California continues to expand its privacy laws, introducing new requirements for businesses that collect, use, and share consumer information.
In late September 2026, Governor Gavin Newsom signed a broad package of privacy and artificial intelligence bills addressing consumer data rights, online privacy settings, data brokers, and website tracking litigation. Most of the provisions discussed below take effect on January 1, 2027.
The changes strengthen certain consumer protections while limiting specific types of privacy lawsuits. They also arrive just as several significant California Consumer Privacy Act (CCPA) regulatory obligations begin to phase in.
For businesses operating in California or handling residents’ personal information, the legislation raises an important question: Are existing privacy practices prepared for these new requirements?
Why California Law Reaches Companies Outside California
A company does not need an office, employees, or other physical presence in California to be subject to these laws. The CCPA applies to any for-profit entity that “does business in the State of California” and meets at least one of three thresholds: (1) annual gross revenue above $26,625,000 (as adjusted for inflation); (2) buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or (3) deriving 50 percent or more of annual revenue from selling or sharing consumers’ personal information (Cal. Civ. Code § 1798.140(d)). A “consumer” is any California resident (§ 1798.140(i)), so the law follows the data of Californians rather than the location of the business.
As a practical matter, an out-of-state company that markets to Californians through targeted digital advertising, sells products or services to California customers, or operates a website or app that collects data from California visitors may be “doing business” in California. That is especially true where the company uses cookies, pixels, or other tracking tools to collect, sell, or share information about those visitors for advertising purposes.
The same reach applies to website tracking litigation. Claims under the California Invasion of Privacy Act (CIPA) are routinely filed against out-of-state companies based on communications with California residents, and in Briskin v. Shopify, Inc. (9th Cir. 2025) (en banc), the Ninth Circuit held that a company that knowingly installs tracking software on the devices of consumers it knows are located in California may be sued in California, even if it does not specifically target the state. Out-of-state companies with California customers or website visitors should therefore treat California compliance as their own obligation, not simply a concern for California-based businesses.
What Changed?
California’s latest legislation builds on the CCPA, as amended by the California Privacy Rights Act (CPRA), which gives consumers rights over how businesses collect and process their personal information. The CCPA is enforced by the California Privacy Protection Agency (now operating as CalPrivacy) and the California Attorney General.
The following four measures are particularly important for companies managing consumer data.
- SB 923: Expanded Consumer Deletion Rights
Under the CCPA, consumers can request that covered businesses delete personal information that the business collected from the consumer (Cal. Civ. Code § 1798.105).
Senate Bill 923, signed on September 27, 2026, and effective January 1, 2027, expands these rights by extending deletion requests to information collected “from or about” consumers. This change reaches information obtained from data brokers, marketing and business partners, and data enrichment or identity-resolution vendors, as well as inferences and other derived data, subject to the CCPA’s existing exceptions.
This distinction matters because businesses frequently obtain personal information from sources other than consumers themselves, including third-party providers. To make the right workable, SB 923 permits a business to retain a record of the request and the minimum data necessary to ensure that information obtained from other sources stays deleted and is not reacquired and reused, effectively authorizing a suppression list.
The legislation also requires businesses operating exclusively online and maintaining direct consumer relationships, which today may satisfy their obligations by providing only an email address, to also offer an online method, such as a web form or privacy portal, for submitting requests to know, delete, and correct personal information (Cal. Civ. Code § 1798.130(a)(1)(A)).
What this means for businesses: Companies should review how they collect consumer information and ensure their deletion procedures account for data obtained through third parties. They should also confirm that service providers and contractors can support the broader deletion scope, and that the privacy policy accurately describes the expanded right and each available request method.
- AB 2561: Greater Control Over Privacy Settings
Assembly Bill 2561, signed on September 27, 2026, and effective January 1, 2027, addresses how operating systems and applications manage user privacy preferences.
The law generally prohibits covered companies from changing a user’s affirmative privacy setting without consent, subject to limited exceptions, such as where a change is required by law, court order, or subpoena, or where a business discontinues a product, feature, or setting in a manner that preserves or strengthens the user’s existing privacy protections.
These settings may control how personal information is collected, shared, retained, or processed. A common example is a software update that quietly resets location-sharing or ad-tracking settings to a default “on” position.
For technology companies, the legislation reinforces the importance of respecting consumer choices.
What this means for businesses: Application developers (potentially including browser and mobile app developers) and operating system providers should review privacy controls, software updates, and consent procedures to ensure user preferences are preserved. Release-management and quality-assurance processes should include a check that updates, migrations, and redesigns do not reset user-selected privacy settings.
- AB 883: Stronger Data Broker Requirements
California also strengthened its oversight of data brokers.
Assembly Bill 883 modifies requirements under the state’s Delete Act, which established the Delete Request and Opt-Out Platform (DROP). Since August 1, 2026, registered data brokers have been required to access DROP and process consumer deletion requests at least once every 45 days.
AB 883, signed on September 27, 2026, shortens the period for processing applicable deletion requests submitted through DROP from 45 days to 30 days. The shorter cycle also applies to related obligations, including how often brokers must delete newly collected information about consumers who have already submitted requests.
AB 883 also requires public agencies to notify elected officials and judges that they may use DROP and, beginning July 1, 2027, authorizes public enforcement actions, including claims for damages and attorney’s fees, against data brokers that fail to delete those individuals’ information. Existing Delete Act penalties of $200 per deletion request for each day of noncompliance remain in place.
The change increases pressure on data brokers to maintain efficient systems for identifying and deleting consumer information.
What this means for businesses: Covered data brokers should evaluate their deletion workflows, response timelines, and recordkeeping procedures to avoid compliance problems. Businesses that are not registered data brokers should still confirm whether any data-licensing or data-sharing activities could bring them within the statutory definition.
- SB 690: Changes to Website Tracking Lawsuits
Senate Bill 690 addresses litigation under the California Invasion of Privacy Act (CIPA), Cal. Penal Code § 630 et seq.
Businesses have faced lawsuits alleging that website tracking technologies, including certain analytics tools, violate CIPA’s restrictions on pen registers and trap-and-trace devices. Because CIPA provides statutory damages of $5,000 per violation, these claims, often based on pixels, analytics tags, and similar tools that capture IP addresses and device information, have generated a wave of demand letters and class actions.
SB 690 eliminates the private right of action for pen register and trap-and-trace claims under Penal Code § 638.51 arising from conduct on websites and mobile applications, leaving enforcement of those claims to the California Attorney General. SB 690 was signed on September 30, 2026, takes effect January 1, 2027, and applies to pending claims in actions filed on or after January 1, 2025.
However, the legislation does not eliminate other CIPA requirements or potential liability involving website tracking technologies. Plaintiffs continue to pursue claims under CIPA’s wiretapping provision (Penal Code § 631) and eavesdropping provision (§ 632), as well as the federal Wiretap Act, particularly against session-replay tools, website chat features, and third-party pixels that capture the contents of communications. In signing the bill, Governor Newsom noted that additional work on CIPA is needed, so further reform remains possible.
What this means for businesses: Companies may face reduced exposure to certain tracking-related lawsuits, but they should continue evaluating cookies, analytics software, and other technologies that collect visitor information. Consent management, including clear cookie banners, honoring opt-out requests, and accurate privacy policy disclosures, remains the most effective risk-mitigation tool.
Other Key Developments for 2027
The 2026 legislation does not stand alone. Several previously adopted requirements also begin to apply, and businesses should address them in the same compliance cycle:
- Opt-out preference signals. Under AB 566, the California Opt Me Out Act enacted in 2025, web browsers must offer consumers a built-in opt-out preference signal beginning January 1, 2027. Businesses that sell or share personal information are already required to treat qualifying signals, such as Global Privacy Control, as valid opt-out requests; broader browser adoption will make noncompliance easier to detect.
- Automated decisionmaking technology (ADMT). Under CCPA regulations finalized in 2025, businesses that use ADMT to make significant decisions about consumers must provide pre-use notices, opt-out rights (subject to exceptions), and access rights beginning January 1, 2027.
- Risk assessments and cybersecurity audits. The same regulations require documented risk assessments for higher-risk processing, such as selling or sharing personal information or processing sensitive personal information, and phased-in annual cybersecurity audits for businesses whose processing presents significant security risk. For the largest businesses (more than $100 million in annual gross revenue), the first audit period runs through January 1, 2028, with certifications due April 1, 2028.
- Threshold and penalty adjustments. CalPrivacy adjusts the CCPA’s monetary thresholds and penalty amounts for inflation in January of each odd-numbered year. The current applicability threshold is $26,625,000 in annual gross revenue, and the next adjustment is expected in January 2027.
Notably, Governor Newsom vetoed AB 1542, which would have prohibited the sale or sharing of sensitive personal information unless the consumer directed the disclosure. The CCPA’s existing opt-out and “right to limit” framework for sensitive personal information therefore remains unchanged.
What Should Businesses Do Next?
California’s new legislation and regulations create additional compliance considerations for companies handling personal information.
Businesses should consider several steps:
- Review privacy policies to ensure they accurately describe data collection and consumer rights. The CCPA requires privacy policies to be updated at least once every 12 months, and updates should address the expanded deletion right, available request methods, recognition of opt-out preference signals, and any use of ADMT.
- Update deletion procedures to account for expanded requests and applicable deadlines, and maintain suppression records so that deleted third-party data is not reacquired.
- Add an online request method if your business operates exclusively online; an email address alone will no longer suffice after January 1, 2027.
- Evaluate website tracking tools for potential privacy and consent issues, particularly pixels, session-replay, and chat tools that may still give rise to wiretapping claims, and confirm that your consent management platform honors opt-out preference signals.
- Audit privacy settings to confirm consumer preferences are respected and are not reset by software updates or redesigns.
- Review vendor agreements to understand how third parties collect, process, and retain personal information. Service provider and contractor terms should require cooperation with expanded deletion requests.
- Assess regulatory obligations for ADMT, risk assessments, and cybersecurity audits, and calendar the applicable deadlines.
- Confirm data broker status and, if registered, prepare DROP workflows for the shorter 30-day cycle.
Companies should also monitor the effective dates of applicable provisions and prepare for implementation before new obligations take effect. Because most of these changes take effect on January 1, 2027, the window to update policies, systems, and vendor contracts is short.
The Bottom Line
California continues to reshape how businesses manage consumer information.
Although some changes may reduce litigation exposure, others expand consumer rights and operational obligations and increase compliance expectations.
Businesses that review their data practices now may be better positioned to avoid regulatory scrutiny and costly disputes.
At Romano Law, our attorneys help businesses navigate privacy regulations, technology agreements, and legal risks associated with collecting and using consumer data.
This article is provided for general informational purposes only and does not constitute legal advice. Attorney Advertising.
Contributions to this blog by Kennedy McKinney.
