California’s legislators took their oaths of office for a fresh two-year session last week. As we prepared for a new session, it’s worth looking back at the past session—in which, with your help, EFF was able to advocate successfully for digital rights victories. California is often seen as a leader in recognizing the importance of privacy, innovation, and free expression. This year, EFF was proud to support legislation that again put the state at the forefront of privacy protections for those seeking reproductive and gender-affirming care.
EFF supported three bills—A.B. 2091, A.B. 1242, and S.B. 107–that were signed into law and take steps to set California as a data sanctuary state for anyone seeking reproductive or gender-affirming care. Authored by Assemblymember Rebecca Bauer-Kahan, Assemblymember Mia Bonta, and California State Senator Scott Wiener, these bills will protect people by forbidding health care providers and many businesses in California from complying with out-of-state warrants seeking information about reproductive or gender-affirming care.
Health privacy has always been important to EFF. While we are not focused on reproductive justice or gender-affirming care advocacy, we joined those advocacy communities in support of these bills because no one should fear receiving a medical procedure because of privacy risks. In the wake of the Dobbs decision, the increasing criminalization of health care makes protecting health privacy newly important.
In addition to these three bills, EFF supported A.B. 2089, authored by Asm. Bauer-Kahan, which was signed into law by Gov. Newsom. This bill extends the protections of the California Confidentiality of Medical Information Act (CMIA) to information generated by mental health apps—previously a glaring hole in medical privacy protections.
Unfortunately, not every legislative battle we tackled this year was as successful. EFF began the session by sponsoring two bills. The first, the Biometric Information Privacy Act (BIPA), would have mirrored many of the protections of a landmark Illinois statute that requires companies to obtain opt-in consent before collecting your biometric information. It was authored by California State Senator Bob Wieckowski. The second, the Student Test Takers’ Privacy Act, was aimed at preventing student proctoring companies from collecting more information that is necessary. It was authored by California State Senator Richard Pan. Both, in line with EFF’s legislative principles, were introduced with a strong private right of action—an enforcement mechanism that gives people the right to sue companies that violate their privacy.
Neither survived the session intact. As in years past, California’s lawmakers were unwilling to stand up for the individual right to sue over privacy violations, and both bills took a beating as they went through the committee process. The California BIPA bill was quietly killed in the Senate Appropriations Committee—which, unlike policy committees, does not allow for public testimony—using a specious argument about costs to California’s courts. The Judicial Council of California itself has said that the legislature should not mark bills as costlyl due to the inclusion of a private right of action. However, the Senate Appropriations Committee continues to use this argument. We thank Sen. Wieckowski and his staff for authoring this bill and working to raise the issue in the legislature.
Similarly, after it was made clear that the private right of action would keep the student privacy bill from moving forward, Sen. Pan agreed to drop the provision. While EFF understood that decision, we—along with our co-sponsors, Privacy Rights Clearinghouse—could no longer sponsor that bill after that point. S.B. 1172 has been signed into law and takes some important steps to curb data collection of proctoring companies. However, the bill lacks teeth. Enforcement of the bill will depend heavily on the workloads and priorities of the state AG and city and county attorneys. This unfortunately silences the voices of those most afflicted by overbroad data collection: students.
There were also bills that EFF opposed due to privacy concerns. One was A.B. 984, sponsored by digital license plate company Reviver. It originally would have allowed for GPS trackers to be placed in the digital license plates of personal vehicles. After advocacy work with many other groups, including ACLU California Action, the National Network to End Domestic Violence, and others, the bill was amended to remove this troubling flaw. We thank Assemblymember Lori Wilson for hearing our concerns and hope others will not reintroduce this bill in the next session.
EFF also raised concerns about A.B. 2273 and A.B. 587, which address how social media and other technology companies moderate their platforms. Both were signed into law and address the ways that social media platforms present and report information. While these bills may be a well-intentioned reaction to reports from those such as Frances Haugen on the effect social media has on children, we believe both violate the First Amendment. We urge other states not to adopt these bills as models for their own legislation.
In the coming year, we look forward to working with advocates and legislators in California. We especially hope to build on the bills passed this past year to continue to ensure that the data of those seeking medical care are not handed over to those who wish to prosecute or expose them.
