Restricting private lawsuits under CIPA (SB 690)
Senate Bill 690 (SB 690) was passed on August 28, 2026 and is now awaiting signature by the Governor. SB 690 targets the growing wave of private litigation under CIPA's pen register and trap-and-trace device provisions, which have increasingly been invoked against operators of websites and online/mobile applications. Currently, any individual claiming injury from a CIPA violation may sue for statutory damages of up to USD5,000 per violation or treble actual damages and injunctive relief. SB 690 would amend CIPA so that an action for a violation of these provisions arising from activity on an internet website, online application or mobile application, can only be brought by the Attorney General. Notably, this restriction applies retroactively to any claim already pending that was filed within two years before SB 690 takes effect, which could impact a significant volume of existing litigation. SB 690 would also introduce a business purpose exemption which would mean that pen registers and trap-and-trace devices would not be deemed to include devices used for a commercial business purpose. SB 690 principally affects technology companies, website operators and app developers that have faced a surge of CIPA-based class actions and individual claims in recent years.
Read the full text of Senate Bill 690.
Expanding CCPA deletion rights (SB 923)
Senate Bill 923 (SB 923), known as the Expanding Privacy Rights Act, was sponsored by the California Privacy Protection Agency (CalPrivacy) and approved by the Legislature on August 27, 2026. SB 923 is now enrolled and heads to the Governor for signature.
SB 923 addresses what CalPrivacy has characterized as a "loophole" in the CCPA's existing framework for the right to deletion. At present, the CCPA only obliges businesses to delete personal information that they collected directly from a consumer, meaning that data acquired from third-party sources can remain on a business's systems even after the consumer has exercised their deletion right. SB 923 closes this gap by extending the deletion right to cover all non-exempt personal information held about a consumer, regardless of its source. This brings California into line with deletion rights already available in Delaware, Indiana, Maryland and New Jersey.
SB 923 affects any business subject to the CCPA and is particularly significant for organizations that routinely supplement consumer profiles with third-party data. Recognizing the practical realities of compliance, the bill permits businesses to maintain a suppression record (i.e. retaining only the minimum data necessary to ensure the consumer's information stays deleted and is not reacquired). The existing CCPA exemptions (including for fraud prevention, research and legal obligations) are preserved.
Separately, SB 923 seeks to make it easier for consumers to exercise their privacy rights by requiring online-only businesses that have a direct consumer relationship to offer a web-based submission method (such as a web form or portal) for privacy requests, rather than solely an email address.
Read the CalPrivacy press release, and the full text of Senate Bill 923.
Children's online privacy and safety (AB 2246)
Assembly Bill 2246 (AB 2246) passed both chambers and is now enrolled and awaiting the Governor’s signature. AB 2246 would replace California's existing Age-Appropriate Design Code Act with a strengthened regime governing online services, products and features that are likely to be accessed by children (defined as consumers under 18).
AB 2246 is aimed at technology companies and online platform operators whose services are used by, or marketed to, minors. It introduces a suite of positive obligations, including requirements to implement age estimation measures, default to high-privacy settings for child users, present privacy information in age-appropriate language, and give children and their parents accessible tools for exercising privacy rights.
Alongside these positive duties, AB 2246 sets out a range of prohibitions. Businesses would generally be barred from profiling children by default, collecting more personal information than is needed to deliver the service a child is actively using, repurposing children's data beyond its original collection purpose, gathering precise geolocation data from minors by default, and deploying dark patterns that steer children towards providing personal information or giving up privacy protections. Limited exceptions apply, for instance, profiling is permitted where a business can demonstrate appropriate safeguards and the profiling is necessary to deliver the service or enhance safety, privacy or education.
AB 2246 also introduces a general duty on covered businesses to take reasonable steps to prevent foreseeable harms to children, spanning physical, financial, psychological and discriminatory harm, while expressly clarifying that it does not require content moderation, restrict lawful speech or mandate particular algorithmic outcomes.
A notable consumer protection feature is that contracts (including terms of service) entered into by a child or their parent as a result of a design feature of the online service may be voided at the child's election. Enforcement would sit with the Attorney General and public prosecutors, with civil penalties of up to USD5,000 per affected child for negligent violations and up to USD15,000 for intentional violations. No private right of action is created.
Read the full text of Assembly Bill 2246.
Sensitive personal information (AB 1542)
Assembly Bill 1542 (AB 1542) passed both chambers and is awaiting the Governor's signature by 30 September 2026. AB 1542 strengthens protections around sensitive personal information under the CCPA by introducing a general prohibition on the sale or sharing of such data with third parties, going beyond the existing regime which allows consumers to direct businesses to limit the use of their sensitive personal information. The bill affects all businesses, service providers and contractors that handle sensitive personal information as defined under the CCPA. A narrow exception permits commercial credit reporting agencies to continue selling social security numbers where this is solely for the purpose of identifying a consumer's ownership relationship to a business.
Read the full text of Assembly Bill 1542.
Operating system and application privacy settings (AB 2561)
Assembly Bill 2561 (AB 2561) passed both chambers on August 26, 2026 and awaits the Governor's signature. AB 2561 is designed to prevent software providers from silently reversing privacy choices that users have actively made. Specifically, it bars operating systems and applications from overriding a user's affirmative privacy setting configuration without first obtaining the user's consent, unless the change is required by law or court order. "Privacy setting" is broadly defined to capture any user-configurable option within an application's privacy menu that controls how the application handles personal information.
AB 2561 primarily affects developers and operators of operating systems (such as mobile and desktop platforms) and applications that collect or process personal information and offer privacy controls to users. Importantly, AB 2561 does not prevent businesses from winding down services or ceasing data collection altogether, provided that any such changes maintain or improve the user's existing level of privacy protection.
Read the full text of Assembly Bill 2561.
As to whether Governor Newsom will sign or veto any of these bills remains unknown. There have been no public statements from the Governor's office on any of these five measures.
