California sensitive data privacy legislation

California Governor Gavin Newsom vetoed a legislative ban on the sale of sensitive consumer data on September 27, 2026, maintaining the advertising industry's ability to trade location, health, and financial information until lawmakers introduce a revised framework in the 2027 legislative session.[4][5]

The rejected legislation would have shifted the state's privacy model from an opt-out system to a strict opt-in requirement for 3 specific sensitive categories. By vetoing the measure, the governor aligned with advertising and business groups who argued the restrictions would severely disrupt digital marketing and the operational revenue of small businesses relying on targeted ads in a $200 billion US digital ad market.[2][3]

Privacy Daily reported that the decision "Pleases Advertisers," as it preserves the data ecosystem necessary for personalized shopping experiences and precise ad targeting.[3]

Consumer advocacy groups expressed immediate disappointment, noting that the veto leaves individuals responsible for manually navigating complex privacy settings across more than 500 registered data brokers in the state. Consumer Reports highlighted the setback, emphasizing the ongoing burden on residents to protect their personal metrics.[1]

AI

Despite the veto on the sales ban, the governor did advance a separate piece of the privacy package. On September 28, 2026, Newsom signed Senate Bill 923 (SB 923), which expands the California Consumer Privacy Act (CCPA), a landmark law originally passed in 2018.[5][6]

Privisy confirmed that with the signing of SB 923, "CCPA Deletion Now Covers Bought Data." This means California residents can now demand that data brokers delete personal information even if that data was purchased from a third party, closing a loophole that previously exempted bought data from deletion requests.[6]

For consumers managing their digital footprint, the immediate actionable takeaway is to utilize existing CCPA opt-out mechanisms and the newly granted deletion rights. Because default protections for sensitive data remain absent from state law, users must actively submit deletion requests to registered data brokers, who then have 45 days to respond under standard CCPA rules.[1][6]

The legislative debate is expected to resume next year, with privacy advocates preparing to introduce modified proposals that address the governor's stated concerns while attempting to secure tighter default restrictions on the state's data brokerage industry.[4][5]