California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits

What happened

Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy settings without consent; AB 883 shortens data‑broker deletion request processing to 30 days and promotes DROP awareness; SB 690 removes the private right of action for certain pen‑register and trap‑and‑trace claims under CIPA.

Why it matters for trust and compliance

• Its status is signed. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The new statutes significantly strengthen consumer deletion rights, tighten data‑broker obligations, protect user‑controlled privacy settings, and curtail a class of privacy‑related lawsuits.
• It relates to CCPA/CPRA. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Inventory where this data is shared or sold and whether opt-outs are honoured.