past year it shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (outside a subpoena or court order) or a developer of a generative artificial intelligence system or model; and a link to a page explaining how consumers exercise their California Consumer Privacy Act rights.

By July 1 each year, a data broker must also disclose in its privacy policy how many consumer-rights requests it received, complied with and denied in the previous calendar year, and the median and mean number of days it took to respond. A data broker that fails to register is liable in an administrative action by the Agency for a fine of $200 for each day, the fees due for that period and the Agency's expenses.

The title does not supersede or interfere with the operation of the California Consumer Privacy Act. An administrative action under it must be commenced within five years of the violation.

Beginning January 1, 2028, and every three years after, a data broker must undergo an audit by an independent third party to determine its compliance with section 1798.99.86, the deletion duties. The data broker must submit the report resulting from the audit, and any related materials, to the California Privacy Protection Agency within five business days of the Agency's written request, and keep them for at least six years.

Beginning January 1, 2029, the data broker's annual registration must say whether it has undergone the audit and, if so, the most recent year it submitted the report to the Agency. A data broker that fails to comply with section 1798.99.86 is liable in an administrative action by the Agency for the Agency's reasonable expenses of investigation and administration.

The California Privacy Protection Agency runs an accessible deletion mechanism through which a consumer, in a single verifiable request, can ask every data broker that holds their personal information to delete it. The Agency calls the mechanism the Delete Request and Opt-Out Platform (DROP).

Beginning August 1, 2026, a data broker must access the mechanism at least once every 45 days and, within 45 days of receiving a deletion request, delete all personal information related to the consumer and direct its service providers and contractors to delete it too.

A data broker need not delete information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require, and may use what it keeps only for that purpose. A request the data broker cannot verify is processed as an opt-out of the sale or sharing of the consumer's personal information.

After deleting a consumer's data, the data broker must delete that consumer's personal information again at least once every 45 days and may not sell or share new personal information about them, unless the consumer requests otherwise or an exemption applies. A data broker that fails to delete as required is liable in an administrative action by the Agency for a fine of $200 for each deletion request for each day, plus the Agency's expenses.

AB 2561 was chaptered on 27 September 2026 as Chapter 478 of the Statutes of 2026. It adds Chapter 23.1, commencing with Section 22710, to Division 8 of the Business and Professions Code. An operating system or an application may not undo a user's affirmative configuration of a privacy setting without the user's consent, except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding.

A privacy setting is any user-configurable option within an application's privacy, or similarly labeled, menu that governs the application's collection, use, sharing, disclosure, retention, or processing of the user's personal information.

An application is a software program, mobile app, or desktop app that collects, processes, or stores personal information about a user in the state and that provides privacy settings allowing the user to control the collection, use, sharing, or disclosure of that personal information.

The chapter does not prohibit a business from discontinuing services or applications, ceasing to collect, use, retain or share a user's personal information, or ceasing to offer privacy options, if the change complies with the chapter or maintains current protections or increases privacy protection.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for AB 2561 is January 1, 2027.

Civil Code section 1798.136 bars a business from developing or maintaining a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal. Section 1798.136(a)(2) requires the functionality to be easy for a reasonable person to locate and configure.

Section 1798.136(b) requires a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and its intended effect. Under section 1798.136(d), a browser business that includes the functionality is not liable for a violation of the title by a business that receives the signal. Civil Code section 1798.136 becomes operative on January 1, 2027. AB 566 was approved and chaptered on October 8, 2025 as Chapter 465 of the Statutes of 2025.

Section 7070(a)(1) of the CCPA Regulations requires a business that has actual knowledge that it sells or shares the personal information of a consumer less than 13 years of age to establish, document and comply with a reasonable method for determining that the person consenting is the child's parent or guardian. The parental consent required by section 7070(a)(1) is in addition to any verifiable parental consent required under COPPA.

Under section 7071(a), for a consumer at least 13 and less than 16 years of age whose personal information it has actual knowledge it sells or shares, a business must establish, document and comply with a reasonable process for allowing the consumer to opt in to the sale or sharing. Section 7072(a) requires a business subject to sections 7070 or 7071 to include a description of the processes in its privacy policy. The Agency's regulations became effective on March 29, 2023.

Article 3 of the CCPA Regulations governs business practices for handling consumer requests, beginning with the methods for submitting requests to delete, correct and know in section 7020. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information is required only to provide an email address for requests to delete, correct and know.

A business must confirm receipt of a request to delete, correct or know within 10 business days after receiving it. A business must respond to a request to delete, correct or know no later than 45 calendar days after receipt. A business that sells or shares personal information must process an opt-out preference signal that meets the section's format and disclosure requirements as a valid request to opt out of sale or sharing.

A business that collects personal information online and receives such a signal must treat it as a valid request to opt out for that browser or device and any consumer profile associated with that browser or device. A business may not require a consumer to provide information beyond what is necessary to send an opt-out preference signal. A notification or tool regarding cookies, such as a cookie banner, is not by itself an acceptable method for submitting requests to opt out of sale or sharing.

A business may not require a consumer to verify identity to make a request to opt out of sale or sharing, a request to limit, or a request to opt out of automated decisionmaking technology. A request to opt in after opting out must use a two-step opt-in process in which the consumer first clearly requests to opt in and then separately confirms the choice. The Agency's regulations became effective on March 29, 2023. The Agency's amended regulations carry an effective date of January 1, 2026.

Section 7200(b) of the CCPA Regulations requires a business that uses automated decisionmaking technology for a significant decision before January 1, 2027 to comply with the article on that technology no later than January 1, 2027.

Gives California consumers the right to know and access what personal information a business holds and its source, the right to delete it, the right to correct it, a right to a portable copy, and the right to opt out of the sale or sharing of their personal information to third parties, all exercisable against the business rather than directly against its service providers or contractors. A business may not discriminate against a consumer for exercising these rights.

A financial institution may not sell, share, transfer or otherwise disclose nonpublic personal information to or with a nonaffiliated third party without the explicit prior consent of the consumer to whom it relates, except as sections 4053, 4054.6 and 4056 provide. A financial institution is an institution whose business is engaging in the financial activities described in section 1843(k) of Title 12 of the United States Code and that does business in California.

An institution that is not significantly engaged in financial activities is not a financial institution. An institution primarily engaged in providing hardware, software or interactive services is not a financial institution, provided that it does not act as a debt collector and does not engage in activities for which it must acquire a charter, license or registration from a state or federal banking, insurance or securities agency.

A consumer is an individual resident of California, or that individual's legal representative, who obtains or has obtained from a financial institution a financial product or service to be used primarily for personal, family or household purposes. Personally identifiable financial information includes such information collected through an Internet cookie or an information collecting device from a Web server.

To obtain consent for disclosure to nonaffiliated third parties, a financial institution must use a separate document that is dated and signed by the consumer, clearly and conspicuously states that signing consents to the disclosure, that the consent remains in effect until revoked or modified, that it may be revoked at any time and how, and that the institution will keep a copy which the consumer may request.

A financial institution may not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer has not given consent to disclosure to a nonaffiliated third party.

A financial institution may not disclose or share a consumer's nonpublic personal information with an affiliate unless it has clearly and conspicuously notified the consumer annually in writing that the information may be disclosed to an affiliate and the consumer has not directed that it not be disclosed.

The United States Court of Appeals for the Ninth Circuit has narrowed the affiliate-sharing provision, section 4053(b)(1), to exclude the regulation of consumer report information as defined by the federal Fair Credit Reporting Act. The affiliate notice must be sent on the form the section sets out or on a form that meets the requirements listed in subparagraphs (A) to (L) of the section.

A consumer may direct at any time that nonpublic personal information not be disclosed, and a financial institution must comply with the direction within 45 days of receipt. A financial institution need not give the written notice if it does not disclose nonpublic personal information to any nonaffiliated third party or to any affiliate, except as the division allows.

For an affinity card issued in an affinity partner's name, the financial institution may disclose to the partner only the cardholder's name, address, telephone number and email address and a record of purchases made with the card in an establishment, including a Web site, bearing the partner's brand name, subject to the conditions in subdivision (c).

A financial institution may release nonpublic personal information without the consent or notice that sections 4052.5, 4053, 4054 and 4054.6 would otherwise require in the circumstances listed in section 4056, which include a release necessary to effect, administer or enforce a transaction requested or authorized by the consumer.

A release to an affiliate or nonaffiliated third party to perform services such as printing, mailing, data processing or analysis, or customer surveys on the institution's behalf is permitted if the services could lawfully be performed by the institution, a written contract bars other disclosure or use, the information is limited to what the services need, and the institution receives no payment from or through the recipient.

An entity that receives nonpublic personal information from a financial institution may not disclose it to any other entity unless the disclosure would be lawful if made directly by the financial institution, and a recipient under a section 4056 exception may use or disclose it only in the ordinary course of business to carry out the activity the exception covers.

An entity that negligently discloses or shares nonpublic personal information in violation of the division is liable for a civil penalty not to exceed $2,500 per violation, and not to exceed $500,000 in total where the release covers more than one individual. An entity that knowingly and willfully obtains, discloses, shares or uses nonpublic personal information in violation of the division is liable for a civil penalty not to exceed $2,500 per individual violation.

The civil penalties are doubled if a violation results in the identity theft of a consumer, as defined by section 530.5 of the Penal Code. The civil penalties are exclusively assessed and recovered in a civil action brought in the name of the People of California by the Attorney General or by the functional regulator with jurisdiction over the financial institution.

The division preempts and is exclusive of all local agency ordinances and regulations relating to the use and sharing of nonpublic personal information by financial institutions.

The Insurance Information and Privacy Protection Act sets standards for the collection, use and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents or insurance-support organizations.

For life or disability insurance, the article applies to those that collect, receive or maintain information in connection with insurance transactions that pertains to natural persons who are California residents, or that engage in insurance transactions with applicants, individuals or policyholders who are California residents.

For property or casualty insurance, the article applies to those that collect, receive or maintain information in connection with insurance transactions involving policies, contracts or certificates of insurance delivered, issued for delivery or renewed in California, or that engage in such transactions.

An insurance transaction is one involving insurance primarily for personal, family or household needs rather than business or professional needs that entails determining an individual's eligibility for coverage, a benefit or a payment, or servicing an insurance application, policy, contract or certificate. A health care service plan regulated under the Knox-Keene Health Care Service Plan Act is not an insurance institution.

The article does not apply to a title insurer, or to a home protection company that does not obtain or maintain personal information of its policyholders and applicants. Persons subject to the article are exempt from Part 2.6 of Division 1 of the Civil Code, which begins at section 56, and from Civil Code sections 1785.20 and 1786.40.

No insurance institution, agent or insurance-support organization may use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no generally or statutorily recognized privileged relationship with the person the information concerns.

An insurance institution or agent must give every applicant and policyholder a written notice of information practices, and may instead give an abbreviated notice that says the full notice will be furnished on request. For a written application, the notice is due at delivery of the policy when personal information is collected only from the applicant, an insured or public records, and otherwise when collection of personal information from another source begins.

An insurance institution or agent must clearly specify the questions designed to obtain information from an individual solely for marketing or research purposes. A disclosure authorization form used to obtain personal or privileged information about an individual must be written in plain language, be dated, and specify how long it remains valid.

An insurance institution, agent or insurance-support organization may not prepare or request an investigative consumer report about an individual for an application, renewal, reinstatement or change in benefits unless the individual is told that they may request an interview and may receive a copy of the report.

On a written request after proper identification, an insurance institution, agent or insurance-support organization must within 30 business days tell the individual the nature and substance of recorded personal information about them, let them see and copy it, and disclose, if recorded, to whom it was disclosed in the previous two years.

Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons for it and the individual's right to file a statement of disagreement.

The access right extends to all natural persons about whom an insurance institution, agent or insurance-support organization collects and maintains information in connection with an insurance transaction, but not to information about them collected in connection with or in reasonable anticipation of a claim or a civil or criminal proceeding involving them.

An adverse underwriting decision is a declination or termination of individually underwritten coverage, an agent's failure to apply for requested coverage with an insurer it represents, a placement of a property or casualty risk at other than a preferred or standard rate with a residual market mechanism, an unauthorized insurer or an insurer of other than preferred or standard risks (a placement with an insurer of other than preferred or standard risks is not one if the applicant or insured did not specify or apply for placement as a preferred or standard risk or with a particular company insuring preferred or standard risks), a higher rate charged on information that differs from what the applicant or policyholder furnished, or, for life, health or disability coverage, an offer to insure at higher than standard rates.

After an adverse underwriting decision, the insurance institution or agent responsible must give the applicant, policyholder or individual proposed for coverage the specific reasons in writing or, except as subdivision (e) provides, advise that they may be requested in writing, and a summary of the rights to reasons and supporting items and to access and correction.

Except as subdivision (d) provides for a decision resulting solely from an oral request or inquiry, for a declination, cancellation or nonrenewal of a property insurance policy covered by section 675 of the Insurance Code, an automobile insurance policy covered by section 660 or an individual life, health or disability insurance policy, the specific reasons must be given in writing at the time of the decision.

On a written request made within 90 business days of the notice, the insurance institution or agent must furnish within 21 business days the specific reasons in writing, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources, except that it need not furnish privileged items where it has a reasonable suspicion, based on specific information available for review by the Commissioner, of criminal activity, fraud, material misrepresentation or material nondisclosure.

An insurance institution, agent or insurance-support organization may not seek information about an individual's previous adverse underwriting decision, or previous coverage through a residual market mechanism, unless the inquiry also requests the reasons.

An insurance institution or agent may not base an adverse underwriting decision, in whole or in part, on the fact of a previous adverse underwriting decision or of earlier coverage through a residual market mechanism, though it may rely on further information obtained from the insurance institution or agent responsible for the earlier decision.

An insurance institution or agent also may not base an adverse underwriting decision on personal information received from an insurance-support organization whose primary source of information is insurance institutions, though it may rely on further personal information obtained as a result of that information.

An insurance institution, agent or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure falls within a ground the section lists, the first of which is the individual's written authorization.

Disclosure to a person whose only use of the information is marketing a product or service is permitted only if no medical record information, privileged information, information about character, personal habits, mode of living or general reputation, or classification derived from the information is disclosed or the individual has been given an opportunity to object and has not, and the recipient agrees to use it only for marketing.

The Insurance Commissioner may examine and investigate every insurance institution or agent doing business in California for violations of the article. After a hearing at which the Commissioner determines that an insurance institution, agent or insurance-support organization violated the article, the Commissioner must issue an order requiring it to cease and desist.

A person who violates a cease and desist order may, after notice and hearing, be fined not more than $10,000 for each violation, or not more than $50,000 if the violations occurred with such frequency as to constitute a general business practice, or have an insurance institution's or agent's license suspended or revoked if it knew or reasonably should have known it was in violation.

A person whose rights under the access, correction or adverse-decision sections are violated may apply to a court for appropriate equitable relief, and a disclosure in violation of the disclosure limits makes the discloser liable for the individual's actual damages. The court may award costs and reasonable attorney's fees to the prevailing party, and an action must be brought within two years from the date the violation is or should have been discovered.

Except as section 791.20 specifically provides, no remedy or recovery is available to individuals for a violation of any provision of the act.

No cause of action for defamation, invasion of privacy or negligence arises against a person for disclosing personal or privileged information in accordance with the article, or for furnishing it to an insurance institution, agent or insurance-support organization, except for false information disclosed or furnished with malice or willful intent to injure.

A person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is subject to a fine of not more than $10,000 or imprisonment for not more than one year, or both.

A disability insurer providing hospital, medical or surgical coverage may not release information to an employer that would directly or indirectly indicate that an employee is receiving or has received services from a covered health care provider unless the employee authorizes it.

An insurer under a personal lines residential property insurance policy that reports claims history or loss experience of insureds to an insurance-support organization must give the insured an additional disclosure naming each claims information database to which it reports.

Health and Safety Code section 123110 entitles an adult patient, a minor patient authorized by law to consent to treatment, and a patient's personal representative to inspect patient records on request. Section 123110(a) requires a health care provider to permit inspection during business hours within five working days after receipt of the request. Section 123110(b)(1) requires a health care provider to ensure that copies are transmitted within 15 days after receiving the request.

Section 123110(j)(1) lets a health care provider impose a reasonable, cost-based fee for providing a paper or electronic copy or summary of patient records. Section 123110(i) bars a health care provider from withholding patient records or summaries of patient records because of an unpaid bill for health care services.

Under section 123110(h), a willful violation by a health care provider described in paragraphs (1) to (3) of section 123105(a) is an infraction punishable by a fine of not more than $100. Under section 123110(h), a willful violation by a health care provider described in paragraphs (4) to (10) of section 123105(a) is unprofessional conduct. The Patient Access to Health Records chapter of the Health and Safety Code took effect on January 1, 1996.

Section 123120 of the Health and Safety Code lets a patient or representative aggrieved by a violation of section 123110 bring an action against the health care provider to enforce the obligations, and the court may award costs and reasonable attorney fees to the prevailing party. Section 123140 provides that the Information Practices Act of 1977 prevails over the chapter with respect to records maintained by a state agency. Section 123110 as currently in force was amended by Statutes 2023, chapter 294 (SB 815), effective January 1, 2024.

Bars an operator of a website, online service or app directed to minors from marketing or advertising on it the products and services listed in section 22580(i), including alcoholic beverages, firearms, ammunition, tobacco, cannabis, electronic cigarettes and lottery tickets.

An operator of any website or app may not market or advertise those products or services to a minor it has actual knowledge is using the service, when the marketing is specifically directed to that minor based on information specific to that minor. Taking reasonable actions in good faith designed to avoid that marketing or advertising counts as compliance.

An operator directed to minors, or with actual knowledge that a minor is using its service, may not knowingly use, disclose, or compile a minor's personal information, or allow a third party to, with actual knowledge that it is for marketing or advertising those products or services to that minor. A minor is a natural person under 18 years of age who resides in California.

A service is directed to minors when it, or a portion of it, is created to reach an audience predominately comprised of minors and is not intended for a more general audience comprised of adults. An advertising service notified by an operator that its service is directed to minors may not market or advertise those products or services on it.

The advertising restrictions do not apply to the incidental placement of products or services embedded in content that is not distributed primarily for marketing or advertising them. Marketing or advertising means a communication made in exchange for monetary compensation, the primary purpose of which is to encourage recipients to purchase or use the product or service. Section 22580 does not require an operator to collect or retain age information about users.

An operator directed to minors, or with actual knowledge that a minor is using its service, must let a registered minor user remove, or request and obtain removal of, content or information the minor posted, and must give the minor notice and clear instructions. An operator must notify a registered minor that removal does not ensure complete or comprehensive removal of the content or information posted.

An operator is not required to erase content in the circumstances listed, among them content posted by a third party, content the operator anonymizes, and content for which the minor received compensation. An operator complies if it renders the content no longer visible to other users and the public even if it remains on the operator's servers. The chapter became operative on January 1, 2015. Section 22580 was last amended by Chapter 347, Statutes of 2018 (AB 3067), effective January 1, 2019.

Section 17204 of the Business and Professions Code lets a person who has suffered injury in fact and lost money or property as a result of unfair competition sue.

SB 923 was chaptered on 27 September 2026 as Chapter 482 of the Statutes of 2026. It amends Sections 1798.105 and 1798.130 of the Civil Code. It expands the consumer's right under the California Consumer Privacy Act to request deletion from personal information the business collected from the consumer to any personal information the business has collected from or about the consumer.

A business that receives a verifiable consumer request to delete must delete the consumer's personal information from its records, notify its service providers and contractors to delete it, and notify all third parties to whom it sold or shared the information to delete it, unless that proves impossible or involves disproportionate effort.

A business that obtained the personal information from a source other than the consumer is deemed in compliance with a deletion request if it retains a record of the request and the minimum data necessary to keep the information deleted from its records and unused for any other purpose.

A business that operates exclusively online and has a direct relationship with the consumer must provide an email address and also make an online method, such as a web form or online portal, available for submitting requests. The Legislature declared that the act furthers the purposes and intent of the California Privacy Rights Act of 2020.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for SB 923 is January 1, 2027.

Requires a business that has an established business relationship with a California customer, and that in the preceding calendar year disclosed the customer's personal information to third parties it knows or reasonably should know used it for their direct marketing, to give the customer on request and free of charge the categories of information disclosed and the names and addresses of the recipients. A business with fewer than 20 full-time or part-time employees is exempt.

A customer is a California resident whose relationship with the business is primarily for personal, family, or household purposes. A relationship that is no longer ongoing and rests solely on a purchase, rental, or lease counts as established for 18 months from that date. A request received at a designated address or number must be answered within 30 days, and a request received elsewhere within a reasonable period not exceeding 150 days.

A business that publicly adopts a policy of disclosing customer information for third parties' direct marketing only with the customer's affirmative agreement, or not at all after an opt-out, may comply by notifying the customer of the right to prevent disclosure and giving a cost-free means to exercise it.

Disclosures under processing and servicing contracts, the business's own marketing that discloses nothing to third parties, account servicing, consumer reporting, payment processing, and certain public-record, joint-offer, agent and private-label card arrangements are not disclosures for direct marketing purposes. A financial institution subject to the California Financial Information Privacy Act is outside the section if it complies with the sections of the Financial Code the subdivision lists.

A business that discloses to affiliates sharing its brand name may meet the duty to name recipients by giving the overall number of those affiliated companies. A customer may recover a civil penalty of up to $500 per violation of the section, or up to $3,000 per violation that is willful, intentional, or reckless. A prevailing plaintiff recovers reasonable attorney's fees and costs.

Unless the violation is willful, intentional, or reckless, a business has a complete defense if it provides the missing or accurate information to all affected customers within 90 days of the date it knew of the failure. A waiver of a provision of the title is void and unenforceable.

Civil Code section 3273.91 requires a social media platform to provide a clear and conspicuous button that enables the user to delete their account. Under section 3273.90(d) of the Civil Code, a social media platform is one that generates more than $100,000,000 per year in gross revenues. Section 3273.91(c) bars a social media platform from obstructing or interfering with a user's ability to delete their account, including by using dark patterns.

Under section 3273.91(d), a deletion request counts as a request to delete the user's personal information under section 1798.105 of the Civil Code and is processed under the California Consumer Privacy Act. Civil Code section 3273.91 took effect on January 1, 2026.

Section 7301(a) of the CCPA Regulations lets the Agency open investigations upon the sworn complaint of any person or on its own initiative. Section 7302(a) of the Regulations provides that, under Civil Code section 1798.199.50, probable cause exists when the evidence supports a reasonable belief that the CCPA has been violated. Section 7304(a) of the CCPA Regulations lets the Agency audit a business, service provider, contractor or person to ensure compliance with any provision of the CCPA.

Under section 7304(c), audits may be announced or unannounced as determined by the Agency. Under section 7304(d), a subject's failure to cooperate during an Agency audit may result in the Agency issuing a subpoena, seeking a warrant, or otherwise exercising its powers to ensure compliance with the CCPA. The Agency's regulations became effective on March 29, 2023.

The California Privacy Protection Agency, which assumed enforcement authority July 1, 2023, and the Attorney General share administrative enforcement of the CCPA/CPRA, with civil penalties currently up to $2,663 per violation or $7,988 per intentional violation or one involving a consumer known to be under 16, inflation-adjusted for 2025 under a streamlined adjustment mechanism AB 3286 (2024) put in place.

There is no general private right of action for a CCPA violation; a narrow one exists only under section 1798.150 for a business's failure to maintain reasonable security resulting in a breach of unencrypted, unredacted personal information, carrying statutory damages of $100 to $750 per consumer per incident and a 30-day cure notice that does not excuse a breach already suffered.

Requires the operator of a commercial website or online service that collects personally identifiable information online from California residents who use or visit it to conspicuously post a privacy policy, and to follow it. No revenue, volume or headcount threshold applies, so the duty reaches operators the California Consumer Privacy Act does not.

The policy must list the categories of personally identifiable information collected and the categories of third parties it may be shared with, describe any process for reviewing and requesting changes to that information and how material changes to the policy are notified, and state its effective date.

Since the 2013 amendments (AB 370), it must also disclose whether other parties may collect information about a user's activity over time and across sites and, if the operator itself collects such information, how it responds to browser Do Not Track signals. A failure to post is a violation only 30 days after the operator is notified of it. Failing to comply with section 22575 or with the posted policy is a violation when knowing and willful, or negligent and material. The chapter preempts local rules on posting a privacy policy.

AB 1159 was chaptered on 10 September 2026 as Chapter 182 of the Statutes of 2026. It amends Sections 22584 and 22586 of the Business and Professions Code, adds Section 22586.1 and Chapter 22.2.6, and repeals and adds Section 22585. The K-12 Pupil Online Personal Information Protection Act (KOPIPA) protects the personal information of a student enrolled in a K-12 course of instruction.

The Early Learning Personal Information Protection Act (ELPIPA) protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction. The act applies both Acts to an operator, or an entity working on behalf of the operator, of a site, service or application with actual knowledge that it is used for the applicable school purposes and was designed or marketed for those purposes.

An operator may not knowingly engage in targeted advertising on its site, service or application, or target advertising on another site, service or application based on information it acquired through the use of its site, service or application for K-12 school purposes.

An operator may not knowingly use covered information, including persistent unique identifiers, created or gathered by its site, service or application to train a generative artificial intelligence system or service or develop an artificial intelligence system. An operator may not knowingly collect, use, retain or disclose covered information relating to a pupil's reproductive or sexual health, immigration status, or sexual orientation or gender identity.

An operator may not knowingly amass a profile about a pupil enrolled in a local educational agency, except in furtherance of K-12 school purposes and for the use and benefit of the school and the teacher, pupil or parent. An operator may not knowingly sell a pupil's information unless the sale is part of an acquisition of the operator or is made under a written contract that meets the section's conditions.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information. An operator must delete a pupil's covered information if the school or local educational agency requests deletion of data under its control.

An operator must also delete a pupil's covered information that the California Consumer Privacy Act does not cover when the pupil's parent, education rights holder or guardian, or a former pupil who is 18 or older, requests it and the pupil has been no longer enrolled in the local educational agency for at least 60 days. An operator must retain covered information only as long as reasonably necessary to fulfill the specific purpose for which it was collected.

An operator must establish, implement and maintain a written data retention policy, available on request to a pupil, parent, guardian, education rights holder or K-12 personnel, that states the purposes for which covered information is collected and retained and a timeframe for deleting it.

A pupil who suffers actual damages as a result of an operator's failure to comply, or the pupil's parent, education rights holder or guardian, may sue on the pupil's behalf and on behalf of a similarly situated class for the greater of actual damages or $500 per plaintiff per violation, injunctive relief, punitive damages, and reasonable attorney's fees and costs.

At least 60 days before bringing the action the pupil must give the operator written notice of the alleged violations and demand that it correct and remedy them. The person who brings the action must furnish a copy of the complaint to the Attorney General within 10 days after filing it.

AB 1159 also enacts the Higher Education Student Information Protection Act (HESIPA), which protects the personal information of a student enrolled in a higher education institution in a similar manner as KOPIPA and ELPIPA. HESIPA applies to an operator, or an entity working on behalf of the operator, of a site, service or application with actual knowledge that it is used for higher educational purposes and was designed or marketed for them.

HESIPA also bars an operator from knowingly collecting, using, retaining or disclosing covered information relating to a student's reproductive or sexual health, immigration status, precise geolocation information, or sexual orientation or gender identity. HESIPA becomes operative on July 1, 2027.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for the amendments to Sections 22584 to 22586.1 is January 1, 2027.

Defines biometric information to expressly include faceprints extracted from facial imagery and voiceprints extracted from voice recordings, with no exclusion for an identifier derived from a recording.

Sensitive personal information is personal information that reveals a consumer's social security, driver's license, state identification card, or passport number; a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; the contents of a consumer's mail, email, and text messages unless the business is the intended recipient of the communication; genetic data; or neural data, together with the processing of biometric information for the purpose of uniquely identifying a consumer, personal information collected and analyzed concerning a consumer's health, and personal information collected and analyzed concerning a consumer's sex life or sexual orientation.

A consumer may direct a business to limit use of sensitive personal information, including biometric information, to what is necessary to provide the requested goods or services. California has no dedicated biometric capture-consent or retention-and-destruction statute comparable to Illinois's Biometric Information Privacy Act (BIPA); biometric data is regulated only as a CCPA sensitive-information category, and the CCPA's private right of action does not reach this provision.

Bars a provider of health care, a health care service plan or a contractor from disclosing medical information about a patient, enrollee or subscriber without first obtaining an authorization, except where section 56.10(b) compels the disclosure or section 56.10(c) permits it.

A business that offers software, hardware or a mobile application designed to maintain medical information so that an individual or a provider of health care can obtain it, or for diagnosis, treatment or management of a medical condition, is deemed a provider of health care for the purposes of this part only. A business that offers a mental health digital service or a reproductive or sexual health digital service is likewise deemed a provider of health care for those purposes.

A business deemed a provider of health care must keep the same standards of confidentiality as a provider and is subject to the part's penalties for improper use and disclosure.

Medical information is individually identifiable information in possession of or derived from a provider of health care, health care service plan, pharmaceutical company or contractor regarding a patient's medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. An employer that receives medical information must establish procedures to protect it from unauthorized use and disclosure.

The part does not limit the disclosure and use of the categories of records listed in section 56.30. An individual who sues for a negligent release of confidential information may recover nominal damages of $1,000 without proof of actual damage.

A patient who has sustained economic loss or personal injury from a use or disclosure in violation of section 56.10, 56.104, 56.107 or 56.20 or section 56.26(a) may recover compensatory damages, punitive damages not to exceed $3,000, attorney's fees not to exceed $1,000 and the costs of litigation. A negligent disclosure of medical information also carries an administrative fine or civil penalty of up to $2,500 per violation.

A defendant that is a covered entity or business associate, as federal regulations define those terms, avoids nominal damages by establishing the affirmative defense in section 56.36(e). A violation that results in economic loss or personal injury to a patient is punishable as a misdemeanor.

Civil Code section 1798.85 bars a person or entity from publicly posting or publicly displaying an individual's social security number in any manner. Section 1798.85(a)(3) also bars requiring an individual to transmit the number over the internet unless the connection is secure or the number is encrypted.

Section 1798.85(a)(4) bars requiring an individual to use the number to access an internet website unless a password, unique personal identification number or other authentication device is also required. Section 1798.85(a)(6) bars selling, advertising for sale or offering to sell an individual's social security number.

Section 1798.85(g) bars a person or entity from encoding or embedding a social security number in a card or document, including by a barcode, chip or magnetic strip, in place of removing it. Under section 1798.86 of the Civil Code, any waiver of the provisions of the title is contrary to public policy and is void and unenforceable. When SB 168 enacted section 1798.85, its prohibitions applied to uses of social security numbers on or after July 1, 2002.

Section 1798.85 as currently in force was amended by Statutes 2021, chapter 615 (AB 474), effective January 1, 2022 and operative January 1, 2023.

Requires a person or entity that provides the operation of a voice recognition feature in California to prominently inform, during the initial setup or installation of a connected television, either the user or the person the user designated to perform the setup. Recordings of spoken word that a connected television manufacturer collects through the feature to improve it may not be sold or used for any advertising purpose.

Recordings of spoken word collected through a voice recognition feature by a third party contracting with a manufacturer, for the purpose of improving the feature, may likewise not be sold or used for any advertising purpose. No person or entity may compel a manufacturer or other entity providing a voice recognition feature to build specific features that let an investigative or law enforcement officer monitor communications through it.

A connected television is a video device designed for home use with an integrated screen that exceeds 12 inches, and does not include a personal computer, portable device, set-top box, game console, or digital video recorder. A voice recognition feature does not include voice commands that are not recorded or transmitted beyond the connected television.

A user is the person who originally purchases, leases, or takes ownership of a connected television, and a person incidentally recorded when a user activates the feature is not a user. A manufacturer is liable only for functionality provided at the time of the original sale, and not for applications the user chooses to use in the cloud or downloads and installs. The chapter does not apply to a product or service provided by a company covered under Section 637.5 of the Penal Code.

Only the Attorney General or a district attorney may bring a civil action under the chapter, which creates no private right of action. A person who knowingly engages in a violation is liable for a civil penalty not to exceed $2,500 for each connected television sold or leased in violation of the chapter. A waiver of the provisions of the chapter is contrary to public policy and void and unenforceable.

The remedies or penalties the chapter provides are cumulative to each other and to the remedies or penalties available under all other laws of the state.

The Early Learning Personal Information Protection Act binds the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for preschool or prekindergarten purposes and was designed and marketed for those purposes. Business and Professions Code section 22586(b)(1) bars an operator from knowingly engaging in targeted advertising on its site, service or application.

Section 22586(b)(3) bars an operator from knowingly selling a pupil's information, including covered information. Under section 22586(d)(1), an operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information. Under section 22586(d)(2), an operator must delete a pupil's covered information if the preschool, prekindergarten or district requests deletion of data under its control.

Business and Professions Code section 22587 made the Early Learning Personal Information Protection Act operative on July 1, 2017. Section 22586 as currently in force was amended by Statutes 2024, chapter 935 (AB 801), effective January 1, 2025.

Binds a direct-to-consumer genetic testing company, which is an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer, or collects, uses, maintains or discloses genetic data from such a product or service or provided directly by a consumer.

A company must obtain a consumer's express consent for the collection, use and disclosure of genetic data, with separate and express consent for the use of the data collected, including who has access to it and how it may be shared, for storing the biological sample after the initial testing, for each use beyond the primary purpose, for each transfer to a third party other than a service provider, and for marketing based on the data.

A company must honor a consumer's revocation of consent as soon as practicable and no later than 30 days after it, and must destroy the consumer's biological sample within 30 days of receiving a revocation of consent to store it. A company must keep reasonable security procedures and practices, and have procedures that let a consumer access the genetic data, delete the account and genetic data, and have the biological sample destroyed.

A company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises such an entity, except in the narrow case section 56.181(f)(2) describes.

The chapter does not apply to medical information governed by the Confidentiality of Medical Information Act or to protected health information held by a covered entity or business associate under the federal health privacy rules. A person who negligently violates the chapter is assessed a civil penalty of up to $1,000 plus court costs, and a person who willfully violates it a civil penalty of $1,000 to $10,000 plus court costs.

Only the Attorney General, a district attorney or the other public prosecutors the section names may prosecute actions for relief under the chapter, in the name of the people. The chapter took effect on January 1, 2022.

Civil Code section 1798.99.92 makes it unlawful to geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services. Section 1798.99.92(a) also makes it unlawful to geofence such an entity to collect personal information from a person seeking, receiving or providing health care services or to send the person notifications or advertisements related to their personal information or health care services.

Section 1798.99.92(b) makes it unlawful to sell personal information to, or share it with, a third party for use in violating the geofencing prohibition. Under section 1798.99.92(d)(1), a violator is subject to an injunction and a civil penalty of $25,000 for each violation, recovered in an action by the Attorney General.

Section 1798.99.92(f) does not prohibit a person that owns, operates, manages or provides services to an in-person health care entity from geofencing the entity's own location to provide necessary health care services. Civil Code section 1798.99.92 took effect on January 1, 2026.

Civil Code section 1798.99.91 makes it unlawful to collect, use, disclose, sell, share or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center. Section 1798.99.90 of the Civil Code defines a precise geolocation as a geographic area equal to or less than a circle with a radius of 1,850 feet.

Under section 1798.99.91(b), a person may collect or use that personal information only as necessary to perform the services or provide the goods the person requested. Section 1798.99.91(c) lets an aggrieved person or entity, including a family planning center, sue a violator for injunctive and monetary relief and attorney's fees within three years of discovery of the violation.

Recovery in an action under section 1798.99.91(c) is three times the amount of actual damages and any other expenses, costs or reasonable attorney's fees incurred in the litigation.

Section 1798.99.91 does not apply to a provider of health care, a health care service plan or a contractor as defined in section 56.05 of the Civil Code, or to a covered entity or its business associate as defined in the federal regulations, and a contractor or business associate qualifies for the exemption only if it is contractually obligated to comply with all applicable state and federal privacy laws. Civil Code section 1798.99.91 took effect on January 1, 2026.

Insurance Code section 791.29 requires a health insurer, notwithstanding any other law and to the extent permitted by federal law, to take steps to protect the confidentiality of an insured's medical information. A health insurer may not require a protected individual to obtain the policyholder's authorization to receive sensitive services or to submit a claim for sensitive services if the protected individual has the right to consent to care.

A health insurer must direct all communications about a protected individual's receipt of sensitive health care services directly to that individual, at an alternative mailing address, email address or telephone number the individual designated or otherwise in the individual's name at the address or telephone number on file.

A health insurer may not disclose medical information about sensitive health care services provided to a protected individual to the policyholder or any insured other than that individual without the individual's express written authorization. A health insurer must permit an insured to request, and accommodate requests for, confidential communication in the form and format requested if it is readily producible in that form and format, or at alternative locations.

A confidential communications request must be implemented within 7 calendar days of an electronic transmission, telephonic request or request through the health insurer's internet website, or within 14 calendar days of receipt by first-class mail. A health insurer must notify insureds of the right to request confidential communication and how to make the request, on initial enrollment and annually at renewal.

A health insurer may not condition coverage on the waiver of the rights the section provides. If the Commissioner determines that an insurer has violated the section, the Commissioner may, after notice and an opportunity for hearing, assess a civil penalty not to exceed $5,000 for each violation, or $10,000 for each willful violation.

Sensitive services are all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care and intimate partner violence.

A protected individual is any adult insured covered under a health insurance policy, or a minor who can consent to a health care service without the consent of a parent or legal guardian under state or federal law, but not an individual who lacks the capacity to give informed consent for health care under section 813 of the Probate Code. The section became operative on July 1, 2022.

The K-12 Pupil Online Personal Information Protection Act binds the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes. Business and Professions Code section 22584(b)(1) bars an operator from knowingly engaging in targeted advertising on its site, service or application.

Section 22584(b)(2) bars an operator from knowingly using information it gathers to amass a profile about a pupil except in furtherance of K-12 school purposes. Business and Professions Code section 22584(b)(3) bars an operator from knowingly selling a pupil's information, including covered information. Under section 22584(d)(1), an operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information.

Under section 22584(d)(2)(A), an operator must delete a pupil's covered information if the school or local educational agency requests deletion of data under its control. Section 22584 does not apply to general audience internet websites, online services, online applications or mobile applications. Business and Professions Code section 22585 made the K-12 Pupil Online Personal Information Protection Act operative on January 1, 2016. Section 22584 as currently in force was amended by Statutes 2024, chapter 935 (AB 801), effective January 1, 2025.

Education Code section 49073.1 lets a local educational agency contract with a third party for cloud-based services for the digital storage, management and retrieval of pupil records, or for digital educational software that accesses, stores and uses pupil records. Section 49073.1(b)(1) requires the agency to ensure the contract contains a statement that pupil records continue to be the property of and under the control of the local educational agency.

Section 49073.1(b)(3) requires the contract to prohibit the third party from using any information in the pupil record for any purpose other than those required or specifically permitted by the contract. Section 49073.1(b)(9) requires the contract to prohibit the third party from using personally identifiable information in pupil records to engage in targeted advertising.

Section 49073.1(b)(7)(A) requires the contract to include a certification that a pupil's records will not be retained or available to the third party upon completion of the terms of the contract. Under section 49073.1(c), a contract that fails to comply is rendered void if, after notice and a reasonable opportunity to cure, the noncompliant party fails to cure. Section 49073.1 as currently in force was amended by Statutes 2015, chapter 386 (SB 436), effective January 1, 2016. No day on which the section came into force has been located.

Education Code section 49073.6 requires a school district, county office of education or charter school that considers a program to gather or maintain in its records information obtained from the social media of an enrolled pupil to notify pupils and their parents or guardians and provide an opportunity for public comment before adopting the program.

Under section 49073.6(c)(1), an agency that adopts such a program must gather or maintain only information that pertains directly to school safety or to pupil safety. Under section 49073.6(c)(2), the agency must provide a pupil with access to any information about the pupil obtained from social media and an opportunity to correct or delete it.

Under section 49073.6(c)(3)(A), the agency must destroy information gathered from social media within one year after a pupil turns 18 or is no longer enrolled, whichever occurs first. Under section 49073.6(c)(3)(C), if the agency contracts with a third party to gather social media information on an enrolled pupil, the contract must prohibit the third party from using the information for purposes other than the contract. Education Code section 49073.6 took effect on January 1, 2015.

Bars a provider of a book service from knowingly disclosing a user's personal information to a government entity, or being compelled to disclose it to anyone, except in the circumstances the section lists. A book service is a service whose primary purpose is the rental, purchase, borrowing, browsing, or viewing of books.

A store that sells a variety of consumer products is not a book service when its book service sales do not exceed 2 percent of its total annual gross sales of consumer products sold in the United States. A provider is any commercial entity offering a book service to the public. A book is paginated or similarly organized content in printed, audio, electronic, or other format, and does not include serial publications such as a magazine or newspaper.

Personal information includes any information that identifies, relates to, describes, or is associated with a particular user, a unique identifier or Internet Protocol address used to identify a user or book, and information relating to a user's access to or use of a book service or book.

A provider may disclose to a law enforcement entity only under a court order from a court with jurisdiction over the offense under investigation, issued on findings of probable cause, a compelling interest and no less intrusive means. Before the order issues, the law enforcement entity must give the provider reasonable notice of the proceeding and tell the provider it has notified the user, unless a judge finds a strong showing of necessity to delay notice for up to 90 days.

Before complying with a court order sought by another government entity or a private party, the provider must give the user notice of the order and at least 35 days to appear and quash it. Disclosure is permitted where the user has given informed, affirmative consent to the specific disclosure for a particular purpose.

A provider may disclose to a government entity on a good-faith belief in imminent danger of death or serious physical injury that requires immediate disclosure, and the government entity must give a written statement of the facts on request or within 48 hours after seeking disclosure. A provider may disclose to a government entity where it believes in good faith that the information is evidence directly related and relevant to a crime against the provider or that user.

On a law enforcement entity's request a provider must preserve records of a user's personal information for 90 days, extended by another 90 days on a renewed request. No evidence obtained in violation of the section is admissible in any civil or administrative proceeding, except in an action for a violation of the section.

A provider that has disclosed personal information of more than 30 total users must prepare an annual report of the demands it received and the disclosures it made in the previous calendar year. Reports must be made publicly available in an online, searchable format on or before March 1 of each year. A provider subject to section 22575 of the Business and Professions Code must, by March 1, link to or post its latest report, or state that none is available because it is exempt.

A provider that knowingly provides a user's personal information to a government entity in violation of the section is subject to a civil penalty not to exceed $500 per violation, paid to the user in a civil action brought by the user. The Attorney General, a district attorney or city attorney, or a city prosecutor in a city with a full-time city prosecutor may recover a further civil penalty not to exceed $500 per violation.

A civil action must be commenced within two years after the claimant first discovered the violation. Objectively reasonable reliance on a warrant, a court order, or an enumerated exception is a complete defense to a civil action.

The section does not make it unlawful for a law enforcement entity to obtain a search warrant for a user's personal information when probable cause exists to believe the person possessing it has committed an offense involving child pornography or the sexual exploitation of children.

Section 502(c) criminalizes knowing access without permission, and the Ninth Circuit has said the statute is different from the federal Computer Fraud and Abuse Act (CFAA) because it does not require unauthorized access and merely requires knowing access. Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016) held a scraper's originally-permitted access did not violate this section, but access became without permission once Facebook sent a cease-and-desist and IP-blocked the scraper and it continued anyway.

Craigslist v. 3Taps (964 F. Supp. 2d 1178, N.D. Cal. 2013) denied a motion to dismiss CFAA and section 502 claims against a scraper alleged to have kept scraping after a personally addressed cease-and-desist letter and an IP block. The court reasoned that a person of ordinary intelligence would understand those actions as a revocation of authorization to access the website. The current section was added by chapter 1499 of the Statutes of 1987.

The section's history note records only its most recent amendment, and no day on which chapter 1499 came into force has been located.

AB 2013 requires developers of generative AI systems made available to Californians, released or substantially modified since January 1, 2022, to publicly post documentation of their training datasets, including whether the datasets include data protected by copyright, trademark, or patent, and whether they include personal information as defined in Civ. Code § 1798.140. The duty commences January 1, 2026 and repeats before each subsequent release or substantial modification.

AB 2013 added Title 15.2 (commencing with Section 3110) to Part 4 of Division 3 of the Civil Code. It was chaptered as Chapter 817, Statutes of 2024. A federal district court denied a preliminary injunction against enforcement in X.AI LLC v. Bonta (C.D. Cal., Mar. 4, 2026), finding no likelihood of success on trade-secret or constitutional claims without reaching the law's ultimate validity, so the law remains in effect subject to that ongoing litigation.

Section 1798.140(v) defines publicly available narrowly: lawfully available government records, information a business has a reasonable basis to believe the consumer themselves lawfully made available to the public or through widely distributed media, or information made available by a person to whom the consumer disclosed it without restricting the audience, and it expressly excludes biometric information a business collected about a consumer without the consumer's knowledge.

The publicly available carve-out applies only to information within one of those limbs, and a for-profit entity doing business in California that determines the purposes and means of processing consumers' personal information it collects, including by gathering, obtaining or accessing it by any means, is a business under the Act if it has annual gross revenues above $25,000,000 (as adjusted), buys, sells or shares the personal information of 100,000 or more consumers or households, or derives 50 percent or more of its annual revenues from selling or sharing it.

AB 1008 (Chapter 802, Statutes of 2024) amended this section to specify that personal information can exist in various formats. Those formats include artificial intelligence systems that are capable of outputting personal information. Section 1.5 of SB 1223 (Chapter 887, Statutes of 2024) incorporates the amendments proposed by both bills.

Section 17200 defines unfair competition to include any unlawful, unfair or fraudulent business act or practice and unfair, deceptive, untrue or misleading advertising, together with any act prohibited by Chapter 1 (commencing with Section 17500) of Part 3 of Division 7 of the Business and Professions Code.

In hiQ Labs v. LinkedIn, a data-analytics company dependent on LinkedIn's publicly available member data argued that LinkedIn's decision to block its access was an unfair business practice under the Unfair Competition Law. The district court's 2017 order granting a preliminary injunction found serious questions that LinkedIn's behavior may be anticompetitive conduct in violation of that Law.

Separately, trespass to chattels is narrower in California than the earlier federal-district trend: Intel Corp. v. Hamidi (30 Cal. 4th 1342, 2003) requires actual damage to, or impairment of the functioning of, the computer system, so an unwanted crawl causing no measurable server harm is not trespass to chattels under California law.

Chapter 299 of the Statutes of 1977 added section 17200, which moved the former Civil Code § 3369 unfair-competition provisions into the Business and Professions Code. The section's history note records only its 1992 amendment, and no day on which chapter 299 came into force has been located.

A manufacturer of a connected device, any device or other physical object capable of connecting to the internet, directly or indirectly, and assigned an internet protocol or Bluetooth address, that is sold or offered for sale in California, must equip the device with a reasonable security feature or features appropriate to the device's nature and function and to the information it may collect, contain, or transmit, designed to protect the device and any information in it from unauthorized access, destruction, use, modification, or disclosure.

Where a connected device authenticates outside a local area network, the statute deems that duty met if the device's preprogrammed password is unique to each unit manufactured, or the device requires the user to generate a new means of authentication before first use; a manufacturer may instead satisfy the duty by meeting or exceeding the baseline criteria of a National Institute of Standards and Technology (NIST)-conforming Internet of Things cybersecurity labeling scheme and completing that scheme's conformity assessment.

The duty does not reach unaffiliated third-party software or applications a user chooses to add to someone else's connected device. It also imposes no duty on an app store, gateway, or marketplace to review or enforce compliance, nor on the manufacturer to prevent a user from modifying the device's own software or firmware. The title does not apply to a connected device already subject to security requirements under federal law, regulation, or federal agency guidance.

It also does not apply to a covered entity, health care provider, health plan, business associate, contractor, or employer as to an activity already regulated by Health Insurance Portability and Accountability Act (HIPAA) or California's Confidentiality of Medical Information Act. The statute creates no private right of action; the Attorney General, a city attorney, a county counsel, or a district attorney have the exclusive authority to enforce it, and the statute names no penalty amount of its own.

A business that owns, licenses, or maintains personal information about a California resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure; where the business instead discloses that information to a nonaffiliated third party by contract, it must require the same standard of the third party by contract.

Covered personal information reaches a California resident's name paired with a Social Security, driver's license, state identification, passport, military identification, or tax identification number, a financial account or payment card number together with its access code, medical information, health insurance information, unique biometric data used to authenticate a specific individual, genetic data, or a username or email address paired with a password or security question that would permit access to an online account.

The duty exempts a health care provider, health plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a Health Insurance Portability and Accountability Act (HIPAA) covered entity as to HIPAA-regulated medical privacy and security rules, an entity receiving Vehicle Code confidentiality-protected information, and a business already subject to state or federal law that provides greater protection to personal information on the same subject, which is deemed compliant instead.

Civil Code section 1798.84(b), within the same Customer Records title, gives a customer injured by a violation of this duty a civil action to recover damages, with no statutory cap of its own. The $500 to $3,000 per-violation civil penalty that section 1798.84(c) provides is reserved, by its own terms, for a violation of section 1798.83's Shine the Light disclosure duty rather than a violation of this section.

Where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a further and separate remedy, already researched as this jurisdiction's privacy row.

A local educational agency shall report any cyberattack impacting more than 500 pupils or personnel to the California Cybersecurity Integration Center. A local educational agency, for the purposes of the article, means a school district, county office of education, or charter school.

A cyberattack, for the purposes of the article, is an alteration, deletion, damage, or destruction of a computer system, computer network, computer program, or data caused by unauthorized access, or the unauthorized denial of access to legitimate users of a computer system, computer network, computer program, or data. The section does not affect any disclosure or notification requirements under sections 1798.29 and 1798.82 of the Civil Code.

Article 8.5 of the Education Code, which holds the section, remains in effect only until January 1, 2027, and is repealed as of that date. The section was added by Assembly Bill 2355, chapter 498 of the Statutes of 2022, effective January 1, 2023.

Section 17529.5(a) makes it unlawful to advertise in a commercial email advertisement sent from California or to a California email address that contains or is accompanied by a third party's domain name used without permission, falsified, misrepresented, or forged header information, or a subject line a person knows would likely mislead a recipient about a material fact regarding the message's contents.

Section 17529.5(b) lets the Attorney General, an electronic mail service provider, or a recipient of the unsolicited commercial email sue for actual damages, or liquidated damages of $1,000 for each violating email up to $1,000,000 per incident (reduced to $100 per email, up to $100,000 per incident, if the defendant shows it had established and implemented due-care practices to prevent violations), plus attorney's fees and costs for a prevailing plaintiff; a claim under this section forecloses a separate claim under sections 17529.8 or 17538.45 for the same email, and there is no cause of action against an email service provider only routinely transmitting the message.

Section 17529.5(c) also makes a violation a misdemeanor punishable by a fine of up to $1,000, imprisonment in county jail for up to six months, or both. The federal CAN-SPAM Act's preemption clause supersedes a state statute that expressly regulates commercial email, except to the extent the state statute prohibits falsity or deception in the message. Section 17529.5's duties are framed as exactly that kind of falsity-or-deception rule, the kind CAN-SPAM's preemption clause leaves in force.

California's broader, non-deception-based commercial-email ban, section 17529.2, is framed instead as a flat ban on any unsolicited commercial email regardless of truthfulness, and is not researched here as a separate instrument for that reason. The provisions this entry describes came into force on different days.

Section 17538.41(a) bars a person, business, candidate, or political committee in California from transmitting a text message advertisement, one whose principal purpose is to promote the sale of goods or services or a political purpose, to a mobile telephony services handset, pager, or two-way messaging device capable of receiving text messages.

Subdivisions (b) through (e) exempt a message sent at the direction of the carrier if the subscriber may opt out, a message from a business, candidate, or political committee with an existing relationship with the subscriber if an opt-out is offered, a message from an affiliate of a business with which the subscriber has consented to receive affiliate messages, and an email forwarded to a mobile device without the sender's knowledge.

Section 17536 lets the Attorney General, a district attorney, a county counsel, or a city attorney recover a civil penalty of up to $2,500 for each violation of Chapter 1. Section 17534 makes a violation of any provision of Chapter 1 (Advertising), which this section does not disclaim, a misdemeanor. The provisions this entry describes came into force on different days.

Section 22947.2 of the Business and Professions Code bars a person or entity that is not an authorized user, acting with actual knowledge, with conscious avoidance of actual knowledge or willfully, from causing computer software to be copied onto the computer of a consumer in California and using it to modify, through intentionally deceptive means, the page a browser opens on launch, the default provider or Web proxy, or the list of bookmarks.

The same section bars using the software to collect, through intentionally deceptive means, personally identifiable information through a keystroke-logging function or covering all or substantially all of the Web sites the user visits where the software was installed in a manner designed to conceal the installation.

It also bars using the software to prevent, through intentionally deceptive means, the user's efforts to block or disable software by making software the user removed or disabled reinstall itself, to misrepresent that software will be uninstalled or disabled, and to remove security, antispyware or antivirus software through intentionally deceptive means.

Section 22947.3 bars the same class of person on the same knowledge standard from using the software to take control of the consumer's computer by transmitting or relaying commercial electronic mail or a computer virus initiated by someone other than the authorized user and without authorization, by using the modem or Internet service to cause damage or unauthorized charges, by using the computer in a group of computers to damage another computer, or by opening multiple, sequential, stand-alone advertisements without authorization that a reasonable user cannot close without turning off the computer or closing the browser.

Section 22947.3 also bars using the software to modify the user's security or other settings for the purpose of stealing personal information, or the computer's security settings for the purpose of damaging one or more computers.

Section 22947.3 bars as well preventing, without the authorization of an authorized user, that user's efforts to block or disable software by offering an option to decline installation with knowledge that the installation will proceed anyway, or by falsely representing that software has been disabled.

Section 22947.4 separately bars a person or entity that is not an authorized user from inducing an authorized user to install a software component by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content.

An authorized user, with respect to a computer, is a person who owns it or is authorized by the owner or lessee to use it, and does not include a person or entity that obtained authorization to use the computer solely through an end user license agreement. A consumer is an individual who resides in California and uses the computer in question primarily for personal, family or household purposes.

Intentionally deceptive means by an intentionally and materially false or fraudulent statement, by a statement or description that intentionally omits or misrepresents material information in order to deceive the consumer, or by an intentional and material failure to give an authorized user any notice of the download or installation of software in order to deceive the consumer.

Section 22947.3 does not apply to monitoring of or interaction with a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of unauthorized use or fraud.

Section 22947.4 carries the same exclusion in its subdivision (b). The chapter supersedes and preempts every local rule, ordinance and other law regarding spyware and notices to consumers from computer software providers regarding information collection. The chapter was added by Statutes 2004, chapter 843, effective January 1, 2005.

Section 638.51(a) makes it unlawful for a person to install or use a pen register (a device or process that records the dialing, routing, addressing, or signaling information an instrument transmits, but not the contents of the communication) or a trap and trace device (a device or process that captures the incoming signals identifying the source of a communication) without first obtaining a court order.

Section 638.51(b) exempts a provider of electronic or wire communication service using the device to operate, maintain, or test its own service, to protect its rights or property, to protect users from unlawful or abusive use, to record that a communication was initiated or completed in order to guard against fraud, or where the user of the service has consented.

Because this section sits within the same Chapter 1.5 (Invasion of Privacy) as sections 631, 632, and 632.7, a violation carries the same civil action under section 637.2, for the greater of $5,000 per violation or three times actual damages, and the same misdemeanor exposure under section 638.51(c) of a fine of up to $2,500, up to a year in county jail, or both.

Senate Bill 690 of the 2025-2026 Regular Session, approved by the Governor on September 30, 2026, amends section 637.2 so that, from January 1, 2027, an action against a private actor for a violation of this section arising from conduct on an internet website, online application, or mobile application may be brought only by the Attorney General, not a private plaintiff, while the private civil action for a violation of sections 631, 632, and 632.7, and for a violation of this section outside that context, is unchanged.

Senate Bill 690 amends Penal Code section 637.2 to provide that an action against a private actor for a violation of section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under section 637.2 only by the Attorney General, removing the private right of action for that class of claim; it does not change the civil action for a violation of sections 631, 632, or 632.7, or for a violation of section 638.51 outside that context.

The amendment applies retroactively to a pending claim in an action commenced within two years before its operative date. Introduced in the California Senate on February 21, 2025, the bill passed both houses on August 28, 2026 and was approved by the Governor on September 30, 2026 as Chapter 976 of the Statutes of 2026.

The bill carries no urgency clause, so under Government Code section 9600 it takes effect on the January 1 next following a 90-day period from the date of enactment: the period ends on December 29, 2026, and the effective date is January 1, 2027.

Section 631 makes it a crime to tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or to learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.

Section 632 separately makes it a crime to use an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether conducted in person or by telephone, without the consent of every party, and the section excludes a person known by every party to be listening in or recording. A communication is confidential where a party has an objectively reasonable expectation that it is not being overheard or recorded.

Section 632.7 separately makes it a crime to intercept or record, without the consent of all parties, a communication transmitted between a cellular or cordless telephone and another telephone. Enacted in 1992, it reaches every such communication regardless of whether it is confidential.

The California Supreme Court has held that section 632.7 applies to a party to the call and not only to a third-party eavesdropper, remanding the further question whether an audible warning tone alone gave the plaintiff adequate notice to establish consent.

Section 633.5 lifts the consent requirement of sections 631, 632, and 632.7 only where a party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony including human trafficking, a violation of Section 653m, or domestic violence, and creates no general business-purpose exception.

Sections 631 and 632.7 also exempt a public utility or telephone company from these prohibitions where the acts are for the purpose of constructing, maintaining, conducting, or operating its own communications services and facilities. A 2022 amendment, SB 1272, extended this exemption, previously limited to a public utility, to a telephone company as well, without changing either section's fine amounts.

Section 637.2 gives a person injured by a violation of this chapter a civil action for the greater of $5,000 per violation or three times actual damages, with no need to prove actual loss, plus injunctive relief. The California Supreme Court has held that section 632 applies when a confidential communication takes place in part in California and in part in another state.

It applied California law to the alleged secret recording of calls by a brokerage firm's Georgia branch with its California clients. The court allowed the claim for an injunction to go forward. It relieved the firm of liability for damages for its past recording of conversations. A first violation of section 631 is punishable by a fine of up to $2,500, imprisonment in county jail for up to one year or under subdivision (h) of Penal Code section 1170, or both a fine and imprisonment.

A first violation of section 632 is punishable by a fine of up to $2,500 per violation, imprisonment in county jail for up to one year or in state prison, or both. A first violation of section 632.7 is punishable by a fine of up to $2,500, imprisonment in county jail for up to one year or in state prison, or both. After a prior conviction under section 631, 632, 632.5, 632.6, 632.7 or 636 the fine rises to $10,000, with the same terms of imprisonment. The sections this entry groups came into force on different days.

An automatic dialing-announcing device is equipment that stores telephone numbers, or randomly or sequentially generates them, and disseminates a prerecorded message to the number called.

Section 2872 places connecting such a device to a telephone line under the California Public Utilities Commission's jurisdiction, bars operating one to place a call received in California between 9 p.m. and 9 a.m. California time, and exempts specified school, tax-exempt-organization, cable and utility customer-installation, petroleum and chemical emergency-notification, and law enforcement, fire, and public health emergency uses; it also exempts a device that does not randomly or sequentially dial numbers and is used solely to reach an established business associate, customer, or other person with an existing relationship, or to place a call at the recipient's own request.

Section 2874 requires an unrecorded, natural-voice announcement before the device disseminates its message, stating the caller's name and either an address or telephone number, asking whether the person called consents to hear the prerecorded message, and, since a 2024 amendment, disclosing when the message uses an artificial voice, defined as one generated or significantly altered using artificial intelligence; the device must be disconnected when either party ends the call.

Section 2875 requires filing a written application with the telephone corporation before connecting such a device, which may deny or modify the application if the proposed calling pattern would overload its network or harm other customers. Section 2876 makes a violation a civil offense enforced by the Commission, on complaint or its own motion, with a fine of up to $500 per violation and possible disconnection of telephone service to the device; the article names no private civil action. The sections this entry groups came into force on different days.

Civil Code section 1770(a)(22) makes it an unlawful practice under the Consumers Legal Remedies Act to disseminate an unsolicited prerecorded telephone message without first giving the person answering an unrecorded, natural-voice statement of the caller's name or the represented organization and either the caller's address or telephone number, and without obtaining that person's consent to listen to the prerecorded message; this duty does not apply to a message sent to a business associate, customer, or other person with an established relationship, to a call to collect an existing obligation, or to a call made at the recipient's own request.

Section 1780(a) lets a consumer harmed by a violation of section 1770 sue for actual damages (no less than $1,000 in total in a class action), an injunction, restitution, and punitive damages, and section 1780(e) awards a prevailing consumer court costs and attorney's fees.

Section 1782 requires the consumer to send the business written notice by certified or registered mail, at least 30 days before filing for damages, describing the violation and demanding correction; the business avoids a damages claim, though not an injunction, by giving an appropriate remedy within 30 days of that notice. The sections this entry groups came into force on different days.

Section 17511.1 defines a telephonic seller broadly by the content of the solicitation: a call that represents or implies a free additional item, a prize or gift conditioned on a purchase or payment, a below-regular-price claim, an offer to sell gold, silver, gems, minerals, or an oil, gas, or mineral interest, an offer to arrange a loan, or an upfront fee for a promised credit card, among other criteria, or a call responding to certain unrequested notifications.

The definition excludes a person soliciting business from a prospective purchaser who has previously purchased from the same business enterprise, along with securities, real estate, contractors, insurance, and franchise sellers already licensed under other state laws for the same transaction.

Section 17511.3 requires such a seller to register with the Department of Justice's Consumer Protection Section at least 10 days before doing business in California, filing the information section 17511.4 requires with a $50 fee; registration is valid for one year and is renewed annually with the same fee, a material change must be updated within 10 days (or quarterly for a change in salespersons), and the seller must post its filing confirmation, or until received the first page of its registration form, at each California business location.

Section 17511.6 lets the Attorney General accept service of process for a seller whose designated agent cannot be found. Section 17511.9 makes a willful violation of this article, or a deceptive scheme or fraud in connection with a sale by a telephonic seller, a crime. Section 17511.10 preserves whatever other statutory or common-law right a person has; the article creates no civil private right of action of its own for a registration violation. The sections this entry groups came into force on different days.

Section 17538.43(b)(1) makes it unlawful to use a fax machine, computer, or other device to send an unsolicited advertisement, material advertising the commercial availability or quality of property, goods, or services sent without the recipient's prior express invitation or permission, to a fax machine, where either the sender, the recipient, or both are located in California.

Section 17538.43(b)(2) gives a person or entity a civil action for injunctive relief, and for actual damages or statutory damages of $500 per violation, whichever is greater, trebled at the court's discretion up to three times that amount for a willful or knowing violation, in addition to any remedy under the federal Telephone Consumer Protection Act; the section carves out an electronic mail service provider only involved in the routine transmission of the fax over its network.

Section 17538.43(c) separately requires every fax communication sent to or from California, not only an advertisement, to be marked with the date and time sent, the sender's business or individual identity, and the telephone number of the sending machine or business, in a margin at the top or bottom of each page or on the first page of the transmission.

Section 17538.43(d) exempts a fax from a tax-exempt professional or trade association to a member who provided the fax number and has not asked the association to stop, where the fax is not primarily third-party advertising. Section 17534 also makes a violation of any provision of Chapter 1 (Advertising), which this section does not disclaim, a misdemeanor.

Section 17590 declares the Legislature's intent to adopt the California telephone numbers on the federal Do Not Call Registry, maintained by the Federal Trade Commission, as California's own do-not-call list rather than operating a separate state list.

Section 17592 defines a telephone solicitor by the content of the call (seeking to sell, rent, lease, or promote goods, services, credit, investments, or insurance, or to gather marketing information for a future sale) and bars such a solicitor from calling a number on the current list, subject to exceptions for a subscriber's express written permission naming the caller and signed by the subscriber, a call at the subscriber's express request, a call to collect a debt or offer credit on a delinquent obligation, and a call to a subscriber with whom the solicitor has an established business relationship formed by a purchase, rental, lease, or financial transaction within the preceding 18 months.

Section 17591 separately bars using the list for any purpose other than compliance, denying a subscriber's right to be listed, adding a subscriber without consent, selling or leasing the list to anyone other than a telephone solicitor, and charging a fee to be listed.

Section 17593 lets the Attorney General, a district attorney, or a city attorney sue for an injunction and a civil penalty of up to the amount the Federal Trade Commission may seek under 15 U.S.C. section 45(m)(1)(A); a person who receives a solicitation prohibited by section 17592, or whose number was misused in violation of section 17591, may separately sue in small claims court for an injunction, and, if the defendant thereafter violates that injunction within 30 days, for a further civil penalty of up to $1,000.

Section 17534 also makes a violation of any provision of Chapter 1 (Advertising), which is not disclaimed here, a misdemeanor. The sections this entry groups came into force on different days.

AB 1705 was chaptered on 30 September 2026 as Chapter 890 of the Statutes of 2026. It adds Chapter 22.6.10, on pornographic internet websites, to Division 8 of the Business and Professions Code. A pornographic internet website is a website that permits users to upload, or solicits from users, sexually explicit content for display on it.

A depicted individual is someone shown in the nude or engaging in sexual acts who did not consent to being depicted, was a minor when the content was created, or did not consent to its being uploaded. An operator of a pornographic internet website must exercise ordinary care and reasonable diligence to ensure that each instance of sexually explicit content displayed on the website does not include a depicted individual.

The operator must also exercise ordinary care and take reasonable steps to ensure that each instance of sexually explicit content uploaded to the website does not include a depicted individual.

Before uploading sexually explicit content, a user must submit to the operator a statement certifying, under penalty of perjury, that each individual depicted was not a minor when the content was created and consented to both the depiction and the upload, together with information sufficient to contact the user, including at a minimum an email address. An operator that does not obtain the statement is presumed to have violated Section 22612.

The operator must retain the statement and information in a readily available format for at least seven years after they are submitted. The operator must verify a user's email address before permitting the user to upload sexually explicit content. Knowingly providing false information in the statement is an infraction punishable by a $1,000 fine.

A depicted individual who prevails in a civil action against the operator may obtain actual damages or statutory damages of not more than $75,000 per violation, whichever is greater, punitive damages, and reasonable attorney's fees and costs. A public prosecutor may bring a civil action to enforce the chapter for a civil penalty of $25,000 per violation, injunctive and other equitable relief, and attorney's fees and costs.

Each full calendar day that sexually explicit content uploaded or displayed in violation remains accessible on the website is a separate violation. The chapter does not apply to sexually explicit content sent through an online dating service's private messaging or direct-communication feature to user-selected recipients where it is not made available to the general public, a publicly viewable feed or public search indexing.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

AB 1946 was chaptered on 10 September 2026 as Chapter 185 of the Statutes of 2026. It amends Sections 3273.65, 3273.66, 3273.67 and 3345.1 of the Civil Code, relating to social media platforms. Existing law requires a social media platform to provide a means for a user who is a California resident to report child sexual abuse material to the platform.

A social media platform must provide the means in a clear and conspicuous mechanism that is reasonably accessible to users and does not use dark patterns, for material the user reasonably believes is child sexual abuse material displayed, stored, or hosted on the platform. Child sexual abuse material includes child pornography and an intimate visual depiction of an identifiable individual who is a minor.

The platform must ensure that a natural person reviews a report when there is not an established or known hash match to child sexual abuse material and the reported material is not otherwise blocked. Within 48 hours of receiving a report the platform must permanently block the reported material from being viewable if there is a reasonable basis to believe it is child sexual abuse material.

Within 72 hours of when the material was first reported the platform must give the reporting user written confirmation of the actions taken. Within seven days of the first report the platform must give the reporting user a final written determination of its handling of the reported material. If circumstances beyond its reasonable control prevent compliance within 48 hours, the platform must give written notice of the delay and comply no later than 10 days after the first report.

The platform must restore availability or functionality of the reporting mechanism if it is unavailable or nonfunctional. A social media platform is one defined in Section 22675 of the Business and Professions Code, other than a stand-alone direct messaging service with end-to-end encrypted communication or a service owned or operated by a tax-exempt nonprofit organization.

The Attorney General, a district attorney, a city attorney or a county counsel may sue a social media company that fails to comply for a civil penalty of up to $250,000 for each day of violation of the reporting, review and 48-hour blocking duties.

A social media company that fails to comply with the title, other than the reporting mechanism in subdivision (a) of Section 3273.66, is liable to a reporting user who is the depicted individual for actual damages and statutory damages of no more than $250,000 per violation. A depicted individual who is not a reporting user may bring a civil action for the same relief, on their own behalf or through a parent, legal guardian or other authorized representative.

The maximum statutory damages fall to $125,000 per violation if the platform permanently blocked the reported material before a complaint was filed, and to $75,000 per violation for a violation of subdivisions (d) to (g) if it registers with and participates in the National Center for Missing and Exploited Children's Take It Down service and meets the further conditions of the section.

A failure to comply with subdivisions (c) to (g) of Section 3273.66 within 60 days after the material was first reported establishes a rebuttable presumption that the company is liable for statutory damages.

Section 3345.1 deems a social media platform to have knowledge, for its prohibition on knowingly facilitating, aiding, or abetting commercial sexual exploitation, once material is reported through the mechanism, the report criteria are established, and the material was first displayed, stored, or hosted on the platform after January 1, 2025.

A platform is not in violation of that prohibition if it shows that it kept a program of at least biannual audits of its designs, algorithms, practices, affordances, and features, acted within 30 days of each audit, gave each audit to its board of directors, and submitted the audits to the Attorney General. The act adds the requirement that the platform submit its biannual audits to the Attorney General and, if requested, to a district attorney, city attorney or county counsel.

The reporting title was added by AB 1394 and Section 3273.66 became operative on January 1, 2025. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

SB 981 was chaptered on 19 September 2024 as Chapter 292 of the Statutes of 2024. It added Chapter 22.7, Digital Identity Theft, to Division 8 of the Business and Professions Code. Sections 22670 and 22671 are effective 1 January 2025 per the code's own history note. A social media platform must provide a mechanism that is reasonably accessible to a reporting user who is a California resident with an account on the platform to report sexually explicit digital identity theft.

Covered material is an image or video created or altered through digitization that would appear to a reasonable person to show an intimate body part of an identifiable person, or that person engaged in sexual intercourse, sodomy, oral copulation, sexual penetration or masturbation, where the reporting person is the person depicted, did not consent and the material is displayed, stored or hosted on the platform.

The platform must collect information reasonably sufficient to locate the material and to contact the reporting user, confirm receipt of the report within 48 hours, and send a written status update within seven days of that confirmation.

It must determine within 30 days of the confirmation whether there is a reasonable basis to believe the reported material is sexually explicit digital identity theft, or within 60 days after the material was first reported where circumstances beyond its reasonable control prevent that, and must give the reporting user written notice of the delay within 48 hours of knowing it was likely.

It must temporarily block the reported instance from being publicly viewable pending that determination, and must immediately remove it from being publicly viewable if it determines there is a reasonable basis to believe the report is correct.

A stand-alone direct messaging service with end-to-end encrypted communication, the end-to-end encrypted portion of a multiservice platform, and an internet-based service or application owned or operated by a nonprofit organization exempt from federal income tax under section 501(c)(3) of the Internal Revenue Code are not social media platforms for this purpose.

AB 316 was chaptered on 13 October 2025 as Chapter 672 of the Statutes of 2025 and adds Section 1714.46 to the Civil Code. Section 1714.46 defines artificial intelligence as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

In an action against a defendant who developed, modified, or used artificial intelligence that is alleged to have caused a harm to the plaintiff, it is not a defense, and the defendant may not assert, that the artificial intelligence autonomously caused the harm to the plaintiff.

The section does not limit or preclude a defendant from presenting any other affirmative defense, including evidence relevant to causation or foreseeability, or other evidence relevant to the comparative fault of any other person or entity. Statutes the Legislature passed on or before September 12, 2025 that were in the Governor's possession after that date take effect on January 1, 2026 under Article IV, section 8(c) of the California Constitution.

AB 2 was chaptered on 10 September 2026 as Chapter 180 of the Statutes of 2026 and adds Section 1714.02 to the Civil Code. Subdivision (a) of Section 1714 of the Civil Code already makes every person and corporation, including social media platforms, financially responsible for an injury occasioned to another by their want of ordinary care or skill in the management of their property or person.

A social media platform that violates subdivision (a) of Section 1714 by causing injury to a child is liable for statutory damages of the larger of $5,000 per violation, up to a maximum of $1,000,000 per child, or three times the amount of the child's actual damages. A child is a minor under 18 years of age, and a social media platform is one defined in Section 22675 of the Business and Professions Code and further defined in the section itself.

Any waiver of the section is void and unenforceable as contrary to public policy. The duties, remedies and obligations the section imposes are cumulative to those imposed under other law and do not relieve a platform of any of them. The act applies only prospectively and does not apply to a legal case that was pending on or before January 1, 2027. The section remains in effect only until January 1, 2035, and is repealed on that date.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

Section 1798.99.1 of the Civil Code requires a person or business that conducts business in California and seeks to sell any product or service in or into California that is illegal under state law to sell to a minor to take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including verifying the age of the purchaser.

For the products in subdivision (b), reasonable steps include requiring a government-issued identification, requiring a nonprepaid credit card for an online purchase, restricting accounts designated as minor accounts, or shipping the product to an individual who is of legal age. For the products in subdivision (c), reasonable steps include requiring a government-issued identification or shipping the product or service to an individual who is of legal age.

Reasonable steps do not include consent obtained through the minor. A seller's reasonable and good faith reliance on bona fide evidence of the purchaser or recipient's age is an affirmative defense. A person or business required to comply shall not retain, use, or disclose information it receives from a purchaser or recipient to verify age for any purpose other than complying with the section, California law, or a state or federal court order.

Subdivision (c) covers firearms and handguns, BB devices, ammunition, tobacco and tobacco paraphernalia, electronic cigarettes, and less lethal weapons. In an action brought by a public prosecutor, a business or person that violates the section is subject to a civil penalty not exceeding $7,500 for each violation.

The section does not apply to a business regulated by state or federal law that provides greater protection to personal information or requires greater age verification than the section, and compliance with that law is deemed compliance with the section for those subjects. AB 2076 was chaptered on 30 September 2026 as Chapter 920 of the Statutes of 2026 and amends the section. The amendment adds nitrous oxide to the products in subdivision (c).

The amendment provides that an online seller shall not allow a purchaser to use a gift card or store credit for products or services described in subdivision (c).

As amended, a public prosecutor who brings an action may seek a civil penalty of $7,500 for each violation, which the court may increase up to $250,000 per violation against a business with annual gross revenues above $25,000,000 in the preceding calendar year if it finds that doing so is necessary to deter future violations, and may also seek injunctive relief and reasonable attorney's fees and costs. The amendments take effect on January 1, 2027.

Requires a business that provides an online service, product, or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty, or to apply children's privacy and data protections to all consumers.

The business must also take reasonable steps to prevent reasonably foreseeable physical or financial harm to children, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, a highly offensive intrusion on privacy rights, and adverse discrimination in violation of state or federal law. Any contract term entered into by a child or the child's parent or guardian as a result of a design feature of the service is voidable at the child's election.

The act repeals the California Age-Appropriate Design Code Act and replaces it with similar provisions. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

Requires businesses providing an online service, product, or feature likely to be accessed by children under 18 to complete data protection impact assessments, configure default settings for high privacy and safety, and avoid dark patterns and profiling of minors. AB 2246 (Chapter 187, Statutes of 2026) repeals this title and adds a replacement title in its place.

Requires an operator of a companion chatbot to determine each user's age under the Digital Age Assurance Act, or failing that through the age determination made under Health and Safety Code Section 27001, or else to apply the child protections to all users. An operator that permits a child user to access a companion chatbot must implement a documented crisis response protocol.

It must also set default settings that only a parent can change, disabling persistent conversational memory and push notifications and limiting a child user to one hour in a single session and two hours a day. An operator may not display cross-context behavioral advertising to a child user. An operator must have an independent child safety audit performed every two years after the first.

Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.

Requires operating system providers to ask account holders for a birth date or age at device setup and to send a real time age bracket signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) to app developers, without requiring government ID or biometric data.

AB 1856, enacted as 2026 Cal. Stats. ch. 184, amends the Digital Age Assurance Act (Civil Code Sections 1798.500 to 1798.504) rather than extending it to browsers or websites: it applies the age-signal duty to any operating system that operates on a device and has an account setup feature, removes the prior definition tying the protected 'user' to a child, and requires the signal be sent to a covered application store or to an application developer.

A developer must request a signal when an application is downloaded and launched, must treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and may not request more information than the minimum needed; nobody may request a signal unless required by this title or other applicable law.

For a device or application already set up or downloaded before January 1, 2027, the operating system provider or developer must request or provide the signal by July 1, 2027.

The Act carries forward the Digital Age Assurance Act's existing Attorney General civil enforcement (up to $2,500 per affected child for a negligent violation or $7,500 for an intentional violation) and adds good faith compliance defenses and a nondiscrimination duty barring an operating system or application store from using compliance data anticompetitively. Approved by the Governor and chaptered September 10, 2026, effective January 1, 2027.

Bars users under 16 from accessing addictive feeds, autoplay, and similar engagement features on covered platforms, using age determinations from the Digital Age Assurance Act or Health and Safety Code Section 27001, and creates an e-Safety Advisory Commission within the Department of Justice. Passed the Assembly and Senate, was enrolled and presented to the Governor on September 9, 2026, and was approved and chaptered as Chapter 183, Statutes of 2026 on September 10, 2026.

Requires covered addictive platforms to display a prescribed black box warning, attributed to the Surgeon General, to users under 18: for at least 10 seconds covering at least 25 percent of the screen on first daily access, and for at least 30 seconds covering at least 75 percent of the screen after 3 hours of cumulative daily use and each hour thereafter. Approved by the Governor October 13, 2025; operative January 1, 2027.

Bars addictive feeds, most nighttime and school hour notifications, and non default privacy settings for users a platform knows are minors, without verifiable parental consent. A separate age verification requirement is not effective until January 1, 2027.

Signed September 28, 2024, this law requires developers of generative AI systems to publish on their websites summaries of training data used, disclosing copyright status, data ownership, and whether personal information or third-party copyrighted content (including news) was included; compliance required by January 1, 2026. The law does not grant publishers an explicit opt-out or compensation right but creates de facto disclosure pressure on AI developers who scraped news content for training.

A December 2025 federal executive order directed review of state AI regulations for conflict with federal policy, creating some enforceability uncertainty.