--- title: "California’s 2026 Legislative Session Wraps: A Wave of Privacy and AI Bills Reaches the Governor, with Key Child Safety and AI Measures Signed into Law" date: 2026-09-14T17:40:00-04:00 author: "Alysa Z. Hutnik, Aaron J. Burstein, Joseph Cahill" canonical_url: "https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/californias-2026-legislative-session-wraps-a-wave-of-privacy-and-ai-bills-reaches-the-governor-with-key-child-safety-and-ai-measures-signed-into-law" section: Blog Posts --- # California’s 2026 Legislative Session Wraps: A Wave of Privacy and AI Bills Reaches the Governor, with Key Child Safety and AI Measures Signed into Law September 14, 2026 The California Legislature concluded its 2026 session on Monday, August 31, advancing a package of privacy and AI bills to Governor Newsom’s desk. Governor Newsom has since signed several of these measures into law, including child safety and AI oversight bills. The privacy measures address CCPA amendments, data broker regulation, children’s privacy and online safety, the California Invasion of Privacy Act (CIPA), privacy settings, and wearable recording devices. The AI measures address companion and customer service chatbots, AI transparency and provenance data, employment and workplace surveillance, synthetic performers and digital replicas, and state oversight of independent AI auditors and verification organizations. The bills that Governor Newsom has already signed include key child safety measures (AB 2246, SB 1119, AB 1709, SB 867, AB 1856) and AI auditor oversight bills (SB 813 and AB 1405). The Governor has until September 30, 2026, to sign or veto the remaining bills that have been sent to his desk. #### Key Takeaways for Advertisers and Marketers - **Sensitive data monetization**. AB 1542 would replace the CCPA’s current opt-out standard with a broad prohibition on selling or sharing sensitive personal information (SPI). Under the CCPA, SPI includes precise geolocation, racial or ethnic origin, religious or philosophical beliefs, health data, financial account information, and biometric information, among other data types. Companies that use sensitive data for advertising should assess their data flows, third-party relationships, and practices that may constitute sales or sharing. - **Potential limits on CIPA pixel- and cookie-tracking claims**. SB 690 could significantly limit CIPA pen-register and trap-and-trace claims involving common website tracking technologies, including pixels and cookies. The bill would give the Attorney General exclusive authority to bring these claims when they arise from conduct on a website or online or mobile application. These restrictions would apply retroactively to pending claims filed within two years before the bill’s operative date. - **New disclosure requirements for AI-generated advertising content**. SB 1050 (synthetic performer disclosures), SB 1000 (expanded AI transparency obligations), and AB 2025 (AI-altered real estate imagery) would impose disclosure requirements directly affecting marketing and advertising content. Advertisers, agencies, and creative teams should inventory uses of AI-generated or materially altered content, identify the disclosure triggers for each use, and build those disclosures into content-approval workflows. - **Children’s online safety obligations are expanding**. Governor Newsom has signed AB 1709, which restricts addictive features; SB 1119 and SB 867, which expand chatbot safety requirements; AB 2246, which establishes a ​“reasonable steps” framework for protecting children online; and AB 1856, which refines the state’s age-bracketing signal framework. Together, these measures create additional obligations for platforms likely to be accessed by users under 18. Advertisers and platforms that serve this age group should assess potential effects on age assurance, product design, chatbot use, ad delivery, and ad targeting or personalization. The sheer number of bills enacted is striking and is a sign of intense state-level interest in regulating overlapping areas of privacy, minors’ safety, and AI. Please use the links below to jump directly to specific areas of subject matter. [CCPA Amendments ](#CCPAAmendments) [Data Broker Regulation](#DataBrokerRegulation) [Children’s Privacy and Online Safety](#ChildrensPrivacyandOnlineSafety) [California Invasion of Privacy Act (CIPA) Reform](#CIPAReform) [Privacy Settings](#PrivacySettings) [AI and Chatbot Regulation ](#AIandChatbotRegulation) [AI Transparency](#AITransparency) [Employment and Workplace AI](#EmploymentandWorkplaceAI) [Name, Image, and Likeness / Synthetic Performers](#NameImageandLikenessSyntheticPerformers) [AI Auditor Regulation](#AIAuditorRegulation) #### CCPA Amendments [**AB 1542**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1542) **(Sensitive Personal Information Sale/Share Ban)**. This bill amends the CCPA to prohibit businesses from selling or sharing a consumer’s SPI. Under the CCPA, SPI includes precise geolocation, racial or ethnic origin, religious beliefs, health data, financial account details, biometric information, among other categories. An exception to the prohibition would apply when a consumer uses or directs the business to intentionally disclose the information to a third party. Businesses that monetize SPI through advertising, analytics, affiliate sales, or other arrangements should map those disclosures to determine whether they are permissible under AB 1542 and assess whether the ​“Limit the Use of My Sensitive Personal Information” option remains relevant to their practices. [**SB 923**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB923) **(Expansion of CCPA Deletion Rights)**. This bill addresses a limitation in the CCPA’s deletion provisions. Under existing law, a consumer may request deletion of personal information collected ​“from the consumer,” which could be interpreted to exclude information a business obtains from third parties. SB 923 expands the CCPA’s deletion right to cover *all* personal information a business holds about a consumer, regardless of source. The bill also requires businesses that operate exclusively online to provide an online method, such as a webform or portal, for submitting privacy requests. Marketers that retain or control third-party data used to build audience segments should assess whether their access, deletion, and correction processes require changes. #### Data Broker Regulation [**AB 883**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB883) **(30-Day DSR Response Deadline for Data Brokers)**. This bill reduces the response deadline for data subject requests to data brokers from 45 days to 30 days and requires data brokers to provide state officials with notice of their right to submit deletion requests through DROP. Registered data brokers should assess their DROP and deletion request intake procedures and subsequent verification, deletion, and downstream-notification procedures to determine whether they need to make changes to meet the 30-day deadline. #### Children’s Privacy and Online Safety [**AB 2246**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB2246) **(Age-Appropriate Design Code Replacement)**. Signed by Governor Newsom on September 10, 2026, this law repeals the California Age-Appropriate Design Code Act and replaces it with a framework requiring businesses that provide online services likely to be accessed by children to take reasonable steps to prevent specified harms to children. The law defines ​“child” as an individual under 18 years of age. The law prohibits profiling children by default. Profiling is permitted only with a child’s opt-in consent or with parental consent for children under 13. The law also prohibits collecting or sharing personal information that is not necessary to provide the service, and using dark patterns to encourage children to provide personal information or reject privacy protections. [**AB 1709**](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1709) **(Addictive Features for Users Under 16)**. Signed by Governor Newsom on September 10, 2026, this law prohibits ​“covered platforms,” defined as social media platforms and other online services that allow users to create public or semi-public profiles and share content, from providing ​“addictive features” to users under 16 and requires such platforms to adopt reasonable measures to ensure that such users are not offered or provided an addictive feature. Addictive features include personalized algorithmic feeds, autoplay features, push notifications, and other psychologically exploitative design elements intended to maximize engagement. The law also creates an e-Safety Advisory Commission within the California Department of Justice and subjects knowing violations to civil penalties of up to $50,000 per affected minor. [**AB 1856**](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1856) **(Digital Age Assurance Act Amendments)**. Signed by Governor Newsom on September 10, 2026, this law amends the Digital Age Assurance Act, which was enacted through AB 1043 in 2025. AB 1043 established an age-bracketing signal framework under which operating system providers must collect a user’s birth date or age at account setup and provide that information to application stores and developers upon request. AB 1856 refines this framework in several ways. Most significantly, it removes AB 1043’s definition of ​“user,” which was limited to ​“a child that is the primary user of a device.” Because that definition technically classified every device owner as a child, it made the signaling framework challenging to put into practice because it did not provide a way to affirmatively declare that a device belongs to an adult. Removing the definition of ​“user” is intended to enable accurate age-bracket signals for users of all ages. The bill also exempts open-source operating systems by excluding entities that distribute software under license terms that permit recipients to copy, redistribute, and modify the software from the definition of ​“operating system provider.” Earlier versions of AB 1856 would have extended age-bracketing requirements to browsers and websites, but the enacted version is limited to operating systems and application stores. For commercial operating system providers and app store operators, the core obligations remain. At account setup, the system must collect the user’s birth date or age and provide app developers with a real-time signal identifying whether the user is under 13, between 13 and 15, between 16 and 17, or 18 or older. A developer that receives the signal is deemed to have ​“actual knowledge” of the user’s age range, even if the developer disregards it. #### California Invasion of Privacy Act (CIPA) Reform [**SB 690**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB690) **(CIPA Pen-Register and Trap-and-Trace Reform)**. This bill responds to widespread litigation alleging that common website technologies, including pixels and cookies, qualify as ​“pen registers” or ​“trap-and-trace” devices under CIPA and result in the disclosure of non-content information to third parties without consumers’ consent. SB 690 effectively removes the private right of action from CIPA’s pen register and trap-and-trace provision where conduct ​“occurring on an internet website, online application, or mobile application” is concerned and gives the California Attorney General the sole authority to bring such claims. SB 690 does not affect other rights under CIPA. The restrictions on pen register/trap-and-trace claims would apply retroactively to pending claims filed within two years before the bill’s operative date. #### Privacy Settings [**AB 2561**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB2561) **(Prohibition on Silently Reverting Privacy Settings)**. This bill prohibits an operating system or application from undoing a user’s affirmative privacy-setting configuration, including after a software update or policy change, without the user’s consent, except when required by law, court order, or subpoena. A ​“privacy setting” is any user-configurable option within an application’s privacy menu that governs the collection, use, sharing, disclosure, retention, or processing of personal information. #### Wearable Device Privacy [**SB 1130**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1130) **(Wearable Recording Device Privacy)**. SB 1130 makes it a misdemeanor to use a wearable recording device to capture sound or video of another person in any area within a place of business, defined as a physical office or retail establishment, where the person has a reasonable expectation of privacy, unless the operator has explicit consent. The bill also prohibits disabling a light, sound, or other indicator that shows when the device is recording. Beginning January 1, 2028, wearable recording devices manufactured for sale must include a prominent recording indicator, and the bill prohibits manufacturing, selling, or distributing devices that lack such an indicator. Violations are subject to civil penalties of up to $2,500 per violation. The bill exempts hearing aids, augmentative and alternative communication devices, and similar assistive technology used to overcome a hearing or communication impairment. #### AI and Chatbot Regulation [**SB 867**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB867) **(Ban on Companion Chatbots in Toys)**. Signed by Governor Newsom on September 10, 2026, this law prohibits the manufacture, sale, exchange, or possession with intent to sell any toy that includes a ​“companion chatbot,” defined as an AI system that provides adaptive, human-like responses, exhibits anthropomorphic features, and is capable of sustaining a relationship across multiple interactions. The definition excludes bots used solely for customer service, video game features limited to game-related replies, and stand-alone virtual assistants that do not sustain relationships or elicit emotional responses. The law is a temporary moratorium that sunsets on January 1, 2031. [**SB 1119**](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260SB1119) **(Enhanced Companion Chatbot Safety Protections)**. Signed by Governor Newsom on September 10, 2026, this law creates a new child safety framework for companion chatbots, building on California’s existing companion chatbot law (SB 243). The law requires operators to perform risk assessments, implement crisis response protocols, and apply strict default settings for child users. Beginning on January 1, 2029, operators must undergo independent child safety audits every two years (operators under $500 million in revenue are exempt until 2032). The law’s core operational requirements become operative on July 1, 2027. It authorizes specified public prosecutors to bring civil enforcement actions and permits a child who suffers actual harm (or the child’s parent or guardian) to bring a private civil action. The law does not specify maximum civil penalty amounts. [**AB 1609**](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB1609) **(Customer Service Chatbot Requirements for Large Businesses)**. AB 1609 regulates customer service chatbots used by ​“large private businesses,” defined as businesses with more than $500 million in annual gross revenue nationwide that provide goods or services to customers. Covered businesses may not represent that a customer service chatbot is human and must clearly disclose that it is automated. They must also provide a simple way for customers to request a human agent during regular business hours. The business must make a good faith effort to connect the customer within 15 minutes or schedule an appointment within one business day. The bill defines ​“customer service chatbot” as an AI system with a ​“natural language interface” that provides adaptive, human-like responses. The definition does not expressly include or exclude any specific media or applications (e.g., voice, SMS, email, etc.) that chatbots use to communicate. The bill exempts hospitals for healthcare-related communications, consumer reporting agencies, regulated utilities, and certain business-to-business communications. #### AI Transparency [**SB 1000**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1000) **(AI Transparency Act Amendments)**. SB 1000 amends the California AI Transparency Act to remove the one million monthly visitor/user threshold from the definition of ​“covered provider,” expanding the scope of generative AI operators subject to the Act’s requirements. The bill also eliminates the requirement to offer manifest (i.e., visible) disclosures while retaining the obligation to embed latent (i.e., machine-readable) provenance disclosures in AI-generated content. SB 1000 is an urgency measure that would take effect immediately upon the Governor’s signature. Violations are subject to civil penalties of $5,000 per violation per day. [**AB 2713**](https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill_id=202520260AB2713&showamends=false) **(AI Transparency Act Amendments (Provenance Data Inspection))**. AB 2713 complements SB 1000 by requiring large online platforms to provide a user interface that reliably indicates whether content was generated or substantially altered by a generative AI system, or captured by a recording device. For example, a user viewing an image on a social media platform could see an indicator disclosing whether the image is AI-generated, and could download the underlying provenance data (i.e., information about when and how the content was created) to verify its authenticity before sharing it or relying on it. This capability is intended to help users identify disinformation, deepfakes, and other synthetic content. The bill includes a safe harbor providing that platforms are not required to take action on provenance data that is not compliant with widely adopted specifications issued by an established standards body. [**AB 2025**](https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB2025) **(AI-Generated Imagery Disclosure in Rental Listings)**. AB 2025 requires landlords and others marketing properties for rent to disclose when listing photos have been meaningfully digitally altered and to provide a link to the original, unaltered images. The bill extends similar disclosure obligations already in effect for property sale listings under AB 723 (2025) to the rental market. A violation by a licensee under the Real Estate Law constitutes a violation of that law. #### Employment and Workplace AI [**SB 947**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB947) **(“No Robo Bosses Act”)**. SB 947 regulates employers’ use of automated decision systems (ADS). Under the bill, employers are prohibited from relying solely on an ADS to make disciplinary or termination decisions. If an employer relies primarily on an ADS, it must direct a human reviewer to corroborate the decision using relevant supporting information and provide a post-use notice to the affected employee. SB 947 follows Governor Newsom’s 2025 veto of SB 7, an earlier version of the ​“No Robo Bosses Act.” In his veto message, the Governor expressed concern that SB 7 imposed unfocused notification requirements and overly broad restrictions that could apply even to routine workplace tools. SB 947 narrows the earlier proposal by removing references to deactivation decisions and predictive behavior analysis. It also replaces the right to receive 12 months of worker data with a right to receive a meaningful, objective description of the employee data used. The bill takes effect July 1, 2027, and imposes a civil penalty of $500 per violation. Employers should inventory ADS used in disciplinary or termination decisions, document human review and supporting evidence, and prepare post-use notice and data-description workflows before the effective date. [**AB 1883**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1883) **(Workplace Surveillance and Neural Data)**. This bill prohibits employers from using workplace surveillance tools that employ AI to collect neural data or recognize an individual’s emotional state, subject to limited exceptions. ​“Neural data” includes any information generated by measuring the activity of a person’s central or peripheral nervous system. The Labor Commissioner or a public prosecutor may enforce the provisions, and violations are subject to civil penalties of up to $500 per violation. The bill also allows for civil or injunctive relief, including punitive damages. #### Name, Image, and Likeness / Synthetic Performers [**SB 1050** ](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1050)**(Synthetic Performer Advertising Disclosure)**. SB 1050 makes it unlawful for any person to create and publish an advertisement that prominently includes a ​“synthetic performer” without a clear and conspicuous disclosure. A synthetic performer is an AI-generated human-like figure that does not correspond to a real person. Disclosures must appear in close proximity to the synthetic performer and use wording substantially similar to ​“this performance features a synthetic digital performer.” [**SB 1111**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB1111) **(Digital Replica Protections)**. SB 1111 amends California Civil Code Section 3344, the state’s existing name, image, and likeness law. It clarifies that ​“voice or likeness” includes a ​“digital replica,” defined as a computer-generated, highly realistic electronic representation that is readily identifiable as an individual’s voice or visual likeness. The definition applies when the individual did not perform or appear, or when the individual did perform or appear but the fundamental character of the performance or appearance was materially altered. #### AI Auditor Regulation [**SB 813**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB813) **(Independent Verification Organizations)**. Signed by Governor Newsom on September 9, 2026, this law requires the Government Operations Agency, by January 1, 2028, to establish a process for selecting and regulating independent verification organizations (IVOs) that demonstrate expertise in assessing risks posed by AI systems or models and in identifying the metrics and methodologies underlying those assessments. The law, however, does not require AI developers or deployers to engage an IVO or undergo a covered AI audit. [**AB 1405**](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1405) **(AI Auditor Registry)**. Signed by Governor Newsom on September 9, 2026, this law requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029, along with related registration requirements. Together with SB 813, the law establishes state oversight of entities that offer AI audit or verification services. Beginning January 1, 2029, unregistered persons may not offer, sell, or conduct a covered AI audit. Registered auditors must also display their registration number in advertisements for covered audits. - Share this entry - - - - - [ View entry pdf ](https://s3.amazonaws.com/cdn.kelleydrye.com/content/uploads/pdf-snapshots/californias-2026-legislative-session-wraps-a-wave-of-privacy-and-ai-bills-reaches-the-governor-with-key-child-safety-and-ai-measures-signed-into-law-20260914174043.pdf) ### Search Blog ### Subscribe ### Explore Topics - [Artificial Intelligence](https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/artificial-intelligence) - [Children’s Privacy](https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/childrens-privacy) - [Privacy and Information Security](https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/privacy-and-information-security) ### Related Services - [Advertising and Marketing](https://www.kelleydrye.com/practices/advertising-and-marketing) - [Advertising Technology (AdTech)](https://www.kelleydrye.com/trending/advertising-technology) - [Artificial Intelligence](https://www.kelleydrye.com/trending/artificial-intelligence) - [Privacy and Information Security](https://www.kelleydrye.com/practices/privacy-and-information-security)