California Privacy and AI Roundup 2026: What Passed and What Didn’t

As Governor Newsom approaches the end of his final term, the close of California’s 2025–2026 legislative session combines an expansion of AI regulation with a selective recalibration of privacy law. New measures address employment decisions, companion chatbots, content transparency and AI auditing, while privacy legislation expands consumer protections and narrows certain avenues for litigation. The Governor’s vetoes were also notable, including a categorical ban on selling or sharing sensitive personal information. Our annual roundup examines this mix of new compliance obligations, targeted litigation relief and limits on particular regulatory approaches.

Key Takeaways

California continues to set de facto national policy on regulation of emerging technology. While 2025 delivered a single signature framework law for frontier AI developers (SB 53) alongside a handful of targeted measures, 2026 produced a broad, sector-by-sector buildout: the nation’s first statutory guardrails on AI in employment discipline and termination, the strongest child safety regime for chatbots in the country, a new state infrastructure for licensing AI auditors, and a significant overhaul of the California AI Transparency Act.

In data privacy, the headline is litigation relief: SB 690 effectively ends one path toward private California Invasion of Privacy Act (CIPA) suits over website pixels and cookies, handing that enforcement exclusively to the Attorney General although lawmakers chose to keep other paths open. Other passed legislation expanded CCPA deletion rights, tightened data broker response deadlines and introduced a sweeping children’s online safety package that replaces the enjoined Age-Appropriate Design Code. At the same time, the Governor drew a line at categorical restrictions, vetoing a ban on the sale and sharing of sensitive personal information even as other states enacted similar bans this year.

Finally, the Governor paired his signatures with executive action. A September 18 executive order directs state agencies to recommend statutory changes that could include third-party safety evaluations and emergency shutoff (“kill switch”) requirements for frontier models, and he has left the door open to a special session on AI before he leaves office.

Artificial Intelligence Regulation Expands

California’s new AI measures address both particular uses of automated systems and the organizations that assess them. The result is a more differentiated regulatory framework with obligations that turn on how AI is deployed, whom it affects and the role a business plays.

AI in Employment and the Workplace

• SB 947 (McNerney): No Robo Bosses Act. In a reversal of his 2025 veto of SB 7, the Governor signed a narrowed version of the bill that prohibits employers from relying solely on an automated decision system (ADS) to make disciplinary or termination decisions. Where an employer relies primarily on ADS output, a human reviewer must corroborate the decision using other relevant information (such as managerial evaluations, peer reviews and personnel files), and the affected worker must receive a post-use notice, a description of the employee data the system used and a human point of contact. The law takes effect July 1, 2027 and includes civil penalties of $500 per violation.
• AB 1883 (Bryan): Emotion Recognition and Neural Data. Employers may no longer use workplace surveillance tools that employ AI to infer or predict an employee’s emotional state or to collect “neural data” (information generated by measuring activity of the central or peripheral nervous system), subject to limited exceptions, including for safety. The law takes effect January 1, 2027 and is enforceable by the Labor Commissioner and public prosecutors with civil penalties of up to $500 per violation.
• AB 1331 (Elhawary) and SB 951 (Reyes): Workplace Surveillance and AI-Driven Layoffs. AB 1331 restricts employer surveillance in workplace bathrooms, including devices with embedded AI, while SB 951 requires Cal/WARN notices to disclose mass layoffs, relocations or terminations caused substantially by AI or automation. Both laws take effect January 1, 2027 and are subject to existing enforcement mechanisms and civil penalties.

Safeguards and Restrictions for Companion Chatbots

• SB 1119 (Padilla, Wicks, Bauer-Kahan): “Adam’s Law” Companion Chatbot Child Safety. Building on 2025’s SB 243, this law requires companion chatbot operators to conduct risk assessments before release, implement suicide and self-harm crisis protocols, apply protective default settings for child users, offer parental controls, and notify parents when safety settings are disabled. Beginning January 1, 2029, operators must undergo independent child safety audits every two years (operators with under $500 million in revenue are exempt until 2032). Core operational requirements take effect July 1, 2027. The law authorizes public prosecutor enforcement and a private right of action for a child who suffers actual harm.
• SB 867 (Padilla): Companion Chatbots in Toys. Prohibits the manufacture, sale or possession with intent to sell any toy that includes a companion chatbot. Customer service bots, game-limited features and standalone virtual assistants that do not sustain relationships are excluded. The law takes effect January 1, 2027 and the moratorium sunsets January 1, 2031.

Changes to Transparency and Provenance Framework

• SB 1000 (Becker) and AB 2713 (Wicks): AI Transparency and Provenance. Together, these laws expand and operationalize the California AI Transparency Act’s provenance framework. SB 1000 removes the one million monthly user threshold from the definition of “covered provider,” substantially broadening the generative AI providers subject to the Act, and eliminates the obligation to provide disclosures while retaining latent, machine-readable provenance disclosures. Complementing those requirements, AB 2713 requires large online platforms to provide a user interface indicating whether content was generated or substantially altered by generative AI or captured by a recording device and to allow users to access the underlying provenance data. Platforms receive a safe harbor for provenance data that does not comply with widely adopted specifications from an established standards body. SB 1000 took effect immediately upon signature and carries civil penalties of $5,000 per violation per day, while AB 2713 takes effect January 1, 2027 and operates within the Act’s existing enforcement framework.
• SB 1050 and SB 1111 (Ashby): Disclosures for Synthetic Performers and Digital Replicas. These laws address deceptive or undisclosed uses of AI-generated identities in advertising, impersonation and customer service, recalling existing laws in other states such as New York. SB 1050 requires clear and conspicuous disclosure when advertisements prominently feature AI-generated, human-like performers, and SB 1111 clarifies that California’s right of publicity protects against unauthorized digital replicas of a person’s voice or likeness and adds criminal exposure for digital-replica impersonation. Both laws take effect January 1, 2027 and are enforced through existing false-advertising, unfair-competition, right-of-publicity, criminal or public-prosecutor mechanisms.
• AB 1609 (Zbur): Customer Service Chatbots. Businesses with more than $500 million in annual gross revenue may not represent a customer service chatbot as human and must clearly disclose that it is automated. They must also offer a simple way to reach a human agent during business hours and make a good-faith effort to connect the customer within 15 minutes or schedule a callback within one business day. Hospitals (for health care communications), consumer reporting agencies, regulated utilities and certain B2B communications are exempt. The law takes effect January 1, 2027, is enforceable by a public prosecutor, and carries civil penalties of up to $5,000 for an initial violation and $10,000 for each subsequent violation.

Formalizing AI Auditing

• SB 813 (McNerney): Independent Verification Organizations. Requires the Government Operations Agency to establish, by January 1, 2028, a process for selecting and overseeing independent verification organizations (IVOs) with demonstrated expertise in assessing AI risk. Notably, the law does not require developers or deployers to engage an IVO.
• AB 1405 (Bauer-Kahan): AI Auditor Registry. Requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029. From that date, unregistered persons may not offer, sell or conduct a covered AI audit, and registered auditors must display their registration number in advertising. With SB 813, California now has the first state-level framework for overseeing the AI assurance industry itself.

Selected Sector-Specific Measures on AI

• AB 1979 (Bonta) and SB 503 (Weber Pierson): AI in Health Care. These laws preserve the professional judgment of physicians and other licensed providers when AI or clinical decision tools are used in patient care and require developers of clinical decision tools to take reasonable steps to mitigate known or reasonably foreseeable bias. Both build on 2025’s AB 489, which barred AI systems from implying that care is being delivered by a licensed professional. Both laws take effect January 1, 2027. The laws will be enforced through professional licensing boards, including the Medical Board of California and the Osteopathic Medical Board for physicians, and through facility and clinic licensing enforcement mechanisms.
• SB 574 (Umberg): Attorneys, Arbitrators and Judicial Officers. Prohibits attorneys from fully delegating core legal work (such as drafting briefs or exercising legal judgment) to AI and addresses AI use by arbitrators, judicial officers and alternative dispute resolution providers. The law takes effect January 1, 2027. Violations may draw sanctions under Code of Civil Procedure section 128.7 (including attorney’s fees and penalties), and the attorney conduct duties are enforceable through State Bar discipline.

Privacy Protections Expand Through Consumer Rights and Children’s Safeguards

These privacy measures expand certain consumer protections while changing how businesses must implement them. Their effects range from broader deletion rights to restrictions on product features, privacy settings and sector-specific data practices.

Consumer Rights and Data Practices

• SB 923 (Becker): Expansion of CCPA Deletion Rights. The CCPA’s deletion right previously reached personal information collected “from” the consumer. SB 923 extends the right to all personal information a business holds about a consumer, regardless of source, and requires businesses that operate exclusively online to provide an online method, such as a webform or portal, for submitting privacy requests. The law takes effect January 1, 2027 and is enforced by the California Privacy Protection Agency and the Attorney General.
• AB 883 (Lowenthal): Data Broker Responses to Deletion Requests. AB 883 shortens data brokers’ deadline for responding to consumer requests from 45 to 30 days and requires officials, including elected officials and judges, to receive information on submitting deletion requests through the Delete Request and Opt-Out Platform (DROP). The shortened deadlines take effect January 1, 2027 and remain subject to the California Privacy Protection Agency’s existing Delete Act enforcement. Provisions for officials and judges become operative July 1, 2027 and authorize the Attorney General, county counsel or city attorneys to sue data brokers that fail to delete an official’s or judge’s personal information.
• AB 2561 (Valencia): Consumer Privacy Requests and Settings. AB 2561 prohibits operating systems and applications from reversing users’ affirmative privacy choices after software updates or policy changes without consent, except where legally required. The law takes effect January 1, 2027, sits outside the CCPA, and specifies no standalone penalty or enforcement mechanism.
• SB 354 (Limón): Insurance Information and Privacy Protection Act Overhaul. Repeals and replaces California’s Insurance Information and Privacy Protection Act, aligning insurance privacy rules with the CCPA. Beginning July 1, 2028, it applies to insurance licensees, surplus line insurers, reinsurers and their third-party service providers, requiring standalone privacy notices, consent for sharing beyond insurance transactions, data minimization and written retention schedules and granting consumers rights to access, correct and delete information and to receive explanations of adverse underwriting decisions. The law is enforced by the Insurance Commissioner who gains expanded oversight and monetary penalties for privacy violations.

New Regulations for Children and Teens

• AB 2246 (Wicks): Age-Appropriate Design Code Replacement. This law repeals the partially enjoined California Age-Appropriate Design Code Act and replaces it with a framework requiring businesses whose online services are likely to be accessed by children (defined as under 18) to take reasonable steps to prevent specified harms. The law prohibits profiling children by default (permitting it only with the child’s opt-in consent or parental consent for children under 13), collecting or sharing personal information not necessary to provide the service, and using dark patterns to elicit children’s data or weaken privacy protections. The law takes effect January 1, 2027 and is enforced by the Attorney General and public prosecutors with civil penalties of up to $5,000 per affected child for negligent violations and up to $15,000 for intentional violations.
• AB 1709 (Lowenthal) and AB 1856 (Wicks): Age Assurance and Addictive Features. These laws prohibit social media and similar platforms from offering personalized feeds, autoplay, push notifications and other “addictive features” to users under 16 while refining the operating-system and app-store framework enacted in 2025 through AB 1043 for communicating accurate age-bracket signals to developers. Both take effect January 1, 2027 and are enforced by the Attorney General, with AB 1709 also authorizing local public-prosecutor enforcement and penalties of up to $25,000 per affected minor for negligent violations and $50,000 for knowing violations.

CIPA Reform: A Counterweight to Expanded Obligations

• SB 690 (Caballero): CIPA Pen Register and Trap-and-Trace Reform. Responding to a flood of litigation alleging that common website technologies, such as pixels and cookies, are “pen registers” or “trap-and-trace” devices under CIPA, SB 690 removes the private right of action for those claims where the conduct occurs on a website, online application or mobile application and gives the Attorney General sole authority to bring them. Other CIPA sections that also have private rights of action and statutory damages, including wiretapping claims, are unaffected. The law becomes operative January 1, 2027 and reaches pending claims in actions filed within the prior two years (i.e., on or after January 1, 2025)—meaning that many pending pen register suits should become subject to dismissal. In a brief signing message, the Governor urged the Legislature to take up CIPA’s other provisions next year, and the business coalition that backed the bill has said it will keep pressing for reform of Section 631, CIPA’s wiretapping provision that is still pervasively used for shakedown litigation against website owners of all types and sizes.

Notable Vetoes: Where California Stopped Short

These selected vetoes highlight questions about the scope, necessity and implementation of additional technology restrictions.

• AB 1542 (Ward): Ban on Sale and Sharing of Sensitive Personal Information. Co-sponsored by Consumer Reports and opposed by major advertising trade groups, this bill would have replaced the CCPA’s opt-out approach with a broad prohibition on selling or sharing sensitive personal information, including precise geolocation, health, financial and biometric data, subject to limited exceptions. In his veto message, the Governor said he supported the goal but characterized a categorical ban as going too far, pointing to consumers’ existing right under the CCPA to limit use and disclosure of their sensitive information as well as budget constraints on implementation and enforcement.
• SB 1130 (Reyes): Wearable Recording Devices. Would have restricted nonconsensual recording with wearable devices in private business spaces and required recording indicators, with penalties of up to $2,500 per violation. The Governor vetoed the proposal as overly broad and partly duplicative of existing law.
• AB 2575 (Ortega): AI in Health Care Services. This bill sought to protect health care workers from retaliation for overriding AI outputs within their scope of practice, would have required facilities to disclose information about AI systems used in patient care, and would have barred defendants who developed or deployed a clinical decision support system from arguing that a clinician’s failure to override the system was a superseding cause of the harm. A broad coalition of hospitals, physicians, health plans and life sciences groups opposed the bill as unworkable and costly.
• SB 903 (Padilla): AI in Mental Health Care. The “Wellness and Oversight for Psychological Resources Act” would have barred offering or advertising psychotherapy not delivered by a licensed professional, prohibited licensed professionals from allowing AI to make independent therapeutic decisions or detect emotions or mental states, and required informed consent before AI was used to record or transcribe sessions. Violations would have carried civil penalties of up to $10,000, enforced by the Department of Consumer Affairs. The bill passed the Senate unanimously and the Assembly 71-4 and would have aligned California with Illinois and Nevada, which similarly restrict AI in mental health treatment.

What’s Next?

This year’s enactments might be seen as moving California’s AI regulations beyond the transparency-first posture of 2025 and into firmer prohibitions and restraints on AI deployments. Newly introduced controls include specific prohibitions, mandatory human review, independent audits and a licensing regime for the auditors themselves. Compliance timelines are staggered with various obligations rolling out throughout 2027 and audit and registry obligations phasing in from 2028 onward. Companies deploying AI in HR, consumer-facing chats, health care or content generation should pay particular attention and begin inventorying relevant systems now.

AI and privacy legislation is likely to remain very active in 2027, and vetoed measures often return in subsequent sessions, as we saw with the narrower “No Robo Bosses Act” passed last month. The 2027–2028 legislature will be elected in November, and legislators will begin introducing priority legislation in December. We anticipate a number of AI focused bills to be among those introduced, providing an early indication of the new legislature’s AI agenda and proposals that may reach the new governor.

Manatt will continue to monitor these developments and provide additional guidance as implementation proceeds.