California’s 2026 legislative session has officially adjourned and it’s time to reflect on the wins and losses that have shaped Californians’ digital rights landscape this year. This was the second year of a two-year legislative session, which meant several bills resumed their legislative paths from 2025.
EFF monitored nearly 100 bills in the state over the two-year session. These included proposed regulations on 3D printers, access to social media platforms, police, commercial, and workplace surveillance practices, AI, and other privacy concerns. While we saw some victories, alarming developments also raised serious concerns about the future of privacy protection in the state.
Celebrating Wins
Use of automated decision-making and surveillance in the workplace
Governor Newsom signed vital protections on the use of automated decision-making in the workplace and workplace surveillance tools, specifically No Robo Bosses (SB 947) and AB 1883.
Championed by our labor partners, SB 947 limits how employers can use automated decision-making to fire or discipline workers, including provisions that ensure workers get vital information about automated decisions that affect them, and that an algorithm is not the only authority for these consequential decisions. Alongside it, AB 1883 prohibits the use of workplace surveillance to predict emotions or collect neural data. This stops employers from using potentially biased, invasive, and exploitative forms of AI surveillance at the workplace, marking an important step toward creating workplaces that respect the privacy and autonomy of workers. We look forward to continuing to ensure that technology in California’s workplaces is deployed fairly, thoughtfully, and with respect for all workers.
Protecting against federal overreach
EFF was also grateful to see Governor Newsom sign SB 747, which allows damages lawsuits against federal officials who violate the U.S. Constitution. Victims of constitutional violations deserve a complete remedy and this law also helps deter constitutional violations in the first place. Gaps in current law often make it difficult to seek a damages remedy against federal officials who violate the U.S. Constitution. This bill makes it easier to bring such litigation. Federal law enforcement officials have violated our First Amendment right to record on-duty police and other newsworthy subjects, and also sometimes violate our Fourth Amendment right to be free from unreasonable searches of our phones and laptops. When this happens, the people who suffer these violations should be able to sue these officials for damages.
Additionally, EFF supported two bills (which are now state law) that clarify and extend California’s shield laws to protect patients, healthcare providers, and others involved in reproductive healthcare and gender-affirming care that is legal in California. After the overturn of Roe v. Wade, California enacted numerous shield laws to protect people who provide, receive, or help others obtain healthcare that is legal in California. These laws prohibit California agencies and certain companies from helping other states enforce laws that punish this care. Yet the federal government and coordinated efforts in other states still threaten access to these legally protected healthcare services. AB 1854 addresses these threats by expanding coverage to more California businesses and individuals who receive legal demands, creating a notification process so the Attorney General can intervene to stop improper disclosures, and clarifying that law enforcement cannot arrest someone if the Governor refuses an extradition request. These protections serve as a necessary response to real and escalating tactics outside the state targeting lawful reproductive healthcare.
EFF also supported AB 1930 to protect confidential medical records from politically motivated investigations into lawful healthcare, empowering the California Attorney General’s office to meaningfully intervene and respond to out-of-state subpoenas or requests for data regarding protected care.
Young people online
EFF is dedicated to protecting the rights of young people online. We supported a handful of bills on digital literacy and cybersecurity education that were signed into law, such as AB 2071 on digital wellness instruction and AB 2298 on cybersecurity in educational standards. Unlike blanket bans, these bills address online safety through education rather than prohibition. Young people rely on the internet not just for entertainment, but for civic engagement, education, self-expression, and community—especially vulnerable youth who may lack support in their physical surroundings.
Real digital safety comes from preparation, not isolation. Research consistently shows that open, honest conversations about digital literacy and privacy with trusted adults are far more effective at protecting youth than restrictive censorship laws. Young people themselves recognize this need; in fact, AB 2071 was co-authored by a group of students actively seeking better resources to navigate their digital lives safely.
EFF and our allies were also able to stop the expansion of California’s dangerous age gating law from operating systems to browsers. The California legislature stepped back from their plan to expand the 2025 age-gating law and ultimately removed language from AB 1856 that could have compounded serious threats to users’ speech, privacy, and security just to browse the internet, and positively, removed the burdens on open-source operating systems.
Real digital safety comes from preparation, not isolation
While EFF still believes the underlying law that AB 1856 amends, AB 1043, is unconstitutional, we appreciate that the legislature did not expand this problematic age-gating framework to browsers. We were also pleased that an earlier amendment to AB 1856 reduced the threat to the open-source community by exempting open-source operating systems. Given these changes, EFF removed its opposition to AB 1856, and thanks the author for listening to concerns from advocates and developers.
Mourning Losses
Updating California’s Information Practices Act (IPA)
EFF was proud to co-sponsor AB 1337 this session alongside our friends at Oakland Privacy and Assemblymember Chris Ward, who is also the chair of the legislative LGBTQ Caucus. The bill unfortunately failed to cross the finish line after stalling in the Senate.
AB 1337 would have updated California's foundational Information Practices Act of 1977 and extended its vital privacy safeguards present at the state agency level to counties and cities. Today, city and county governments collect vast amounts of sensitive personal data (from public health records such as vaccinations, to welfare assistance details, to license plate reader data) and administer programs that were likely not contemplated back in 1977. Yet the law has simply not kept up with modern data practices, and California still has no state law governing how local governments handle this information. While we could not build enough political progress to pass the bill this session, closing this local privacy gap remains an urgent need for California.
Social media ban
Another major setback was the passage (and subsequent signing) of a social media ban for youth under the age of 16 (AB 1709).
Technology and the laws that regulate it should support and empower young people, but AB 1709 falls far short of this goal. Using technology is how we learn and build community in today’s world, but laws such as AB 1709 cut young people off from essential information and experiences. They also particularly harm those already facing increased challenges who find safety in supportive online communities that they cannot always access in the physical world.
Technology and the laws that regulate it should support and empower young people
Denying minors access to digital forums or stripping out basic tools needed to navigate them will not make young people safer or healthier in the AI age. Research shows social media bans are ineffectual while denying young people opportunities to develop their own voices, share their art, practice religion, or engage in politics. These laws also hurt all of us. Age-gating requirements force everyone to give up more personal information. To verify who can pass through online gates, companies will collect even more data, concentrating power in corporate hands rather than protecting people. AB 1709 is also inconsistent with rights to free expression, meaning California will spend resources defending a law that will likely get tied up in court.
Gutting California’s Invasion of Privacy Act (CIPA)
CIPA was originally intended to protect personal privacy against surveillance and included a private right of action so consumers could hold corporations accountable in court. This is why EFF and allied organizations spent the two-year session strongly opposing SB 690—a bill we dubbed the "Corporate Cover-Up Act" for its attempt to weaken consumer protections in CIPA. Although SB 690 was narrowed from its original draft, we asked Governor Newsom to veto it because it strips away the law's private right of action—a vital tool for individuals fighting back against unlawful metadata surveillance. People deserve the right to decide whether to bring a lawsuit, which remains one of the most effective ways to deter corporate abuse. Unfortunately, the Governor signed the bill and even urged the legislature to go further next year. It's especially alarming to see this disregard for accountability as the federal government and law enforcement agencies seek data from businesses or data brokers to target people based on political beliefs, religious affiliations, or health decisions.
We expect to see further attacks on CIPA next legislative session, as Governor Newsom’s signing statement called for “additional work in this area” and urged the legislature to “take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation."
Banning the sale of sensitive personal information
California also missed the opportunity to join other states in restricting the sale of sensitive data. We are deeply disappointed that Governor Newsom vetoed AB 1542, which would have ensured sensitive personal information stays private by banning its sale outright. There's a nationwide movement to protect consumers by making intimate details off-limits for businesses to sell or share. From precise geolocation and genetic data to private messages, health records, sexual orientation, and immigration status, sensitive data reveals the most private aspects of our lives. Monetizing this information fuels financial scams, predatory pricing, and warrant-free government surveillance. By vetoing this bill, California not only fails to lead but falls behind other states, by missing a critical opportunity to protect our most vulnerable communities.
3D printing
The California legislature unfortunately also passed AB 2047, which aimed to make every 3D printer come pre-loaded with censorship software. It's a law that is trying to prevent an act that is already illegal in the state, and just won't work. It was part of a recent sweep of misguided state bills which purport to go after "ghost guns," but actually “enshittify” 3D printers by introducing privacy risks and a new way to restrict or upcharge users. Lawmakers even considered including misdemeanor charges that would have impacted people using alternative open-source programs. Fortunately an outpouring of opposition from makers and civil liberties advocates resulted in a bill so limited that, despite having passed and been signed into law, will not affect makers until ASTM International publishes a standard — something the organization had not been considering doing.
Where California Missed the Mark
Consumer privacy
California lawmakers also missed key opportunities to curb commercial surveillance. EFF supported AB 2564, which prohibits retailers from engaging in surveillance pricing, the invasive practice that allows corporations to offer the same product to two different people at two different prices based on scrutiny of their personal data. Unfortunately, the bill stalled on the last day of session.
The legislature also failed to move AB 322, which would have safeguarded the privacy of Californians by placing restrictions on the collection, use, and sale of location data. Last year, EFF published a rubric for comprehensive location privacy laws, outlining baseline standards states should meet to shield individuals from pervasive location surveillance. Since then, states like Connecticut, Maryland, New Jersey, Oregon, and Virginia have enacted new consumer privacy restraints on geolocation data. Yet, even as these states move the ball forward, most of their laws leave significant gaps that still must be filled. California failed to make that change and protect residents from location surveillance.
Automatic license plate readers
California lawmakers have lagged in enacting meaningful limits on automated license plate readers with all proposed ALPR regulation bills failing to pass since 2022. SB 1013 initially appeared on track to pass with broad support, but ultimately stalled in the final days of the session.
EFF maintains high standards for ALPR legislation, favoring full bans or, at minimum, strict warrant requirements and brief data retention limits. While we remained neutral on earlier versions of SB 1013, EFF and our partners ultimately opposed the bill after late amendments compromised key privacy protections. The final draft would have doubled the current data retention period and allowed agencies to archive rather than delete data unrelated to active investigations—effectively shifting away from data minimization toward indefinite retention. (We saw San Francisco adopt a similar proposal this year). We encourage California lawmakers to draw from our ALPR legislative agenda to enact robust safeguards or ban ALPR mass surveillance altogether.
Looking Ahead
Next session, we expect ALPR legislation to be top of mind as states across the country reckon with the harms the technology has caused. We will also be monitoring the results and action following the state’s audit into California’s fusion centers. Following calls from advocates to address privacy abuses and a lack of transparency, the Joint Legislative Audit Committee approved Senator Sabrina Cervantes’ audit request in March 2026. This builds on our past experiences working with JLAC audits to expose law enforcement overreach—such as the state auditor's damning 2020 report on law enforcement’s use of automated license plate readers and our 2016 push to fix the deeply flawed CalGang database. The audit will examine the legal authority, governance, and funding of the centers, map out state and private data systems accessed by personnel, and review protocols for handling data breaches and unauthorized surveillance. This audit will mark the first comprehensive review of these facilities in 13 years and should be released by Summer 2027. We hope lawmakers use the findings to rein in these centers and their unauthorized surveillance.
Other “zombie bills” are also expected to return next year, including legislation regarding the use of copyrighted material to train AI systems. Throughout the two-year session, EFF raised serious concerns about AB 412, a bill that would require AI developers to identify and disclose copyrighted works used in generative AI training. We argued that complying with such a mandate is practically impossible, as it demands information that often does not exist and cannot realistically be obtained. While we are glad the legislature paused to consider the best approach rather than rushing this policy forward, we expect legislation targeting fair use and AI training to return next session.
More broadly on AI, vulnerabilities and security issues have dominated recent news cycles, and everyday Californians feel real anxiety about the risks of AI. We expect to see numerous bills addressing issues like existential risk and kill switches, as Assembly and Senate privacy committees in California have held informational hearings on these topics over the last month.
We hope to work with legislators to address the threats of AI and ensure that technology supports rights, justice, freedom, and innovation for all people. Laws should always ensure that technology empowers rather than oppresses.
