At the time of our September blog post, the California legislature had passed several privacy-related bills which were waiting for the Governor’s signature or veto. The Governor had until the end of September to take action. While some bills were vetoed, many more were signed into law.
The California Consumer Privacy Act (CCPA), as amended, is amended again by SB 1223/AB 1008 and AB 1824. SB 1223/AB 1008 adds “neural data” to the definition of sensitive personal information. It also clarifies that personal information can exist in various formats, including paper, digital, and in artificial intelligence models. AB 1824 provides that opt-out requests need to follow any transfer of personal information to another business as part of a merger, acquisition, or bankruptcy.
The Protecting Our Kids from Social Media Addiction Act (SB 976) goes into effect January 1, 2027. The Act requires a privacy-protective default setting in social media apps for all minors under 18 years old located in California and the social media app’s default feed cannot be based on the minor’s interaction with the social media app. The Act bars social media companies from deploying addictive feeds to known minors without verifiable parental consent and from sending notifications to minors without verifiable parental consent during certain hours. Parents are also granted controls to limit access, view likes, and set a minor’s account to private. The Attorney General is tasked with promulgating rules before the effective date.
The Youth Social Media Protection Act (AB 2481) goes into effect January 1, 2026. The Act requires social media companies to have a process for school principals and licensed mental health professionals to report threats or violations of the social media’s terms of service. Social media companies also need to publish annual reports of the number of reports they receive.
The California Student Online Personal Information Protection Act (SOPIPA) gets a new name under AB 801: the K-12 Pupil Online Personal Information Protection Act (K-12 POPIPA). In addition to changing the terminology of “student” to “pupil,” the K-12 POPIPA adds an exception so that standardized test providers do not need to delete standardized test results. It also provides that any personal information not covered by CCPA that is collected by Ed Tech businesses must be deleted if a pupil or the pupil’s parent makes a deletion request when the pupil is no longer enrolled in the school, unless the records are otherwise required to be maintained. Although called the K-12 POPIPA, it also provides rights to preschool pupils.
AB 2741 reduces the time from 72 hours to 24 hours after a rental car has not been returned for a rental car company to be permitted to activate electronic surveillance technology.
The Governor also signed a number of Artificial Intelligence (AI) bills that have privacy crossover:
- AB 2013 provides that developers need to publicly provide information about the data used to train generative artificial intelligence (GenAI), beginning January 1, 2026.
- SB 926 makes it a misdemeanor to create or distribute computer-generated realistic sexual images.
- The California AI Transparency Act (SB 942) requires, in part, that large GenAI systems must provide users with an AI detection tool to assess whether content was created or altered by GenAI. This tool cannot provide information that is reasonably capable of being associated with a particular user, including personal information and unique device information associated with a particular user.
Please note that these are high level summaries of the laws and there may be exceptions to applicability. Consult an attorney for more specific information about how these laws may apply to your organization. If you need assistance reviewing your company’s or non-profit organization’s compliance with privacy obligations, please contact our privacy & data security team.
This article is provided for informational purposes only—it does not constitute legal advice and does not create an attorney-client relationship between the firm and the reader. Readers should consult legal counsel before taking action relating to the subject matter of this article.
