California’s legislative session closed out at the end of August, and Governor Newsom used his signing deadline (September 30th) to put roughly 30 privacy and AI related bills into law, while vetoing four. Children’s and student data drew the most legislative attention this year, with nine bills signed, and health and employment each picked up their own cluster of new rules. Below is what changed, grouped the way most compliance teams will need to act on it.
Deletion rights get a lot bigger: SB 923
SB 923 is the bill to build your 2027 roadmap around. It expands the CCPA deletion right to cover all the personal information a business holds about a consumer: data collected directly, data obtained from third parties, vendors, or data brokers, and inferences drawn from any of it. Businesses that operate exclusively online with a direct consumer relationship also have to add a web form or portal for access, deletion, or correction requests; relying on email alone is no longer enough. Existing CCPA exemptions still apply. The change takes effect January 1, 2027.
Smaller changes with real teeth
AB 2561 bars operating system and app updates from overriding a consumer’s affirmative privacy choices unless the consumer consents or a statutory exemption applies. AB 883 shortens the DROP data broker deletion deadline from 45 days to 30, also effective January 1, 2027. SB 690 moves specified pen register and trap-and-trace claims about website and app tracking under California’s wiretap statute to the attorney general only, though other private claims remain on the table. The change applies retroactively for two years. SB 354 amends the Insurance Information Privacy Protection Act, effective July 1, 2028. On enforcement, the state’s privacy regulator reminded data brokers to keep their registration accurate and ran a public “Delete Week” campaign in October promoting the DROP mechanism, which could mean a bump in deletion requests headed your way.
Four bills did not survive the session: AB 1542 (sensitive data sales and sharing), SB 1130 (wearable recording devices), and two AI healthcare bills, including one on AI’s role in mental health treatment. Expect versions of them to return in a future session.
Children, students, and chatbots: the busiest category
California’s nine children’s privacy bills fall into three groups. Youth protections: AB 2246 repeals and replaces the Age-Appropriate Design Code Act after the original was challenged in court, AB 1709 bars statutorily defined addictive features for users under 16 and creates an e-safety advisory commission, AB 1856 adds a secure age-bracket signal to the state’s Digital Age Assurance Act so apps can confirm a user’s age range without collecting an exact age, and AB 2 creates civil liability for major social media platforms when minors are injured.
Student data: AB 302 bars schools from making an addictive feed the only way they communicate with students or a condition of joining extracurriculars, AB 1159 restricts targeted ads, profiling, data sales, and AI training on student data, and AB 2392 sets governance and training standards for schools using generative AI tools.
Companion chatbots: SB 867 puts a five-year ban on selling or distributing toys for children under 16 that contain a companion chatbot, and SB 1119 requires companion chatbot operators serving minors under 18 to conduct risk assessments. Two recent enforcement actions explain the attention here: a multistate settlement with Meta over teens’ personal information, and a $400 million settlement between TikTok, ByteDance, the DOJ, and the FTC under COPPA.
AI at work, in healthcare, and in content
At work: SB 947 bars automated decision systems that violate labor or civil rights laws, infer protected status, or retaliate against workers, effective July 1, 2027; AB 1883 bans AI surveillance that collects neural data or reads employee emotions; AB 1331 bans workplace bathroom surveillance, with a narrow exception for brief entry and exit checks.
In healthcare: AB 1979 bars providers from using AI to independently perform clinical functions that require a licensed professional; SB 503 requires reasonable efforts to identify foreseeable bias in clinical decision support tools, with documentation duties for developers and ongoing monitoring duties for deployers.
On content: AB 2713 sets provenance data mandates, SB 1050 covers synthetic performers in ads, and SB 1111 covers digital replicas of real people. SB 1000 amends the California AI Transparency Act, removing its 1 million monthly user threshold and adding a $50,000 per-violation penalty for falsely claiming the assistive technology exemption. AB 1609 requires businesses with more than $500 million in US gross annual revenue to disclose AI customer service chatbots and offer a route to a human agent.
California’s frontier model rules
California is also standing up governance for frontier AI models, generally those trained with more than 10^26 operations of compute, with added duties for large developers above $500 million in affiliated annual revenue. Catastrophic risk is defined narrowly and tied to specific conduct, such as expert-level help building a weapon, defined as a foreseeable risk of death or serious injury to more than 50 people or more than a billion dollars in property damage. Penalties run up to $1 million per violation, incident reports are due within 15 days (24 hours for imminent risk of death or serious injury), and whistleblowers are protected. SB 813 (verification organizations) and AB 1405 (an auditor registry) build the audit infrastructure, with agency milestones of May 1 and December 1, 2027; developer audit deadlines haven’t been set yet.
What to do now
Update deletion workflows for SB 923 and add a web form or portal if you’re online-only. Test that OS and app updates preserve privacy choices under AB 2561, and prepare your DROP process for the 30-day cycle under AB 883. If your service reaches children, assess design-related harms under AB 2246 and disable addictive features for users under 16. Inventory your chatbots and separate customer service bots from companion bots, since they fall under different rules and timelines. On the HR side, list your automated decision and monitoring tools, require substantive human corroboration where discipline or termination relies primarily on automated output, and drop emotion recognition entirely. In marketing, disclose synthetic performers in ads and get prior authorization before commercial use of a digital replica.
SB 923 means more data in scope and no more email-only requests. See how TrustArc helps you collect, route, and fulfill deletion requests across every system before January 1, 2027.
Explore Individual Rights Manager
