October 1, 2026
California Governor Gavin Newsom recently signed several bills and vetoed one bill concerning consumer privacy, amending the California Consumer Privacy Act ("CCPA"), California's Delete Act, and the California Invasion of Privacy Act ("CIPA").
First, Governor Newsom signed Senate Bill 690, which revises the CIPA by removing a private right of action for pen register and trap-and-trace claims. Pen register and trap-and-trace claims are types of claims that plaintiffs bring against website operators that have allegedly violated the CIPA through website tracking technology. SB 690 does not, however, restrict the private right of action under other provisions of the CIPA, including wiretapping claims. The new law is effective on January 1, 2027, but will apply to lawsuits filed in 2025 and 2026.
Second, Governor Newsom signed Senate Bill 923, which amends the CCPA by expanding a consumer's right to have personal information deleted. Effective January 1, 2027, the right to delete under the CCPA applies not only to information that a covered business has collected from a consumer but also to information that it has collected about the consumer from other sources. A business that receives a request to delete personal information obtained from a source other than the consumer to whom it relates fulfills its obligation by retaining a record of the deletion request and the minimum data necessary to ensure that the information remains deleted and is not being used for any other purpose. SB 923 also modifies the consumer access requirements for a business that operates exclusively online. Current law requires such a business to provide only an email address for processing requests to delete personal information. Under the new law, the business must also provide a web form or online portal as an alternative to email for processing deletion requests.
Third, Governor Newsom vetoed a bill that would have amended the CCPA, Assembly Bill 1542. AB 1542 would have banned businesses from selling California consumers' sensitive personal information or sharing it for cross-contextual advertising purposes. Newsom wrote that the ban went too far in restricting consumer choice. Existing law allows a consumer to opt out of the sale or sharing of all personal information, and it allows consumers to limit a business's use and disclosure (broader than the concepts of "sale" and "sharing") of sensitive personal information, which includes certain government-issued identification numbers, financial account access information, precise geolocation, and other items of information. Because Governor Newsom vetoed AB 1542, this opt-out scheme will remain in place unless the legislature votes to override the veto.
Finally, Governor Newsom signed Assembly Bill 883, which concerns data brokers. Under current law, a data broker must access the California Privacy Protection Agency's accessible deletion mechanism at least once every 45 days and process all deletion requests made under Cal. Civ. Code § 1798.99.86 within 45 days after receiving such a request. Effective January 1, 2027, those time windows will each shorten to 30 days. AB 883 also adds a new section, Cal. Civ. Code § 1798.99.86.5, concerning the personal information of elected officials and judges. The new section specifies the state agencies responsible for informing elected officials and judges of their rights under Cal. Civ. Code § 1798.99.86 to have their personal information deleted. It also increases data broker liability with regard to these consumers by authorizing courts to impose punitive damages for violations of the deletion requirements in the case of elected officials and judges. Cal. Civ. Code § 1798.99.86.5 takes effect on July 1, 2027.