California Closes Legislative Session with Significant AI and Privacy Developments

September 4, 2026

The California Legislature passed a significant number of privacy-and AI-related bills during the latest legislative session, which ended August 31, 2026. The measures – which span AI transparency, employment decisions, privacy practices, use of chatbots, health care services, children’s online protections, and more – will have wide-ranging effects on companies doing business in California, if and when they are signed into law by the Governor.

The California Legislature’s 2026 session underscores the state’s continued focus on privacy and AI regulation. The AI package reflects a growing focus on high-impact use cases, including employment decisions and consumer-facing interactions involving chatbots and digital replicas, while reinforcing the importance of human oversight in consequential decision-making. On the privacy front, lawmakers added to the state’s already expansive frameworks. For example, they approved heightened regulation of businesses that sell or share sensitive personal data, as well as new measures addressing children’s online privacy and safety – including a replacement framework for the Age-Appropriate Design Code Act and new restrictions on addictive platform features directed at minors. At the same time, the Legislature adopted a CIPA reform measure aimed at curbing the onslaught of certain private claims under the state’s wiretapping act.

Below, we highlight several key AI and privacy bills that were passed. Except where otherwise noted, the bills remain subject to gubernatorial action and have not yet been enacted into law, and laws in California generally have an effective date of January 1 the following year unless otherwise specified.

Key AI Legislation

Employment and Workplace AI

• SB 947 – Regulates employer use of automated decision systems, prohibits employers from relying solely on those systems for disciplinary or termination decisions, and requires human corroboration and notice when an employer primarily relies on an automated system for such a decision. If signed, this would be effective July 1, 2027.
• AB 1883 – Restricts employers from using AI-enabled workplace-surveillance tools to collect neural data, recognize an individual’s emotional state, or engage in other specified forms of workplace monitoring.
• AB 1331 – Limits employer use of workplace-surveillance tools and prohibits specified surveillance practices, including monitoring or surveilling employees in workplace bathrooms.
• SB 951 – Revises California’s workforce-displacement notice requirements by requiring employers to include specified information when a mass layoff, relocation, or termination results substantially from the use of AI or other automated technology. It also establishes related state reporting requirements.

Chatbots and Consumer Interactions

• AB 1609 – Establishes disclosure and operational requirements for customer-service chatbots used by large businesses, including notice requirements when consumers interact with chatbots.
• SB 1119 – Expands California’s companion-chatbot requirements by imposing additional protections for minors, including independent child-safety audit requirements.
• SB 867 – Prohibits the manufacture, sale, exchange, or offering for sale of toys that incorporate companion chatbots.
• AB 2 – Establishes potential liability for a social-media platform when its failure to exercise ordinary care or skill causes injury to a child.

Synthetic Performers and Digital Replicas

• SB 1050 – Requires a clear and conspicuous disclosure when an advertisement prominently includes a synthetic performer.
• SB 1111 – Expands California’s name, image, and likeness protections by clarifying that a person’s voice or likeness includes certain computer-generated digital replicas.

Health Care AI

• AB 1979 – Prohibits specified health care facilities and provider offices from using or deploying an AI-enabled tool, system, or device to independently perform a clinical function that the law requires a licensed health care professional to perform.

• SB 503 – Requires developers and deployers of AI-enabled clinical decision-support systems to make reasonable efforts to identify systems that present known or reasonably foreseeable risks of biased impacts in health programs or activities.
• SB 903 – Regulates the use of AI in providing or facilitating psychotherapy services and establishes safeguards applicable to AI-assisted mental health services.

• AB 2575 – Regulates health-care provider use of AI-enabled clinical decision-support systems that produce predictions, classifications, recommendations, evaluations, or analyses to assist decisions involving the timing of care, diagnosis, or treatment.

AI Governance, Audits, and Oversight

• SB 813 – Directs the California Government Operations Agency to establish requirements governing the selection and regulation of independent verification organizations that assess risks presented by AI systems and models.
• AB 1405 – Requires the California Government Operations Agency to establish an AI Auditor Registry and imposes registration and related requirements on persons and organizations offering or conducting AI audits.

AI Transparency

• SB 1000 – Expands the scope of the California AI Transparency Act by broadening the definition of covered providers and modifying compliance obligations applicable to providers of generative AI systems.
• AB 2713 – Revises the California AI Transparency Act’s requirements for large online platforms, including requirements related to detecting, displaying, and allowing users to inspect system provenance data associated with online content.

Professional Responsibility

• SB 574 (Generative AI and Legal Practice) – Establishes requirements governing attorneys’ use of generative AI, including requirements concerning confidential and nonpublic information, verification of AI-generated material, correction of erroneous or hallucinated output, and verification of citations included in court filings.

Privacy Legislation

CIPA

• SB 690 – Amends the California Invasion of Privacy Act’s (CIPA) civil remedies provision by limiting private actions based on alleged violations of its pen-register and trap-and-trace provisions, including certain claims involving conduct on websites and online or mobile applications. The measure preserves public enforcement authority and does not eliminate other potential CIPA claims. The bill’s limitation applies retroactively to any pending claim in an action commenced within two years before the bill’s operative date. As a result, it is expected to affect certain CIPA litigation.
• AB 2561 – Prohibits an operating system or application from reversing a user’s affirmative configuration of a privacy setting without the user’s consent, subject to specified exceptions.

CCPA

• AB 1542 – Amends the California Consumer Privacy Act (CCPA) by prohibiting a business from selling or sharing a consumer’s sensitive personal information (including precise geolocation data) with a third party unless the consumer intentionally directs the disclosure or intentionally interacts with the third party, subject to the bill’s specified terms and exceptions.
• SB 923 – Expands the CCPA’s deletion right to cover personal information collected about a consumer regardless of its source, and requires businesses operating exclusively online to provide an online method for submitting consumer requests in addition to an email address.

Data Brokerage

• AB 883 – Amends California’s data-broker law by shortening specified 45-day compliance periods to 30 days and requiring notices to specified public officials regarding their ability to submit deletion requests through California’s Delete Request and Opt-Out Platform.

Children’s Online Services

• AB 2246 – Repeals and replaces the California Age-Appropriate Design Code Act with requirements applicable to businesses that provide online products or services likely to be accessed by children, including obligations to take reasonable steps to prevent specified harms to children.
• AB 1709 – Restricts covered platforms from providing addictive features to users under 16, requires reasonable measures designed to prevent such users from receiving those features, and establishes an e-Safety Advisory Commission.

* * *

Although these bills remain subject to gubernatorial review, organizations should begin evaluating whether existing privacy programs, AI governance frameworks, consumer rights processes, vendor management practices, and product development workflows are positioned to address emerging requirements. Specifically, organizations may want to focus on the use of AI in employment-related decision-making, digital content generation, and the processing or sharing of sensitive personal information.

Wiley’s Artificial Intelligence and Privacy, Cyber & Data Governance practices counsel clients on compliance issues, risk management, and regulatory and policy approaches, and we engage with key government stakeholders in this quickly developing area. Please reach out to the authors with any questions.