California Enacts Sweeping Privacy and AI Laws for 2026, Expanding Deletion Rights and Youth Protections
California Governor Newsom has signed approximately 30 new privacy and AI-related bills into law, with a focus on expanding consumer deletion rights, protecting children's and student data, and regulating AI use in various sectors. A key piece of legislation, SB 923, significantly broadens the California Consumer Privacy Act (CCPA) deletion right to include all personal information a business holds about a consumer, regardless of its source. This change, effective January 1, 2027, also mandates that online-only businesses provide a web form or portal for access, deletion, or correction requests, moving beyond email-only options. Other notable changes include AB 2561, which prevents operating system and app updates from overriding consumer privacy choices without consent, and AB 883, which shortens the data broker deletion deadline to 30 days. The legislative package also addresses AI in the workplace, healthcare, and content creation, alongside establishing governance for frontier AI models.