California Governor Gavin Newsom signed 22 of 25 major privacy and artificial intelligence bills sent to him before the September 30 deadline, closing the state’s 2026 legislative session with changes affecting consumer data rights, website-tracking litigation and data broker compliance.
The package spans AI transparency, automated employment decisions, workplace surveillance, health care AI, chatbots, digital replicas and AI auditing, alongside changes to California’s existing privacy statutes. Three of the major bills were vetoed. The measures affect a range of organizations, including employers, technology companies, health care providers and businesses handling children’s information.
One significant change comes through SB 690, which limits private lawsuits involving certain online tracking claims under the California Invasion of Privacy Act. The law amends the statute’s civil-remedies provision, Penal Code Section 637.2, for alleged violations of Section 638.51, which governs pen registers and trap-and-trace devices.
When those alleged violations arise from activity on a website, online application or mobile application, only the California attorney general may bring a Section 637.2 action against a private actor. The change narrows a litigation route used to challenge analytics, advertising, session-replay tools and other tracking technologies. Section 637.2 otherwise permits recovery of $5,000 per violation or three times actual damages, whichever is greater, without requiring proof of actual damages.
SB 690 also affects pending litigation. Its amendments apply to pending claims in actions commenced within the two years before its January 1, 2027, operative date, covering actions filed on or after January 1, 2025. That provision makes the filing date and statutory basis of existing cases important to determining whether private claims can proceed.
The legislation does not eliminate private litigation under the broader privacy law. Claims under Sections 631 and 632 remain available, and Section 638.51’s underlying prohibition remains intact, as does the attorney general’s enforcement authority. The distinction means businesses using online tracking tools still face potential claims under provisions that SB 690 does not change.
A separate measure, SB 923, expands the California Consumer Privacy Act’s deletion right to cover personal information collected from or about a consumer. That extends the right beyond information supplied directly by an individual to include data obtained from third parties and other sources. Existing exceptions to the deletion requirement continue to apply.
For information collected elsewhere, businesses may retain a record of the deletion request and the minimum information necessary to prevent the deleted data from being restored. Online-only businesses that have a direct relationship with consumers must also provide an online request method, such as a webform or portal, in addition to an email address.
Data brokers face shorter deadlines under AB 883, which reduces certain 45-day requirements to 30 days. The law also requires notice to specified state officials about their ability to use California’s Delete Request and Opt-Out Platform, known as DROP. The platform launched on August 1, 2026, and requires more than 500 registered data brokers to process centralized deletion and opt-out requests.
Sources: National Law Review – AI