Five California Privacy Bills: Four Signed Into Law, One Vetoed

Five California bills covering consumer data deletion, wiretap litigation, wearable cameras and workplace monitoring reached Governor Gavin Newsom in September 2026. He signed four and vetoed one. SB 923 is now Chapter 482, SB 690 is Chapter 976, AB 1331 is Chapter 851 and AB 1883 is Chapter 853, all Statutes of 2026, and all four take effect January 1, 2027. SB 1130, the wearable recording device bill, was vetoed on September 30, 2026 and never became law. Our fuller report on the SB 690 signing is at SB 690 signed: private CIPA pen-register suits barred.

Information last verified on October 1, 2026. This is a developing story; we update it as the record changes.

Update, October 1, 2026: The Governor has finished acting on all five bills. SB 923 was approved and chaptered on September 27, 2026 as Chapter 482, Statutes of 2026. SB 690, AB 1331 and AB 1883 were approved and chaptered on September 30, 2026 as Chapters 976, 851 and 853, Statutes of 2026. SB 1130 was vetoed on September 30, 2026. This article has been updated from its September 24, 2026 version, which reported all five as pending.

Status: Final. All five bills passed both chambers and were presented to the Governor on the dates shown. Four were approved and chaptered: SB 923 on September 27, 2026 (Chapter 482, Statutes of 2026) and SB 690, AB 1331 and AB 1883 on September 30, 2026 (Chapters 976, 851 and 853, Statutes of 2026). SB 1130 was vetoed on September 30, 2026 and is not law. None of the four enacted measures carries an urgency clause, so each takes effect January 1, 2027.

Jurisdiction scope: This article describes California state legislation from the 2025-2026 regular session and existing California statutes only. It does not describe federal law, the law of any other state, or how any court has applied these provisions.

Where These Five Bills Actually Stand

Each entry below is the most recent line on that bill's official history page at the California Legislative Information site, re-checked on October 1, 2026.

Four of the five histories now carry an "Approved by the Governor" entry followed by a "Chaptered by Secretary of State" entry with a chapter number. SB 1130's carries a "Vetoed by the Governor." entry instead, followed the same day by a Senate entry recording that consideration of the veto is pending. Each of the five had first been enrolled and presented to the Governor, which means it had cleared both houses in identical form and been formally delivered: SB 923 at 3 p.m. on September 2, SB 690 at 2 p.m. on September 4, SB 1130 at 2 p.m. on September 9, AB 1883 at 3 p.m. on September 10 and AB 1331 at 1:30 p.m. on September 14, 2026. Enrollment is the last step before a bill becomes a statute or does not; it is not itself enactment.

What Each Bill Does

Each description below reflects the enrolled text, which for the four enacted measures is the text the Governor signed and the Secretary of State chaptered. All four take effect January 1, 2027, so none of them states an obligation in force today, which is why much of the description below is still written in the conditional. SB 1130's description is of a bill that was vetoed and never became law.

SB 923: consumer deletion requests

Signed September 27, 2026. Chapter 482, Statutes of 2026. Takes effect January 1, 2027.

California's deletion right currently lives in Civil Code section 1798.105. Subdivision (a) gives a consumer the right to request that a business delete "any personal information about the consumer which the business has collected from the consumer." The load-bearing word is "from." As written, the right reaches information the consumer handed over, not information a business bought or assembled about that consumer from somewhere else.

SB 923 would amend that subdivision so the right reaches personal information the business "has collected from or about the consumer." Where a business obtained the information from a source other than the consumer, the bill would deem the business compliant if it retains a record of the deletion request plus the minimum data necessary to keep that consumer's information deleted and not used for any other purpose.

The bill would also amend Civil Code section 1798.130. A business that operates exclusively online and has a direct relationship with the consumer currently must provide an email address for submitting personal information requests. SB 923 would additionally require such a business to make an online method available, such as a web form or an online portal. The bill would make findings and declarations, and would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. For context on how California's deletion right sits alongside other states, see our state-by-state privacy law comparison.

SB 690: who may sue under the pen register statute

Signed September 30, 2026. Chapter 976, Statutes of 2026. Takes effect January 1, 2027.

SB 690 is by far the shortest of the five, and its scope is narrower than its subject line suggests. It would amend one section, Penal Code section 637.2, which is the private right of action for the whole Invasion of Privacy Act.

Section 637.2 currently lets a person injured by a violation of the chapter sue for the greater of $5,000 per violation or three times actual damages, and it provides that actual damages are not a prerequisite to suit. SB 690 would add a new subdivision (d), moving the existing savings clause on trade secret law to subdivision (e). Under the new subdivision, an action "against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." Section 638.51 is the provision requiring a court order before installing or using a pen register or a trap and trace device.

Two limits are worth stating precisely. The carve-out would be tied to section 638.51 specifically, so by its terms it would not reach claims under Penal Code sections 631 or 632. And it would not repeal section 637.2, which would continue to supply statutory damages for other violations of the chapter. The bill would also provide that the amendment applies retroactively to any pending claim in an action commenced within two years before the legislation's operative date, and it would declare its provisions severable.

SB 1130: wearable recording devices

Vetoed September 30, 2026. Not law. Consideration of the veto is pending in the Senate.

SB 1130 is the most structurally complex of the five. It would add Penal Code section 632.8, amend Penal Code sections 633, 633.1 and 633.5, and add a new Chapter 40 to Division 8 of the Business and Professions Code, commencing with section 22949.85.

Proposed section 632.8(b)(1) would provide that a person "shall not operate a wearable recording device to capture sound or video of any other person in any area within a place of business where the person has a reasonable expectation of privacy" without that person's explicit consent. Both key terms are defined narrowly in the bill. A "place of business" would mean any physical office or retail establishment in which members of the public receive goods or services from the business. A "wearable recording device" would mean a device designed to be worn on or attached to the body rather than held by the user, with the capacity to make sound or video recordings or to transmit sound or video to another device or to the internet.

The definition would carve out several categories: body-worn cameras used by public officers or peace officers in the course of their official duties; headsets, two-way radios and similar devices an employee operates during the normal course of business duties and that the employer provides for that purpose, though an employer that intentionally records a customer using such a device would have to inform the customer; and traditional wireless headphones or earphones. A separate paragraph would state that photographing or recording a public officer or peace officer in a public place, or from a place the person has a right to be, does not by itself violate the prohibition and does not by itself supply reasonable suspicion to detain or probable cause to arrest.

Subdivision (c) would prohibit disabling any light, sound or other indicator showing that a wearable device is capturing sound or video. A violation would carry a fine of up to $1,500 per violation, imprisonment in a county jail not exceeding one year, or both. The section would not apply to hearing aids, augmentative and alternative communication devices and similar assistive technology used by a person with impaired hearing, a communication disorder or a disability as defined in the Americans with Disabilities Act. It would not impose liability on device manufacturers or on providers of software or services that merely process, store or transmit recordings. It would not preclude prosecution under Penal Code section 632 or any other law providing a greater penalty. And subdivision (i) would state that, notwithstanding section 637.2, the section creates no private right of action.

The Business and Professions Code chapter would work on the supply side. Proposed section 22949.86 would bar manufacturing, selling, delivering, holding or offering for sale in California a wearable recording device without a light, sound or other indicator prominent enough that a reasonable person in the vicinity would be alerted to the capturing activity, and subdivision (b) states that this section would become operative on January 1, 2028. Proposed section 22949.87 would reach technology designed, marketed or likely used primarily to disable such indicators, and would also reach acquiring or using that technology. Section 22949.88 would set a civil penalty of up to $2,500 per knowing violation. These provisions would sit alongside the all-party consent tradition described in our guide to California's recording consent rules.

AB 1883: emotion recognition and neural data at work

Signed September 30, 2026. Chapter 853, Statutes of 2026. Takes effect January 1, 2027.

AB 1883 would add Part 5.8 to Division 2 of the Labor Code, commencing with section 1580. Proposed section 1581(a) would provide that an employer "shall not use a workplace surveillance tool that uses artificial intelligence on employees" for either of two purposes: recognizing, or making inferences or predictions about, an individual's emotional state, or collecting neural data.

The bill would define "neural data" as information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information. A "workplace surveillance tool" would mean a system, application, instrument or device that collects or facilitates the collection of employee data, activities, communications, actions, biometrics or behaviors by means other than direct observation by a person, including video or audio surveillance, continuous incremental time-tracking tools, geolocation, and electromagnetic or photoelectronic tracking. The definition of "employer" would be broad, reaching all branches of state government, the University of California, the California State University, counties, charter cities, school and special districts, labor contractors and client employers.

Enforcement would run through the Labor Commissioner under the procedures in Labor Code sections 98.3, 98.7, 98.74 and 1197.1, and a public prosecutor could also enforce the part. Under proposed section 1582(d)(1), a violating employer could face a penalty of up to $500 for each violation, and a petitioner in a civil action could seek temporary or preliminary injunctive relief, punitive damages, and reasonable attorney's fees and costs. Paragraph (d)(2) provides that the same penalty may be recovered as a statutory penalty paid to the employee or as a civil penalty, but not both for the same violation. Proposed section 1583 would exempt use relating to the development of aircraft for use in the national airspace and to products or services for national security, military, space or defense purposes, and only for operations covered by a federal statute, federal regulation or binding federal contract where the use is reasonably necessary to comply. The part would not preempt any city or county ordinance providing equal or greater protection.

AB 1331: surveillance tools and workplace bathrooms

Signed September 30, 2026. Chapter 851, Statutes of 2026. Takes effect January 1, 2027.

AB 1331 would also add a Part 5.8 to Division 2 of the Labor Code, commencing with section 1560. Proposed section 1561(a) would provide that, unless directed by a court order, an employer "shall not use a workplace surveillance tool to monitor or surveil employees in a bathroom located in the workplace."

The bill would give an employee the right to leave behind workplace surveillance tools that are on their person or in their possession when entering a bathroom. That right would not apply where an employee is required to remain available during meal or rest periods under federal law or existing state law, and an employer could still check workplace surveillance tools for the one-time entry and exit of bathrooms in the workplace.

Two situations would not put an employer in violation. The first is where an employee voluntarily chooses to bring a workplace surveillance tool into a workplace bathroom. The second is where an employee brings in a tool such as a badge or personal alarm system because the employer has a policy requiring that tool to be in the employee's possession on work premises for identification or safety purposes, or because the tool is required to access a locked or secured bathroom, but only if that tool neither detects nor records audio or video and has no artificial intelligence physically embedded or attached.

AB 1331's definition of "workplace surveillance tool" would track AB 1883's closely but would expressly exclude smoke and carbon monoxide detectors and weapon detection systems that automatically screen a person's body. Enforcement would use the same architecture: the Labor Commissioner under sections 98.3, 98.7, 98.74 and 1197.1, a public prosecutor under Chapter 8 of Division 1, injunctive relief, punitive damages and attorney's fees, and a penalty of up to $500 per violation. Readers tracking the existing baseline can compare our page on California employee monitoring rules.

What California Law Requires Today

None of the five has changed anything yet. The four enacted measures take effect January 1, 2027 and SB 1130 was vetoed, so the provisions below are the operative California law through December 31, 2026.

The Invasion of Privacy Act. Penal Code section 630 opens the chapter with a legislative declaration that advances in science and technology have produced eavesdropping devices that pose a serious threat to the privacy of Californians, and states that the purpose of the chapter is to protect the right of privacy of the people of this state. Penal Code section 631 reaches wiretapping and unauthorized connections, and reading or attempting to learn the contents or meaning of a message while it is in transit, without the consent of all parties, as well as using information obtained that way. Penal Code section 632 makes it an offense to intentionally eavesdrop upon or record a confidential communication without the consent of all parties, and defines a confidential communication as one carried on in circumstances reasonably indicating that a party wants it confined to the parties, excluding public gatherings, official proceedings, and settings where the parties may reasonably expect to be overheard or recorded. Violations of sections 631 and 632 carry a fine of up to $2,500 per violation, county jail or state prison time, or both, rising to a fine of up to $10,000 per violation on a qualifying prior conviction. Our detailed treatment of how this plays out on calls is at recording phone calls in California.

Pen registers and trap and trace devices. Penal Code section 638.51(a) provides that, except as stated in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order under section 638.52 or 638.53. Subdivision (b) sets out exceptions for providers of electronic or wire communication service in connection with operating, maintaining and testing the service, protecting the service and its users, and with the consent of the user.

The private right of action. Penal Code section 637.2 currently allows a person injured by a violation of the chapter to recover the greater of $5,000 per violation or three times actual damages, and to bring an action to enjoin and restrain a violation. Subdivision (c) provides that having suffered or being threatened with actual damages is not a necessary prerequisite to suit. This is the section SB 690 amends on January 1, 2027.

The deletion right. Civil Code section 1798.105(a) gives a consumer the right to request that a business delete any personal information about the consumer that the business has collected from the consumer, subject to a list of exceptions in subdivision (d) covering completing transactions and honoring warranties, security and integrity, debugging, free speech, the California Electronic Communications Privacy Act, certain research, internal uses reasonably aligned with consumer expectations, and legal obligations.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most useful way to read these five together is not as a single privacy package but as movement in two directions at once. Four of them would extend individual protections into territory the existing statutes do not clearly reach: information a company assembled about a person rather than collected from them, cameras worn on a face rather than mounted on a wall, inferences drawn about an employee's internal state, and one specific room where monitoring has long been contested. SB 690 runs the other way, removing a category of claim from private plaintiffs and reserving it to the Attorney General. Of the four extending measures, three were signed; the one the Governor rejected, SB 1130, was the wearable device bill.

What connects them is enforcement architecture. SB 690 would channel website and app pen register claims to the Attorney General. SB 1130 says in its own text that it would create no private right of action, notwithstanding section 637.2, which is a notable drafting choice in a bill amending the Invasion of Privacy Act, the chapter whose statutory damages provision has driven a great deal of litigation. AB 1883 and AB 1331 both route enforcement through the Labor Commissioner and public prosecutors with a penalty of up to $500 per violation rather than creating a new private cause of action for employees. Whatever else these five bills would do, they lean toward public enforcers, and the four that became law keep that design.

The drafting also shows how hard it is to legislate about a moving target. SB 1130 is technology-specific: it names wearable devices, defines them by how they are worn, and then spends much of its length carving out hearing aids, assistive technology, employer-provided headsets, two-way radios, ordinary wireless earphones and police body cameras. Its core prohibition is also considerably narrower than a phrase like "wearable camera ban" would suggest, because it would apply only inside a "place of business" as the bill defines that term, and only in areas within that place of business where a person has a reasonable expectation of privacy. AB 1883, by contrast, is written around a capability rather than a product, reaching emotion inference and neural data collection regardless of which device performs it. A similar tension runs through California's approach to synthetic media, which we track on our deepfake law page.

One structural detail is worth recording, and it matters more now that both texts are chaptered. AB 1883 adds "Part 5.8 (commencing with Section 1580)" to Division 2 of the Labor Code, titled "Workplace Surveillance Tools." AB 1331 adds "Part 5.8 (commencing with Section 1560)" to the same division, titled "Workplace Surveillance of Employees." The two parts carry different section ranges but the same part number, and the two acts use overlapping but not identical definitions of "workplace surveillance tool." Two parts of a division cannot share a number, so the codifier may renumber one of them. Treat the chapter numbers, Chapter 853 for AB 1883 and Chapter 851 for AB 1331, as the stable identifiers, and expect the final codified section numbers to differ from those printed in the bills.

What Happens Next

The Governor finished acting on all five inside the window the California Constitution set, and the rule that governed these five bills was not the twelve-day rule most summaries cite.

Article IV, section 10(a) gives the Governor three paths on any bill presented to him. He may sign it, in which case it becomes a statute. He may veto it by returning it with his objections to the house of origin, which enters the objections in its journal and reconsiders the bill; if each house then passes it by a two-thirds rollcall vote, it becomes a statute over the veto. Or he may do nothing, and what happens then is governed by subdivision (b).

Subdivision (b)(2) is the paragraph that controls here. It reads: "Any bill passed by the Legislature before September 1 of the second calendar year of the biennium of the legislative session and in the possession of the Governor on or after September 1 that is not returned on or before September 30 of that year becomes a statute."

Both conditions were satisfied for all five, and each can be checked against the verified histories. 2026 is the second calendar year of the 2025-2026 biennium. Each bill received its final legislative action before September 1: SB 923 on August 27, SB 690 on August 28, AB 1883 on August 30, and SB 1130 and AB 1331 on August 31. Each was then presented to the Governor on or after September 1. That placed all five squarely within subdivision (b)(2), which is why September 30, 2026 was the deadline for all five rather than a date that varied with presentment.

The Governor did not leave the deadline to do the work. He approved SB 923 on September 27, 2026, approved SB 690, AB 1331 and AB 1883 on September 30, 2026, and returned SB 1130 with a veto on September 30, 2026. The automatic-enactment path in subdivision (b)(2), under which an unreturned bill becomes a statute without a signature, therefore never came into play for any of the five. For completeness: the twelve-day clock in subdivision (b)(3) applies to bills that do not meet the (b)(2) conditions, and the weekend and holiday extension in subdivision (b)(5) applies only to paragraphs (3) and (4), not to paragraph (2).

What remains for the four that were signed is the operative date. Article IV, section 8(c)(1) provides that a statute enacted at a regular session goes into effect on January 1 next following a 90-day period from the date of enactment. None of SB 923, SB 690, AB 1331 or AB 1883 carries an urgency clause, and each is recorded in its Legislative Counsel's Digest as a majority-vote measure, so all four take effect January 1, 2027 rather than on the day they were signed. The only other date fixed inside the five texts was in SB 1130, where proposed Business and Professions Code section 22949.86, the device indicator manufacturing requirement, would have become operative on January 1, 2028; the veto means it never does.

For SB 1130, article IV, section 10(a) also describes what a veto leaves behind. The bill returns to its house of origin, which enters the Governor's objections in its journal and reconsiders the bill, and it becomes a statute over the veto only if each house then passes it again by a two-thirds rollcall vote. The Senate's September 30, 2026 history entry records that consideration of the veto is pending, and no override vote appears on the official record as of October 1, 2026. This article does not predict whether one will occur, and we will continue to update this page against the official histories.

Disclaimer: This article is general legal information, not legal advice. It describes four California statutes enacted in September 2026 that do not take effect until January 1, 2027, and one bill that was vetoed. Nothing here creates an attorney-client relationship or tells you how any provision would apply to your situation. Consult a licensed California attorney about your specific circumstances.

Related articles

• California Recording Laws
• Recording Phone Calls in California
• California Employee Monitoring Laws
• US State Privacy Laws Comparison
• Deepfake Laws

Last updated: 2026-10-01. This is a developing story; details verified as of 2026-10-01.

Frequently Asked Questions

Are these five California bills in effect right now?

No. Four of the five were enacted but do not take effect until January 1, 2027: SB 923 (Chapter 482, Statutes of 2026), SB 690 (Chapter 976), AB 1331 (Chapter 851) and AB 1883 (Chapter 853). SB 1130 was vetoed on September 30, 2026 and never became law. Through December 31, 2026 the operative California law on these subjects remains the Invasion of Privacy Act at Penal Code section 630 and following, the pen register provision at Penal Code section 638.51, and the CCPA deletion right at Civil Code section 1798.105.

When did the Governor act on them, and what was the deadline?

Article IV, section 10(b)(2) of the California Constitution provides that a bill passed by the Legislature before September 1 of the second calendar year of the biennium, and in the Governor's possession on or after September 1, becomes a statute if it is not returned on or before September 30 of that year. All five bills received their final legislative action in late August 2026 and were presented in September, so September 30, 2026 was the deadline for all five, and it did not shift with the individual presentment dates. He approved SB 923 on September 27, 2026, approved SB 690, AB 1331 and AB 1883 on September 30, 2026, and vetoed SB 1130 on September 30, 2026.

What happens if the Governor simply does nothing?

Under the same provision, a bill that is not returned by the deadline becomes a statute. Inaction does not kill a bill in California. That differs from a pocket veto, which exists in some other systems. A bill that becomes a statute without a signature is enacted the same as a signed one, and it carries a chapter number in the same way. None of these five took that path: the Governor signed four and vetoed one.

Does SB 690 end all wiretapping lawsuits in California?

No. SB 690, now Chapter 976, Statutes of 2026, amends only Penal Code section 637.2 and adds a subdivision limiting who may sue. The limit is tied to violations of section 638.51, the pen register and trap and trace provision, and only where the claim is alleged to arise from conduct occurring on an internet website, online application or mobile application. By its terms it does not reach claims under Penal Code sections 631 or 632, and section 637.2 continues to provide statutory damages for other violations of the chapter. The change takes effect January 1, 2027.

Did SB 1130 make it illegal to wear smart glasses in public in California?

No. SB 1130 was vetoed on September 30, 2026, so it prohibits nothing, and it would not have reached that conduct in any case. The core prohibition in proposed Penal Code section 632.8 would have applied to operating a wearable recording device to capture another person inside a 'place of business,' which the bill defined as a physical office or retail establishment where members of the public receive goods or services, and only in an area within that place of business where the person had a reasonable expectation of privacy. The bill also excluded police body cameras, employer-provided headsets and two-way radios, ordinary wireless earphones, and assistive devices used by people with hearing impairments, communication disorders or disabilities.

Do AB 1883 and AB 1331 let employees sue their employer directly?

Neither act creates a private cause of action an employee could file on their own. Both route enforcement through the Labor Commissioner under Labor Code sections 98.3, 98.7, 98.74 and 1197.1, and both allow a public prosecutor to bring an action. Both set a penalty of up to $500 per violation, and AB 1883 provides at section 1582(d)(2) that the penalty may be recovered either as a statutory penalty paid to the employee or as a civil penalty, but not both for the same violation. Both take effect January 1, 2027.

When do the four enacted measures take effect?

January 1, 2027. Article IV, section 8(c)(1) of the California Constitution provides that a statute enacted at a regular session goes into effect on January 1 next following a 90-day period from the date of enactment, and none of SB 923, SB 690, AB 1331 or AB 1883 carries an urgency clause. The one later date written into any of the five texts was SB 1130's proposed Business and Professions Code section 22949.86, the manufacturing indicator requirement, which would have become operative on January 1, 2028; the veto means it never does.

How can I check the current status myself?

Each bill has a history page at the California Legislative Information site, leginfo.legislature.ca.gov, reachable by bill number for the 2025-2026 session. The history tab lists every action in date order. A signed bill shows an 'Approved by the Governor' line followed by a 'Chaptered by Secretary of State' line with a chapter number, and a vetoed bill shows a 'Vetoed by Governor' line. That page, not a news summary, is the authoritative record.