California AI and Privacy Legislation Update – January 2026
The new year is off to a quick start as February looms. Businesses are beginning to settle into 2026, and some trends (or at least outlines of such) are beginning to emerge. Businesses are digesting the AI and privacy bills that were signed into law last Fall.
California Invasion of Privacy Act (CIPA)
Litigation shows no sign of abating. The failure of SB 690 and another year of runway are driving litigation in this space. As of January 21, 2026, 40 data breaches impacting more than 500 California residents have been reported to the California Attorney General, compared to 23 for the same period in 2025. Privacy class action litigation usually follows soon after reporting, suggesting that 2026 will be another, if not more, active year in that space.
Investigations from regulators follow as well. The beginning of the year is a good time to review the Written Information Security Program (WISP) and confirm appropriate implementation of the systems and measures that flow from the WISP. This is also a good time to review and, if appropriate, update website privacy notices, ensure that website consent managers and opt-out mechanisms function as intended, and conduct privacy and cybersecurity training.
California Privacy Protection Agency
The California Privacy Protection Agency continues to focus on data brokers and, with the availability of the Delete Request and Opt-Out Platform (DROP), will likely step up enforcement in 2026. Implementation of DROP may not be entirely straightforward; therefore, a detailed project plan and punchlist are recommended.
Updated California Consumer Privacy Act (CCPA)
The updated California Consumer Privacy Act regulations became operative on January 1, 2026. These regulations now mandate, among other items, annual cybersecurity audits, data privacy risk assessments, and pre-use notices for automated decision-making technologies, generally with staggered start dates depending on the size of the business.
Legislative Developments
The California legislature reconvened on January 5, 2026. As we are in the second year of the 2025-2026 Biennium, legislators may introduce new bills and/or try to progress bills that had not made it to the Governor’s desk during the first year. For instance, a few bills stalled in the Assembly Privacy and Consumer Protection Committee after having been approved by the Senate:
- SB 690: aimed to de-conflict CIPA and the CCPA and legislatively close the floodgates on CIPA litigation.
- SB 420: would have required developers of high-risk automated decision systems to conduct impact assessments before making the system publicly available.
The current legislative session ends on August 31, 2026.
New Laws Effective January 1, 2026
Several AI and data privacy laws went into effect on January 1, 2026:
- AB 316 (Artificial intelligence: defenses)
- AB 566 (CCPA: opt-out preference signal)
- AB 853 (California AI Transparency Act)
- SB 53 (Artificial intelligence models: large developers)
- SB 243 (Companion chatbots)
- SB 361 (Data broker registration: data collection)
- SB 446 (Amends Section 1798.82 of the Civil Code, relating to personal information and data breach notification)
AB 566 requires web browsers to include a clear, one-step setting allowing users to send an opt-out preference signal. Meanwhile, AB 853 imposes new transparency and disclosure obligations on General AI systems, amending the existing California AI Transparency Act. On a larger scale, SB 53 requires large AI developers to publish risk-management frameworks and report catastrophic safety incidents to the State.
SB 446 mandates data breach notification to impacted California residents within 30 calendar days of discovery or notification of the data breach, with customary exceptions. A breach notification report must be submitted to the California Attorney General within 15 calendar days of notifying the affected individuals.
Newly Introduced Bills
A number of new AI and privacy bills have been introduced:
- SB 300, SB 867, and AB 1609: new chatbot bills.
- AB 1064 (Leading Ethical AI Development for Kids Act) was vetoed by Governor Newsom last Fall.
- A new ballot measure, Parents & Kids Safe AI Act, has been introduced, seeking signatures to put the measure on the ballot in November 2026.
It’s possible that the California legislature may introduce, and Governor Newsom may sign, new legislation on this topic, following the course of the CCPA, which was originally a proposed ballot measure.
AB 1542 (an act to amend Sections 1798.100 and 1798.121 of the Civil Code relating to privacy) would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party. Current law allows the consumer to opt out of the selling or sharing of personal information and to limit the use and disclosure of sensitive personal information to certain uses as set out in the statute. AB 1542 may be heard in committee on February 5, 2026.
Stay tuned. 2026 promises to be another interesting year in California.
