In the final weeks of California’s 2026 legislative session, lawmakers passed a series of bills that stand to significantly reshape the state’s privacy and AI regulatory landscape. Of particular significance, Senate Bill 690 (SB 690) seeks to curtail one of the principal theories underlying the recent wave of California Invasion of Privacy Act (CIPA) litigation, which has swept across diverse industries to affect website operators ranging from consumer brands to financial services firms. The bill would eliminate private actions under CIPA’s pen register and trap-and-trace provision, leaving the California Attorney General as the sole party authorized to bring those civil claims. If enacted, SB 690 would also apply retroactively to any pending pen/trap claim in actions filed within two years before its operative date, potentially affecting certain website-tracking cases already in litigation.

The Legislature simultaneously passed two consequential amendments to the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA). Senate Bill 923 (SB 923) would expand the right to deletion, extending it to personal information collected from or about a consumer, regardless of its source. Meanwhile, Assembly Bill 1542 (AB 1542) would generally prohibit businesses, service providers, and contractors from selling or sharing sensitive personal information with third parties, subject to specified statutory provisions and a narrow express exception.

Additionally, the Legislature approved several measures affecting AI, most notably amendments to the California AI Transparency Act. If enacted, these amendments would significantly revise requirements for generative AI providers and large online platforms, including new obligations for the provenance, verification, and disclosure of AI-generated or AI-altered content. The proposed changes would expand the range of regulated entities and strengthen the infrastructure for identifying and managing AI content, with immediate and future compliance implications for businesses deploying AI technologies.

Each measure awaits action by Governor Gavin Newsom, who has until September 30, 2026 to sign or veto them. There is no pocket veto in California, meaning any measure left unsigned by this deadline automatically becomes law without the Governor’s signature. Governor Newsom has moved quickly on other fronts, recently signing into law separate AI auditing requirements and child safety measures targeting chatbots and social media platforms.

Together, these initiatives mark significant developments in California’s approach to data privacy and artificial intelligence, reinforcing the state’s role as a national bellwether for technology regulation.

To read the full Ropes & Gray Alert, click here.