California Bills Near Passage: Universal Opt-Outs, Location Privacy and AI

California fiscal committees have until Aug. 29 to report bills to the floor, and Sept. 12 is the last day for Assembly and Senate chambers to pass bills, according to the legislature’s calendar. Gov. Gavin Newsom (D) then will have until Oct. 12 to sign or veto any of the approved legislation. Appropriators are set to meet Monday in the Senate and Wednesday in the Assembly.

Multiple California legislature watchers said they’re closely following AB-566, which would require web browsers to support sending universal opt-out signals like the Global Privacy Control. The bill, which is ready for a Senate floor vote, has been narrowed from a 2024 version that Gov. Gavin Newsom (D) vetoed. Newsom last year raised concerns about including mobile OS companies within the bill’s scope, but legislators reduced the 2025 version to web browsers only (see 2507020016).

David Stauss, a privacy attorney with Troutman, said AB-566 has his attention due to its potentially large impact on the adtech industry. The bill is about “the role of adtech” and its treatment “in the fifth-largest economy in the world,” he told us. “I don’t know that tweaks” like carving out mobile “solves the advertising industry’s fundamental concern with” how requiring opt-out preference signals could affect revenue generation. Even so, said Stauss, AB-566 appears to have “traction.”

The legislation could “have a very meaningful impact on businesses” if it becomes law and then there is a “media blitz” teaching consumers how to opt out universally, said Sidley’s Sheri Porath Rockwell, a founder of the California Lawyers Association’s privacy law section. “What gives me pause is if you couple that” with a rule approved last month by the California Privacy Protection Agency (CPPA) that requires websites to notify visitors when universal opt-out signals are accepted, she said. “It’s just another surface area of risk for companies.”

Rockwell added that it “might be technically difficult to implement [universal opt outs] just in California, so maybe it will be nationwide, which would … amplify the impact of it.”

The Future of Privacy Forum thinks AB-566 has a better shot at crossing the finish line this year than it did in 2024, including because the measure was narrowed according to Newsom’s wishes and since it has the endorsement of the CPPA, said Jordan Francis, FPF policy counsel.

Rockwell agreed, adding that AB-566 has sailed through the legislature. “I would be surprised if Newsom vetoed it.”

The Electronic Frontier Foundation “would hope that the bill this year was responsive” to Newsom’s criticisms and “that it would pass,” said Hayley Tsukayama, associate director of legislative activism. Still, EFF preferred the bill’s more expansive predecessor, she said.

Managing privacy rights for the average person is “very time-consuming and very difficult, and so ... anything we can do to make our privacy rights more user-friendly is a good thing,” added Tsukayama. “A one-stop switch in your browser would be pretty good, right? You can respect your privacy, and you wouldn’t have to waste your own time.”

Consumer Watchdog tech and privacy advocate Justin Kloczko said that Newsom’s signature “is really the outstanding question,” but removing mobile from the bill “might sway him to get his signature on it this time.” Without a universal opt-out mechanism, “data privacy rights are kind of useless because then” consumers have to visit every website and toggle various options."

Location Privacy

Multiple privacy experts also mentioned AB-322 as legislation to watch. The location-privacy measure would have “significant impacts potentially on [the] use of location data for advertising,” said Francis.

Among other requirements, AB-322 would impose heightened transparency requirements on businesses collecting precise geolocation information, plus “some pretty strong prohibitions against collecting or processing” that type of data “for more than is necessary to provide a requested product or service,” the FPF official said. “This is probably a pretty broad bill in its effect, and … it aligns with a lot of what we're seeing in other states this legislative session.”

Rockwell agreed that AB-322 could be “a big deal for businesses.” Many organizations don’t have a good enough handle on all the data they’re collecting, with the mobile environment presenting especially difficult technical challenges, said Rockwell.

From a political perspective, fears about how U.S. Immigration and Customs Enforcement may use people’s location data could “really propel this bill -- however imperfect -- along, and it’s possible that Newsom would not veto it for that reason,” added the Sidley lawyer.

A ‘Gathering Storm’ of AI Bills

Stauss said he’s following 23 California AI bills that could affect the private sector, on an array of topics including algorithmic discrimination, health care, provenance and disclosures. “There’s a lot going on here and the landscape could be very different” after September, when it’s decided which bills will become law, he said.

Stauss highlighted an algorithmic-discrimination bill (AB-1018) by Assembly Privacy Committee Chair Rebecca Bauer-Kahan (D) that’s now in Senate Appropriations (see 2507160030). It’s not the only active bill that would govern automated decision-making technology (ADMT), noted the lawyer: If one or more of them become laws, “a lot of thought” will be needed from a compliance perspective on how they will interact with the CPPA’s recently approved ADMT regulations, which could get a final OK by the state by September’s end (see 2508120025).

“We've talked for years about interoperability between states,” but soon it could be about interoperability between the CPPA and state lawmakers, said Stauss. “There’s just this gathering storm.”

FPF is tracking about 14 of the California AI bills, said Justine Gluck, AI legislation fellow. AB-1018 is at the top of her list. The legislation is comparable to the Colorado AI Act, Gluck said. “This is the third year that [Bauer-Kahan] has introduced the bill,” so she likely “has a strong desire to get it through this year.” A similar ADMT bill from the Senate (SB-420) hasn’t been set for hearing, said Gluck, who suspects it has “been tabled in favor of moving forward with the Bauer-Kahan version.”

SB-53 is another of the most talked-about AI bills this year, said Gluck. That’s the sequel to a frontier AI models bill by Sen. Scott Wiener (D) that Newsom vetoed last year. Instead of signing, the governor established a working group to recommend frontier AI policies. The group released recommendations in June (see 2506170051), which Wiener weaved into SB-53 (see 2507010047).

Now in Assembly Appropriations, SB-53 would apply only to about eight to 10 organizations that are developing “high-powered systems … that could theoretically cause death or serious injury of 100 people or over a billion dollars in damages,” noted the FPF official. It would require transparency about safety and security protocols and provide whistleblower protection to employees at AI developers.

Gluck noted that SB-53 lacks some of the most controversial aspects of the vetoed 2024 bill -- and its proposed penalties are less. Being based partly on a report by Newsom’s working group might also give it a better chance of getting signed than AB-1018, she said.

More Bills to Watch

Below are other active bills Privacy Daily is watching, including some that several California watchers mentioned:

1. SB-7 by Sen. Jerry McNerney (D) on employers’ use of automated decision systems (see 2507170011 and 2506260010).
2. AB-1064 by Bauer-Kahan would make rules around using kids' personal information for AI training (see 2507170018 and 2502210035).
3. Bills that restrict "surveillance pricing," such as AB-446 by Assemblymember Chris Ward (D) and SB-259 by Sen. Aisha Wahab (D). Ward spoke to Privacy Daily about AB-446 on Thursday (see 2508150039).
4. SB-361 by Sen. Josh Becker (D) would amend the California Delete Act to require data brokers to disclose more types of personal information in their state registrations.
5. AB-1043 by Assemblymember Buffy Wicks (D) is a kids online safety measure that would require manufacturers to develop a way to have device owners enter the user’s birthdate or age, so that a digital signal about the user’s age bracket could be sent to app developers through an application programming interface.

Other notable bills hit roadblocks but could return next year:

1. SB-690 by Sen. Anna Caballero (D) would amend the California Invasion of Privacy Act to eliminate wiretapping, pen register and trap-and-trace liabilities from online tracking technologies used for business under CIPA (see 2507010057).
2. SB-435 by Wahab would state that publicly available sensitive information remains sensitive information subject to heightened protections under the California Consumer Protection Act (see 2507170011).

With so many California privacy and AI bills’ fates unknown, Stauss advised businesses: “Play with what you know, not with what you don’t know.”

For now, it makes sense for organizations to focus on the imminent CPPA rules on ADMT, risk assessments and other subjects, said the privacy attorney. After bills are signed this fall, “then we talk to clients about what the landscape looks like.”

One step a company can take now is to conduct an AI inventory, added Stauss. Understand how your company is using and deploying AI, including if it’s being used for employment and other consequential decisions: “You've got to get that under control for reasons that go far beyond what California is going to do.”

Rockwell said she always advises organizations “to get into the nitty-gritty and do what they can to keep track of their trackers.” This year’s possible new California laws “just amplify the potential risks associated with not getting it right.”