California Governor Gavin Newsom signed more than two dozen privacy and AI bills into law, covering minors’ online safety, AI accountability, data rights, surveillance, clinical AI, and AI transparency.

 

What happened

As the 2026 legislative session closed, California passed a set of privacy and AI bills, and Newsom signed more than two dozen. The measures fall into six themes: protecting minors online, AI accountability, consumer data rights, surveillance and tracking, clinical AI, and AI transparency and synthetic media. Most take effect January 1, 2027. SB 1000 took effect September 30, 2026, as an urgency measure.

 

Going deeper

  • SB 690 (CIPA reform): The bill removes the private right of action for pen-register and trap-and-trace claims based on conduct on a website, online application, or mobile application. Only the Attorney General may bring those claims. Wiretapping and eavesdropping claims under other CIPA provisions remain available to private plaintiffs.
  • AB 2246 (Age-Appropriate Design Code): Covered businesses must estimate child users’ ages with a reasonable level of certainty or extend children’s protections to all users. They must set default privacy settings for children to high, limit data collection to what the service needs, and avoid dark patterns.
  • SB 923 (CCPA deletion): Deletion rights now cover information a business collects about a consumer, not only information collected directly from the consumer. Online-only businesses must offer both an email address and an online method, such as a web form, for submitting requests.
  • SB 813 and AB 1405 (AI auditors): SB 813 directs the Government Operations Agency to set criteria by January 1, 2028 for designating independent verification organizations. AB 1405 requires AI auditors to register with the state by January 1, 2029. Neither bill mandates an audit.
  • SB 1119 (Adam’s Law): The first state law to require an outside AI audit. Certain companion chatbot operators must undergo independent child safety audits beginning January 1, 2029.

 

What was said

Newsom’s signing statement on SB 690 applauded efforts to “protect small businesses from overzealous lawsuits based on a statute written without today’s complex technological landscape in mind.” He added that “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse.”

 

Why it matters

The clinical AI laws reach into healthcare. AB 1979 requires health facilities, clinics, and physician offices to preserve licensed providers’ independent professional judgment when AI informs care. It also brings businesses that offer healthcare chatbots to consumers within the Confidentiality of Medical Information Act as providers of healthcare. SB 503 requires developers and deployers of clinical decision support systems to address bias risks, with developers providing documentation on intended uses, training data, performance evaluation, and bias mitigation.

 

The bottom line

California is moving from broad privacy principles to specific, enforceable rules with per-child and per-day penalties. Organizations that track website visitors, use AI in clinical settings, or serve minors online should review their practices before the January 1, 2027 effective date. Those facing CIPA pen-register claims should also assess how SB 690 affects active litigation and demand letters.

Read also: What makes Paubox's generative AI different from others

 

FAQs

What is the California Invasion of Privacy Act (CIPA)?

CIPA is a California law that plaintiffs have used to sue over website tracking, and SB 690 now limits only its pen-register and trap-and-trace claims.

 

What is an AI audit?

An AI audit is an independent assessment of the controls, processes, or systems built for an AI system to comply with state law.

 

Who enforces these new laws?

Enforcement varies by law, but the attorney general, local prosecutors, and the Labor Commissioner handle most of them, while some laws also allow private lawsuits.