2025 CA Legislative Recap
The bills below were signed into law by Governor Newsom.
AB 45 Privacy: health data: location and research
Prohibits the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center.
AB 49 Schoolsites: immigration enforcement
Prohibits school officials and employees of a local educational agency from allowing an officer or employee of an agency conducting immigration enforcement to enter a nonpublic area of a schoolsite, as defined, for any purpose without being presented with a valid judicial warrant; prohibits a local educational agency and its personnel from disclosing or providing, in writing, verbally, or in any other manner, the education records of or any information about a pupil or a pupil’s family and household without the pupil’s parents’ or guardians’ written consent.
AB 82 Health care: legally protected health care activity
Expands the address confidentiality program to a gender-affirming health care provider, employee, or volunteer, as defined, who faces threats of violence or harassment from the public because of their affiliation with a gender-affirming health care services facility; prohibits a person, business, or association from soliciting, selling, or trading on the internet or social media the personal information or image of a gender-affirming health care services provider, employee, volunteer, or patient to commit a crime involving violence or a threat of violence.
AB 260 Sexual and reproductive health care
Permits pharmacists to dispense reproductive care drugs anonymously, without identifying patient or provider information, while keeping a confidential log protected from law enforcement access without a subpoena. The bill shields pharmacists from criminal, civil, or professional penalties for actions related to these drugs and prevents the state pharmacy board from taking disciplinary action against them for doing so.
AB 316 Artificial intelligence: defenses
Prohibits a defendant who developed, modified, or used artificial intelligence, as defined, from asserting a defense that the artificial intelligence autonomously caused the harm to the plaintiff.
AB 325 Cartwright Act: violations
Makes it unlawful to use or distribute a common pricing algorithm as part of an anticompetitive agreement or to coerce others into adopting algorithmically recommended prices or terms.
AB 489 Health care professions: deceptive terms or letters: artificial intelligence
Extends existing laws that prohibit falsely implying licensure in a health care profession to include developers or deployers of artificial intelligence (AI) or generative AI (GenAI) systems. It bans AI technologies from using terms or phrases (such as “doctor” or “dentist”) that suggest medical or professional licensing in their advertising or operation, preventing users from being misled into believing AI-generated advice or care comes from a licensed professional. Violations fall under the jurisdiction of the relevant health care licensing board, with each prohibited use treated as a separate offense, thereby expanding criminal liability.
AB 566 California Consumer Privacy Act of 2018: opt-out preference signal
Starting January 1, 2027, all web browsers are required to include a consumer-configurable feature that sends an opt-out preference signal to businesses, allowing users to automatically opt out of data collection. Browser developers must clearly explain how this feature works and its effects.
AB 621 Deepfake pornography
Expands existing law on nonconsensual sexually explicit material to cover digitized or deepfake content, including cases involving minors. It allows victims to sue not only creators or distributors but also those who knowingly or recklessly facilitate or support deepfake pornography services. Service providers that continue enabling such operations after being notified would be presumed to be aiding or abetting. The bill also raises potential damages to $50,000 for non-malicious and $250,000 for malicious violations and authorizes certain public prosecutors to bring civil actions to enforce these provisions.
AB 656 Account cancellation
Requires a social media platform to provide a clear and conspicuous button that enables the user to delete their account and provide the user with the necessary steps to delete the user’s account and personal information.
AB 853 California AI Transparency Act
Beginning in 2027, large online platforms must detect and disclose provenance data embedded in content, while GenAI system hosting platforms will be prohibited from offering systems that fail to include required disclosures. Starting in 2028, manufacturers of devices capable of recording photos, audio, or video must give users the option to embed a latent disclosure identifying the device. These measures aim to enhance transparency and accountability in AI-generated and digitally captured content.
AB 979 California Cybersecurity Integration Center: artificial intelligence
Directs the California Cybersecurity Integration Center, in coordination with the Office of Information Security and the Government Operations Agency, to create a California AI Cybersecurity Collaboration Playbook by January 1, 2027. The playbook will promote information sharing between cybersecurity and AI sectors and strengthen defenses against emerging threats, guided by federal standards and industry best practices.
AB 1261 Immigration: immigrant youth: access to legal counsel
Provides legal counsel to immigrant youth in the State of California, subject to available funding.
SB 50 Connected devices: device protection requests
Allows survivors of abuse, or their representatives, to request that an account manager terminate a perpetrator’s access to connected devices or related user accounts. Account managers must act within two business days to disable access or provide instructions for resetting the device, while maintaining the survivor’s confidentiality. They must also clearly outline the request process online and are prohibited from sharing information with the perpetrator. Violations can be enforced through civil actions or penalties by affected individuals or government officials. The bill also clarifies that “internet-connected devices” covered by restraining orders include these connected devices.
SB 53 Artificial intelligence models: large developers
Creates the Transparency in Frontier Artificial Intelligence Act (TFAIA), requiring large AI developers to publish a “frontier AI framework” outlining safety standards and best practices, and to report catastrophic risk assessments to the Office of Emergency Services, which must establish systems for reporting and securely handling safety incidents. The Act exempts these reports from public disclosure and allows the Attorney General to impose civil penalties for noncompliance. It also establishes a CalCompute consortium within the Government Operations Agency to design a state cloud framework supporting safe and equitable AI development, reporting to the Legislature by January 1, 2027. Additionally, the bill strengthens whistleblower protections for employees of AI developers, ensuring they can report public safety risks or legal violations without retaliation, and preempts future local regulations targeting frontier AI developers’ risk management.
SB 59 Change of name or gender and sex identifier
Expands confidentiality protections for court records related to name or gender changes, ensuring privacy for all petitioners—not just minors—by restricting access to specified individuals and prohibiting public posting of such records. It allows those harmed by unauthorized disclosures to seek damages or injunctive relief and requires courts to award attorney’s fees to prevailing plaintiffs. The Judicial Council must develop implementation rules by July 1, 2026. The bill also affirms that a transgender person’s gender identity is protected private information and takes effect immediately as an urgency statute.
SB 81 Health care facilities: information sharing
This bill expands the Confidentiality of Medical Information Act (CMIA) to include a person’s immigration status and place of birth as protected medical information. It prohibits health care providers, insurers, contractors, and related entities from disclosing such information for immigration enforcement without patient consent or a valid court order or warrant. The bill also requires health care facilities to establish procedures for handling immigration enforcement requests, restricts access to nonpublic areas, and mandates staff training on how to respond to such requests.
SB 313 Vital records: birth certificates
Beginning July 1, 2027, this bill moves the birthplace of each parent from the public portion of a birth certificate to the confidential medical and social section, ensuring that information is no longer publicly accessible.
SB 361 Data brokers: data collection and deletion
Requires brokers to report additional categories of personal information they collect—such as names, contact details, IDs, biometric data, and gender identity—and to disclose if they have shared or sold data to foreign actors, government agencies, law enforcement, or generative AI developers. It also updates penalties for unregistered brokers and requires denied deletion requests to be processed within 45 days. While the public may access broker registration data, the bill prohibits publishing sensitive collection details on the agency’s website.
SB 446 Data breaches: customer notification
Tightens California’s data breach notification rules by requiring businesses or individuals to notify affected residents within 30 days of discovering or being informed of a breach, with limited exceptions for law enforcement or system restoration needs. It also requires businesses that notify over 500 residents about a single breach to submit a sample notice to the Attorney General within 15 days of consumer notification.
SB 497 Legally protected health care activity
Strengthens protections for individuals seeking or receiving gender-affirming health care or mental health care in California. It prohibits health providers, insurers, contractors, and employers from releasing or sharing medical information in response to out-of-state subpoenas, investigations, or legal actions based on laws that criminalize or restrict gender-affirming care. It also bars cooperation with out-of-state or certain federal law enforcement related to such care and restricts access to sensitive service data. Additionally, it prevents California agencies from sharing CURES prescription data or using resources in investigations tied to other states’ anti–health care laws, making unauthorized access or disclosure of CURES data a misdemeanor.
SB 524 Law enforcement agencies: artificial intelligence
Requires law enforcement agencies to adopt policies governing the use of artificial intelligence (AI) in creating official reports. Any report generated fully or partially with AI must include a disclosure statement and the officer’s signature, and the first AI-generated draft must be retained for the same period as the final report. Drafts other than the official report cannot be considered an officer’s statement. Agencies must also maintain an audit trail identifying who used AI and other key details, while vendors processing agency data with AI are prohibited from sharing or selling that information.
SB 580 Attorney General: immigration enforcement policies
Requires the Attorney General, by July 1, 2026, to develop and publish model policies and guidance for how state and local agencies interact with immigration enforcement and manage their databases to limit data access for immigration purposes, consistent with federal and state law. All state and local agencies must adopt these policies by January 1, 2027. The bill applies statewide, including to charter cities.
SB 635 Food vendors and facilities: enforcement activities
Strengthens privacy and immigration protection measures for sidewalk vendors and compact mobile food operators. It prohibits local authorities and enforcement agencies from sharing or granting access to vendors’ personal information—such as names, addresses, or identification numbers—without a subpoena or court order, and bars them from cooperating with immigration enforcement in connection with vending regulation. Agencies may not ask about immigration status, citizenship, or criminal history, nor require fingerprints or background checks for business permits. Any previously collected birthplace or criminal history data must be destroyed by March 1, 2026, unless legally required to retain it. Contracts with private entities must include compliance clauses, with violations resulting in immediate termination. Personal data collected under these provisions is exempt from public disclosure, and the bill mandates reimbursement procedures for local compliance costs.
SB 660 California Health and Human Services Data Exchange Framework
Transfers responsibility for the California Health and Human Services Data Exchange Framework from the Health and Human Services Agency to the Department of Health Care Access and Information by January 1, 2026. The department will manage all framework functions, including data sharing agreements and related policies, and expand the entities required to participate. By July 1, 2026, it must establish a process to certify qualified health information organizations as data-sharing intermediaries. Additionally, by July 1, 2027, the department must submit a report to the Legislature on implementation and compliance, and the bill expands the stakeholder advisory group’s membership to support this work.
SB 683 Privacy: use of a person’s name, voice, signature, photograph, or likeness: injunctive relief
Expands existing law protecting individuals from unauthorized commercial use of their name, image, or likeness by allowing victims to seek injunctive relief—such as a court-ordered removal or recall of the offending material—in addition to damages. If a temporary restraining order is granted without notice, the respondent must comply within two business days of being served, unless the court specifies otherwise.