A busy few weeks in the California legislature culminated on August 31, 2026 with a wave of privacy, AI, and advertising bills sent to Governor Gavin Newsom's desk. He has until September 30 to sign or veto the bills. If he takes no action, they will become law. 

Privacy Bills

AB 1542 (Sensitive Personal Information) would amend the CCPA to ban businesses, service providers, and contractors from selling or sharing a consumer's sensitive personal information with a third party. The bill includes an exception for commercial credit reporting agencies, which may still sell a consumer's Social Security number solely to verify the consumer's relationship to a business that they own. Because selling sensitive personal information would no longer be permitted, the bill also removes the notice at collection requirement for sensitive personal information.

SB 690 (California Invasion of Privacy Act (CIPA) reform) would limit private lawsuits under CIPA's pen register and trap-and-trace provisions for conduct occurring on websites, online applications, and mobile applications, reserving enforcement authority for the California Attorney General. The bill also applies retroactively to certain pending claims. Although SB 690 would reduce exposure to one category of website-tracking litigation, it would not affect private claims under CIPA's wiretapping and eavesdropping provisions (§§ 631 and 632), which are commonly asserted in lawsuits involving cookies, pixels, chat tools, session replay technologies, and similar tracking technologies.

SB 923 (Consumer privacy requests) would expand the CCPA’s right to delete to cover personal information a business collected about the consumer, not just information collected from the consumer. Where the information wasn't collected directly from the consumer, the business may retain a record (with the minimum data necessary) to ensure that the personal information remains deleted. The bill would also require a business that operates exclusively online and has a direct relationship with the consumer to offer an online method, like a web form or portal for submitting privacy requests rather than only an email address.

AB 2246 (Online service, product, or feature: access by children) would repeal and replace California’s embattled Age-Appropriate Design Code Act with a new version of the law, requiring businesses to take reasonable steps preventing harm to children. It also removes data protection impact assessments (DPIA) from the law after being deemed unconstitutional by the Ninth Circuit. The bill would also let a child void contract provisions tied to a design feature, with enforcement limited to the Attorney General or a public prosecutor.

AB 883 (Data brokers) would impose additional compliance obligations on data brokers, including more frequent deletion reviews under the Delete Act and expedited deletion requirements for certain public officials. Data brokers must now access the Delete Request and Opt-out Platform (DROP) every 30 days (down from 45). Echoing New Jersey’s Daniel’s Law: the Secretary of State, local filing officers, and the Judicial Council must notify elected state officials and judges that they may submit a deletion request through DROP. Data brokers must delete the information on an expedited timeline of 10 days. 

AB 2561 (Operating systems and applications: privacy settings) would prohibit an operating system or application from overriding a user's privacy setting without the user's consent. 

AB 1709 (Covered platforms: age restriction) would prohibit a covered platform from providing an “addictive feature,” such as an addictive feed or autoplay, to a user under 16 and would require platforms to take reasonable measures to ensure minors are not offered those features. It would also create an e-Safety Advisory Commission within the Department of Justice and authorize the Attorney General to adopt regulations.

AI and Chatbot Bills

AB 1609 (Customer service chatbots) would require businesses with more than $500 million in gross annual revenue to provide a feature on their website that lets customers request a human agent during regular business hours. They must make a good-faith effort to connect within 15 minutes or schedule an appointment within one business day. Covered businesses must also disclose when a customer is interacting with a chatbot rather than a human, and post their customer service number conspicuously on their website.

SB 1119 (Companion chatbots: children’s safety) would build on California’s existing regulatory framework by imposing new requirements on operators of companion chatbots used by children. It would require age assurance or default child protections, prohibit chatbots from encouraging harmful conduct, limit targeted advertising to children, require certain parental controls and crisis-response procedures, and prohibit chatbots from claiming to be human or simulating romantic interest.

SB 947 (Employment: automated decision systems) would impose restrictions on employers’ use of automated systems to assist or replace human discretionary decisionmaking that materially impacts a person, including discipline and termination decisions. It would prohibit employers from relying on an automated system to infer an employees protected characteristics or make disciplinary and termination decisions without human review. The bill would also give employees the right to request the data used by an automated decision system when used to make a disciplinary or termination decision. 

SB 1000 (California AI Transparency Act) would significantly expand the scope of the California AI Transparency Act by eliminating the current 1,000,000 monthly user threshold, potentially bringing many additional publicly accessible generative AI systems within the law’s requirements. It would also revise the law’s disclosure requirements, focusing on disclosures embedded in AI-generated content rather than manifest disclosures. It would take effect immediately on signing.

Digital Replicas and False Advertising Bills

SB 1111 (Digital replicas) would expand California's right of publicity law to expressly include “digital replicas” (highly realistic computer-generated versions of a person's voice or likeness). In addition, it would make certain uses of digital replicas subject to California's false impersonation laws. The bill forms part of California’s broader AI regulation framework, granting remedies against unauthorized deepfakes and impersonation. Unlike California AB 2602 (2024), which focuses on whether contracts granting digital replica rights are enforceable, SB 1111 focuses on the unauthorized use of digital replicas themselves.

SB 1050 (False advertising: synthetic performers) would require a clear and conspicuous disclosure when an advertisement “prominently” features a “synthetic performer” (an AI-generated performer that creates the realistic impression of a human but is not actually identifiable as a specific real person). The bill is designed to prevent consumers from being misled by AI-generated advertising content and could expose advertisers to claims under California's False Advertising Law and Unfair Competition Law. Contrasted with New York’s similar law, California’s SB 1050 applies to the “prominent” use of synthetic performers (including voiceover performances) and is enforced through California's existing false advertising framework.