In the final days of California’s 2026 legislative session, California Governor Gavin Newsom signed a series of privacy legislation spanning consumer privacy rights, data broker activities, digital platform design, and civil remedies for website privacy litigation. Governor Newsom also vetoed a privacy measure that would have imposed broad restrictions on the sale and sharing of sensitive personal information. Notable bills include:
- SB 923 – Expanded CCPA Deletion Rights and Online Request Methods: SB 923 expands consumer deletion rights under the California Consumer Privacy Act (“CCPA”) from information collected “from” a consumer to information collected “from or about” the consumer. Additionally, SB 923 will add that a business that operates exclusively online and has a direct relationship with the consumer from whom it collects personal information must provide an email address and make an online method, such as a webform or online portal, available for submitting requests.
- AB 2561 – Operating System and Application Privacy Settings: AB 2561 will prohibit an operating system or application from changing that user’s affirmative “privacy setting” without the user’s consent, subject to some exceptions. The law broadly defines “privacy setting” to include any user-configurable option within an application’s privacy, or similarly labeled, menu, that governs the collection, use, sharing, disclosure, retention, or processing of personal information.
- AB 883 – Amendments to California’s Data Broker Law: AB 883 modifies California’s data broker law and requirements for the state’s Delete Request and Opt-Out Platform (“DROP”) to shorten the period within which data brokers must process applicable deletion requests submitted through DROP from every 45 days to every 30 days. AB 883 also contains provisions designed to increase awareness and use of California’s DROP mechanism by requiring certain government officials to notify other officials of their ability to submit deletion requests through the platform. Additional background on California’s Delete Act legislation establishing the framework and a recent enforcement action can be found in prior blog posts.
- SB 690 – Reform of California Invasion of Privacy Act Litigation: As detailed in our recent blog post, SB 690 eliminates the California Invasion of Privacy Act’s (“CIPA”) private right of action as it applies to certain pen register and trap-and-trace claims, though SB 690 does not eliminate or otherwise modify other CIPA provisions frequently asserted in online-tracking disputes.