Last Week, This Morning

October 5, 2026

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On September 27, California Governor Gavin Newsom signed Assembly Bill 2782, which amends certain disclosure requirements for vehicle contract cancellation option agreements under the state's Automobile Sales Finance Act.

A vehicle contract cancellation option agreement is a paid, optional agreement that gives a used car buyer a "cooling-off period" to return the vehicle within a set timeframe for a full refund (minus a restocking fee and if certain mileage conditions are met). Under the California CARS Act, prior to October 1, 2026, consumers who purchased a used car for less than $40,000 must be offered a 2-day contract cancellation option agreement. However, effective October 1, 2026, the contract cancellation option agreement transitioned to a 3-day right to cancel for vehicles priced up to $50,000.

California's ASFA generally regulates motor vehicle conditional sale contracts. Under existing law, the ASFA defines "cash price" to mean the amount for which the seller would sell and transfer to the buyer title to the vehicle described in the conditional sale contract, if the property were sold for cash at the seller's place of business on the date the contract is executed, and includes applicable taxes and the cash price of accessories or services related to the sale, including, among other things, a vehicle contract cancellation option agreement. The ASFA requires a conditional sale contract to contain certain disclosures, including the amount charged for a contract cancellation option agreement. Under existing law, the ASFA also requires a seller to provide specified information to a buyer prior to the execution of a conditional sale contract, including a description and the price of a contract cancellation option agreement.

A.B. 2782 removes the fee for a contract cancellation option agreement from the definition of "cash price." The cost of a contract cancellation option agreement is now categorized as a separate itemized charge rather than being bundled into the cash price. The new law also removes the requirement that a conditional sale contract disclose the amount charged for a contract cancellation option agreement. Finally, it removes the requirement that a seller provide to a buyer, prior to the execution of a conditional sale contract, a description and the price of a contract cancellation option agreement.

Amicus Brief(ly): First up in this All-California edition is this bill, which goes along with California S.B. 766 that amended the CARS Act to extend the right to cancel a retail installment sale contract for one more day. The impetus for these bills is to give consumers more time to review the contract, to consider the costs involved with the purchase, and to look through the sale and finance documents to ensure that they are getting the deal they thought they were getting. The changes in A.B. 2782 realign the ASFA disclosures to require separate disclosure of a fee that the dealer may charge consumers who exercise the option to cancel ($200 to $600, plus a mileage fee), which the dealer cannot require the consumer to prepay (hence its removal from the disclosed cash sale price). We recommend that California dealers and finance companies review the two bills to see how they affect their sale and finance documents.

On September 30, California enacted Assembly Bill 801, the California Fair Lending Examination Act, which requires the state's Department of Financial Protection and Innovation to examine supervised banks and credit unions, as well as licensed residential mortgage lenders and servicers, for fair lending compliance with applicable mortgage lending laws at least once every four years.

The new law provides that the DFPI must examine the entity for compliance with any nondiscrimination law applicable to mortgage lending, including the federal Equal Credit Opportunity Act, the federal Fair Housing Act, the California Fair Employment and Housing Act, the state's Holden Act, and the state's Unruh Civil Rights Act. The DFPI must provide a written statement of its examination findings to the subject entity and take appropriate steps to ensure correction of any violations of applicable nondiscrimination laws. The statement of findings may not be disclosed to anyone other than the subject entity, law enforcement officials, or other state or federal regulatory agencies for further investigation and enforcement.

The DFPI may exempt from examination, or examine less frequently than otherwise required, a bank or credit union that demonstrated full compliance with applicable nondiscrimination laws in the most recent examination of the entity.

The new law takes effect on January 1, 2027.

Amicus Brief(ly): This new Act is a clear reaction to the federal fair lending pullback, especially with regard to the "disparate impact" theory of liability that says that facially neutral underwriting and pricing policies can still adversely affect protected consumers, requiring a legitimate business justification for those policies. California joins Illinois among the states that have taken steps to codify the theory and also makes a review for disparate impact an express part of the licensing examination process for DFPI licensees. Importantly, any exam findings remain confidential unless they lead to public enforcement actions. While the federal agencies have focused on intentional discrimination, this bill reminds us that several states still view the disparate impact theory of liability as a viable fair lending claim.

On September 27, California Governor Gavin Newsom signed Senate Bill 923, which amends the California Consumer Privacy Act. The CCPA grants to a consumer various rights with respect to personal information that is collected by a business. Among those rights is the right to request that a business delete personal information that the business has collected directly from the consumer, but not personal information about the consumer that the business has collected from third parties. Effective January 1, 2027. S.B. 923 expands that right to include requesting the deletion of any personal information that the business has collected about the consumer, including personal information that the business purchased from third parties. A business that receives a request to delete personal information obtained from a source other than the consumer to whom it relates fulfills its obligation by retaining a record of the deletion request and the minimum data necessary to ensure that the consumer's personal information remains deleted and is not being used for any other purpose.

In addition, the CCPA generally requires businesses to make certain methods of communication available for consumers to submit personal information requests, including requests for deletion and correction. If a business operates exclusively online and has a direct relationship with the consumer from whom it collects personal information, existing law requires the business to provide the consumer with an email address for submitting personal information requests. Under S.B. 923, the business must now provide an online method, such as a web form or online portal, for consumers to submit personal information requests, in addition to the existing requirement that the business provide an email address for submitting such requests.

Amicus Brief(ly): This law gives California consumers more control over the data that companies collect and share about them, continuing the trend over the past few years of states putting consumers in charge of their information. Several other states, including Delaware, New Jersey, and Maryland, have laws that require companies to delete all non-exempt personal information the way the CCPA now will. S.B. 923 also comes with procedural requirements, including one for online companies to provide a webform, not just an email address, to allow consumers to make their requests. Providers subject to the CCPA should spend some time with this new law, with just under 90 days until it becomes effective.

On September 30, in response to numerous website tracking lawsuits under the California Invasion of Privacy Act, California Governor Gavin Newsom signed Senate Bill 690, which revises the CIPA by removing a private right of action for pen register and trap-and-trace device claims under Section 638.51. Pen register or trap-and-trace device claims are types of claims that plaintiffs bring against website operators, online application providers, and mobile application developers that have allegedly violated the CIPA through website tracking technology. The new law authorizes only the attorney general to bring those types of claims. S.B. 690 does not, however, restrict the private right of action under other provisions of the CIPA, including provisions governing wiretapping. The new law is effective on January 1, 2027, but will apply to lawsuits filed in 2025 and 2026.

Amicus Brief(ly): This law provides a rare win for businesses in California by removing the private right of action against companies that track data when consumers visit their websites. Consumers have been suing companies under the CIPA, claiming that website tracking tools used without consumers' knowledge or consent amount to interception of communications in violation of CIPA and that tracking software impermissibly captured geolocation and IP address information from website visitors without their knowledge or consent in violation of CIPA. Importantly, the law does not change the prohibitions, it just helps companies avoid private lawsuits that can be expensive to defend and settle. Under the CIPA (and most other privacy and data security laws), disclosure and consent remain essential to avoiding claims like the ones the California enforcement agencies can still bring.

On September 30, California Governor Gavin Newsom signed Assembly Bill 2116, which dramatically expands the coverage of the California Financing Law with respect to commercial-purpose transactions beginning in 2028. A.B. 2116 amends the CFL to require a CFL license for a "commercial financing provider" and a "commercial financing broker," including for factoring and revenue-based financing providers and brokers. The licensing requirement is effective July 1, 2028. The law also expands the CFL's exemption from California's 10% per year constitutional usury limit to any person licensed under the CFL, regardless of the form of a transaction.

In addition, A.B. 2116 adds a new section to the CFL governing commercial financing transactions with small businesses. The term "small business" means a business entity organized for profit with annual gross receipts of no more than $16 million, with this dollar threshold subject to adjustment for inflation every two years. For purposes of determining a business entity's annual gross receipts, a licensee may rely on any relevant written representation by the business entity, including information provided in any application or agreement for commercial financing.

The new provisions add several consumer-type protections to commercial-purpose financing transactions. For example, the new provisions:

• prohibit confessions of judgment;
• incorporate by reference California's unconscionability standard in Cal. Civ. Code § 1670.5;
• prohibit a provision in a contract or agreement that limits or restricts the recipient from disclosing information that the recipient gains from the recipient's business activities with the commercial financing provider, including, but not limited to, terms or conditions of a product or service offered by the commercial financing provider; and
• require a commercial financing broker to clearly and conspicuously display on its website the average and maximum annual percentage rates for the commercial financing transactions that it facilitated in the most recent calendar year.

A.B. 2116 also adds a new definition of the term "commercial financing broker." The definition covers a person who does any of the following in connection with commercial financing made by a commercial financing provider:

• transmits sensitive data about a prospective recipient to a commercial financing provider with the expectation of compensation in connection with making a referral;
• makes a referral to a commercial financing provider under an agreement with the commercial financing provider that a prospective recipient referred by the person to the commercial financing provider meets certain criteria involving sensitive data;
• participates in a commercial financing negotiation between a commercial financing provider and a prospective recipient;
• counsels, advises, or makes recommendations to a prospective recipient about a commercial financing transaction based on the prospective recipient's sensitive data;
• participates in the preparation of commercial financing documents, including, but not limited to, commercial financing applications, other than providing a prospective recipient with blank copies of commercial financing documents or transmitting non-sensitive data to a commercial financing provider at the request of a prospective recipient;
• communicates a commercial financing provider's approval decisions to a prospective recipient; or
• charges a fee to a prospective recipient for services related to the prospective recipient's application for commercial financing from a commercial financing provider.

However, a person may do any of the following without being a commercial financing broker:

• perform support tasks, including, but not limited to, typing, word processing, data entry, filing, billing, answering telephone calls, taking and receiving messages, and scheduling, in support of the performance by a broker of any of the activities described in the last three items above;
• furnish to a licensee a consumer report by a consumer reporting agency in accordance with 15 U.S.C. §§ 1681b(a) or (c) (the federal Fair Credit Reporting Act);
• furnish to a licensee a consumer credit report, as defined in Cal. Civ. Code § 1785.3 (California's Consumer Credit Reporting Agencies Act), by a consumer credit reporting agency in accordance with Cal. Civ. Code §§ 1785.11(a) or (b)(1);
• furnish to a licensee a prequalifying report, as defined in Cal. Civ. Code § 1785.3, by a consumer credit reporting agency in accordance with Cal. Civ. Code § 1785.11(b)(2); or
• distribute or disseminate to a prospective recipient a provider's marketing materials or factual information about the provider, its lending activities, or its loan products, including, but not limited to, the provider's interest rates, the provider's minimum or maximum loan amounts or loan periods, or a general description of the provider's underwriting criteria.

Amicus Brief(ly): Not hoping to leave small business finance aside in its recent spate of legislation, California expanded its licensing requirements to include commercial financing providers and brokers. It is noteworthy that brokers and others who are not licensed now but who will have to be under this new law have to file their applications by July 1, 2028, likely in recognition of the increasingly long license application processing times at the DFPI. In addition to the expanded licensing requirement, the law includes several provisions that may affect business financing agreements for providers already licensed.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.