On September 27, California Gov. Gavin Newsom issued a legislative update on a package of bills, including bills addressing data privacy, artificial intelligence (AI), and consumer protection. Newsom signed several bills into law, vetoed one, and left others unsigned. Below is a summary of each bill, its current status, and steps organizations may want to consider for the bills Newsom signed or vetoed.
Bills Signed into Law
- SB 1050: Synthetic Performer Disclosures in Advertising
SB 1050 makes it an unlawful advertising practice to create and publish an advertisement that prominently includes a synthetic performer without a clear and conspicuous disclosure. SB 1050 also requires certain advertising mediums to remove, disable access to, or stop disseminating an advertisement containing a synthetic performer after receiving a court order finding a violation or enjoining publication.
What to consider: This law takes effect on January 1, 2027. If your business uses AI-generated or digitally altered human likenesses in marketing or advertising, you should review your operations to ensure that appropriate disclosures accompany any such content.
- SB 923: Expanded CCPA Deletion Rights and Online Request Methods
SB 923 expands the California Consumer Privacy Act's (CCPA) deletion right by allowing consumers to request deletion of personal information collected "from or about" them, including information obtained from third-party or other indirect sources. SB 923 also requires online-only businesses with a direct consumer relationship to provide an online method, such as a webform or online portal, for submitting CCPA requests, in addition to an email option.
What to consider: This law takes effect on January 1, 2027. Businesses should evaluate their data inventories to determine whether they hold personal information obtained from third parties and prepare to honor deletion requests covering that data. Online-only businesses should also confirm that they offer a webform or similar online submission method for consumer requests.
- AB 883: Shorter DROP Processing Timeline and New Enforcement Pathway
AB 883 amends California's data broker law by shortening the time frame for data brokers to access the state's Delete Request and Opt-Out Platform (DROP) and process deletion requests from at least once every 45 days to at least once every 30 days. AB 883 also requires elected officials and judges to be notified of their right to submit a deletion request through DROP and would authorize the attorney general, county counsel, or a city attorney to bring certain civil actions on behalf of elected officials or judges for alleged DROP-related deletion violations.
What to consider: The provisions related to deletion timing take effect on January 1, 2027, with provisions related to state officials becoming operative on July 1, 2027. Data brokers should update their internal compliance calendars to reflect the shortened 30-day processing cycle and ensure their systems can meet the accelerated timeline.
Vetoed Bill
- AB 1542: Restrictions on Sale or Sharing of Sensitive Personal Information
AB 1542 would have amended the CCPA to prohibit businesses, service providers, and contractors from selling or sharing sensitive personal information to third parties, subject to limited exceptions. Newsom vetoed this bill, so it will not become law.
What to consider: The CCPA already provides consumers with the right to limit the use and disclosure of sensitive personal information. Businesses should continue to honor those existing rights and monitor whether similar proposals reemerge in future legislative sessions.
Bills Awaiting Action
Should Newsom take no action on the bills remaining on his desk within the legal deadline, they would become law without signature. Several bills remain on his desk, including bills to address CIPA Litigation Reform for Website and App Claims, AI transparency, operating system and app privacy settings, the use of data in the insurance industry, and customer service chatbot disclosures.
What's Next for California Privacy and AI Legislation?
California continues to expand and update its privacy and AI framework, and we expect additional legislative activity in these areas in the coming sessions. If you'd like help assessing these new laws and emerging legislative trends, contact the authors or visit Venable's Privacy and Data Security center to help ensure your organization is prepared.