Governor Newsom signs 22 of 25 major privacy and artificial intelligence (AI) bills, reshaping obligations for businesses, employers, technology companies, health care providers, data brokers, and organizations serving children.
California has closed its 2026 legislative session with another major expansion of its privacy and AI framework. By the September 30th deadline, Governor Gavin Newsom signed 22 of the 25 major privacy and AI bills sent to him and vetoed three. The new laws reach the California Consumer Privacy Act (CCPA), California Invasion of Privacy Act (CIPA), data brokers, children’s privacy, AI transparency, automated employment decisions, workplace surveillance, health care AI, chatbots, digital replicas, and AI auditing. For businesses operating nationally, these are not just California compliance issues. California’s market size and existing privacy infrastructure let it set requirements that shape privacy and AI governance programs nationwide.
SB 690 Significantly Changes CIPA Website-Tracking Litigation
SB 690 amends Penal Code § 637.2, CIPA’s civil remedies provision. It addresses claims under § 638.51, the pen-register and trap-and-trace provision that plaintiffs increasingly use to challenge analytics, advertising, session-replay, and other tracking technologies. When an alleged § 638.51 violation arises from conduct on a website, online application, or mobile application, only the California Attorney General may now bring a § 637.2 action against a private actor. This matters because § 637.2 otherwise allows statutory damages of $5,000 per violation or three times actual damages, whichever is greater, without proof of actual damages.
SB 690 also reaches pending cases. Its amendments apply to any pending claim in an action commenced within two years before the operative date of January 1, 2027. That covers claims in actions filed on or after January 1, 2025. According to Reuters, more than 4,700 digital wiretapping lawsuits have been filed since 2022, and about two-thirds include a CIPA pen-register claim. In his signing message, Governor Newsom described the bill as addressing the “vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses”.
SB 690 does not end CIPA litigation. Section 631 wiretapping claims are untouched, and those claims drive most current CIPA activity, including many demands from serial plaintiffs. Private claims under Sections 631 and 632 remain available, as do § 638.51’s substantive prohibition and the Attorney General’s enforcement authority. Plaintiffs may try to keep pending cases alive by amending complaints to add § 631 claims. Defendants, for their part, may point to Californians for Disability Rights v. Mervyn’s, where the California Supreme Court applied Proposition 64’s limits on private Unfair Competition Law (UCL) suits to cases already pending. The court reasoned that the measure changed who could bring the claim, not the legal consequences of past conduct.
What businesses should do: Review every pending § 638.51 lawsuit and demand letter to see whether it falls within the retroactivity provision. Preserve SB 690 arguments procedurally and prepare for plaintiffs to shift to the CIPA provisions SB 690 leaves in place.
CCPA: SB 923 Broadens the Consumer Right to Delete
SB 923 extends the CCPA deletion right to personal information a business collected “from or about” the consumer. That means the right now reaches data obtained from third parties and other sources. For information obtained from a source other than the consumer, a business may keep a record of the request and the minimum information needed to keep the data deleted. Existing CCPA exceptions still apply. Online-only businesses with a direct consumer relationship must also offer an online submission method, such as a webform or portal, in addition to an email address.
What businesses should do: Review data subject request procedures, data maps, identity-resolution capabilities, deletion workflows, vendor instructions, and suppression mechanisms.
Data Brokers: AB 883 Accelerates Compliance Timelines
AB 883 shortens certain 45-day requirements to 30 days. It also requires notice to specified state officials about their ability to use California’s Delete Request and Opt-Out Platform (DROP). DROP launched on August 1, 2026, and requires more than 500 registered data brokers to process centralized deletion and opt-out requests.
Children’s Privacy and Privacy Settings
- AB 2246 repeals and replaces the California Age-Appropriate Design Code Act. It requires businesses whose online products or services are likely to be accessed by children to take reasonable steps to prevent specified harms. It also lets a child void certain contract terms that resulted from a design feature. The Governor approved it on September 10.
- AB 1709 bars covered platforms from offering specified addictive features to users under 16 and creates an e-Safety Advisory Commission.
- AB 1856 amends the Digital Age Assurance Act.
- AB 2561 bars an operating system or application from undoing a user’s affirmative privacy-setting choices without the user’s consent.
- SB 354 revises the Insurance Information and Privacy Protection Act.
California’s New AI Legislation
- Chatbots: SB 867 bans toys that contain companion chatbots. SB 1119 adds protections for minors, including independent child-safety audits of operators. AB 1609 regulates customer service chatbots used by businesses with more than $500 million in annual gross revenue nationally.
- AI Transparency: SB 1000 removes the one million monthly visitor/user threshold from the definition of a covered provider under the California AI Transparency Act. AB 2713 requires large online platforms to let users inspect system provenance data.
- Employment AI: SB 947 bars employers from relying solely on an automated decision system for discipline or termination decisions. When an employer primarily relies on one, a human must corroborate the decision, and the employee must receive a post-use notice. AB 1883 restricts AI-enabled workplace surveillance, including neural data collection and emotion recognition. AB 1331 bans employer monitoring in workplace bathrooms.
- Health Care AI: AB 1979 bars covered providers from using AI to independently perform clinical functions that California law reserves for licensed professionals. SB 503 requires developers and deployers of clinical decision-support systems to make reasonable efforts to identify systems with known or reasonably foreseeable risk of biased impacts.
- Digital Replicas: SB 1111 updates name, image, and likeness protections to cover digital replicas. SB 1050 requires a clear and conspicuous disclosure when an advertisement prominently features a synthetic performer.
- AI Auditing: SB 813 directs the Government Operations Agency to oversee “independent verification organizations.” AB 1405 requires the agency to create an AI Auditor Registry.
Vetoed Bills
- AB 1542 would have restricted the sale or sharing of sensitive personal information.
- SB 903 would have regulated AI used in psychotherapy services.
- AB 2575 would have imposed additional requirements on clinical decision-support AI. Health care AI is still regulated through AB 1979 and SB 503.
Other Trending Updates
- Connecticut: Amendments to the Connecticut Data Privacy Act took effect October 1, 2026. They address facial recognition technology, revise the rules for publicly available information and related deletion requests, and ban the sale of precise geolocation data. Connecticut’s SB 5 also takes effect in stages from October 1, 2026, through October 1, 2027. It requires disclosures and employer accountability when AI materially influences employment decisions. Beginning October 1, 2027, employers using automated employment decision tools must tell applicants and employees when they are interacting with those tools and give written notice before making an employment decision with one.
- State Privacy Patchwork: Oklahoma, Alabama, Louisiana, and Vermont enacted new privacy laws in 2026. Twenty states now have comprehensive privacy laws in effect.
- California CCPA Regulations: Businesses must complete risk assessments for covered activities that occurred before 2026 by December 31, 2027, with a senior-executive attestation and summary due April 1, 2028. Phased first certifications for mandatory independent cybersecurity audits are due April 1 in 2028 through 2030, depending on business size.
- EU Digital Omnibus: Negotiations over the European Commission’s Digital Omnibus changes to the General Data Protection Regulation (GDPR) and ePrivacy rules are ongoing in the European Parliament.
What Businesses Should Do Now
- Update California legislative inventories and applicability analyses.
- Revise CCPA deletion workflows to capture data obtained from third parties.
- Reassess pending CIPA § 638.51 matters under SB 690’s retroactivity provision.
- Inventory AI and automated decision systems by use case.
- Review employment AI and workplace surveillance practices.
- Evaluate AI transparency and provenance capabilities.
- Assess children’s products and age-assurance mechanisms.
- Build health care, chatbot, digital replica, and AI audit requirements into vendor diligence and contracting.