California Legislature Passes Bill to Ban the Sale of Sensitive Personal Data

Privacy advocates argue that consumers' most intimate details should never be commodified on the open market, while advertising groups counter that an outright ban violates the First Amendment and disrupts the digital economy. That tension is now sitting on Governor Gavin Newsom's desk in the form of Assembly Bill 1542.[3][4]

The California legislature has passed the measure, which amends the existing California Consumer Privacy Act (CCPA) to strictly prohibit businesses from selling or sharing sensitive personal information. The bill cleared the state Senate on a 31-4 vote and was ordered to engrossing and enrolling on August 30, 2026.[1][2]

Under current CCPA rules, Californians have the right to limit the use and disclosure of their sensitive data, placing the onus on the consumer to navigate opt-out menus. AB 1542 replaces that framework with a default ban. The legislation defines sensitive information broadly, encompassing precise geolocation—defined as data that can pinpoint a person within an 1,850-foot radius—as well as racial or ethnic origin, religious beliefs, union membership, sexual orientation, and health conditions.[3][4]

Consumer Reports, which co-sponsored the legislation, argues that the current opt-out model is insufficient to protect the public. Justin Brookman, the organization's director of technology policy, stated that while companies often need personal data to deliver requested services, "they should not be selling it behind our backs." The group contends that the routine sale of such data can lead to stalking, identity theft, and price discrimination.[3][4]

The advertising industry has mounted a coordinated push for a veto. A coalition including the Association of National Advertisers, the American Association of Advertising Agencies, and the Digital Advertising Alliance sent a letter to Governor Newsom arguing that the bill raises "significant First Amendment concerns" by restricting "the dissemination of lawfully obtained, truthful information."[4]

The ad groups assert that the legislation's "overinclusive approach" would unnecessarily disrupt data practices that allow consumers to discover relevant goods and services through targeted marketing. They also warn that the ban could undermine essential fraud prevention and identity protection services, which rely on responsibly shared location data from third parties to detect suspicious activity and protect consumers from financial loss.[4]

If Newsom signs the bill, California will join a growing bloc of states tightening the rules around data brokering. Maryland, Oregon, Connecticut, and Virginia have all recently passed laws restricting the sale of certain sensitive information, with Maryland enacting a similar comprehensive ban. The only notable exception in the amended California text allows commercial credit reporting agencies to sell a consumer's Social Security number solely to identify their relationship to a business they own.[1][3][4]

The governor must now decide whether to sign or veto the legislation. Until then, the debate remains polarized between a tech industry fighting to preserve the behavioral advertising ecosystem and privacy groups pushing to remove sensitive data from the open market entirely.[3][4]