Five California Privacy Bills Await the Governor's Action

Five California bills covering consumer data deletion, wiretap litigation, wearable cameras and workplace monitoring have passed both chambers and now sit enrolled with Governor Gavin Newsom. As of September 24, 2026, none has been signed, chaptered or vetoed. None of them is law.

Information last verified on September 24, 2026. This is a developing story; we update it as the record changes.

Status: All five bills passed both chambers and were enrolled and presented to the Governor on the dates shown. As of September 24, 2026 none has been signed, chaptered or vetoed. None is law.

Jurisdiction scope: This article describes proposed California state legislation and existing California statutes only. It does not describe federal law, the law of any other state, or how any court has applied these provisions.

Where These Five Bills Actually Stand

Each entry below is the most recent line on that bill's official history page at the California Legislative Information site, re-checked on September 24, 2026.

None of the five histories carries an "Approved by the Governor" entry, a "Chaptered by Secretary of State" entry, or a "Vetoed by Governor" entry. Enrollment means a bill has cleared both houses in identical form and has been formally delivered to the Governor. It is the last step before a bill becomes a statute or does not, and it is not itself enactment.

What Each Bill Would Do

Every description in this section is conditional. Each one reflects the enrolled text, which is the version now before the Governor, and none of it describes law in force today.

SB 923: consumer deletion requests

California's deletion right currently lives in Civil Code section 1798.105. Subdivision (a) gives a consumer the right to request that a business delete "any personal information about the consumer which the business has collected from the consumer." The load-bearing word is "from." As written, the right reaches information the consumer handed over, not information a business bought or assembled about that consumer from somewhere else.

SB 923 would amend that subdivision so the right reaches personal information the business "has collected from or about the consumer." Where a business obtained the information from a source other than the consumer, the bill would deem the business compliant if it retains a record of the deletion request plus the minimum data necessary to keep that consumer's information deleted and not used for any other purpose.

The bill would also amend Civil Code section 1798.130. A business that operates exclusively online and has a direct relationship with the consumer currently must provide an email address for submitting personal information requests. SB 923 would additionally require such a business to make an online method available, such as a web form or an online portal. The bill would make findings and declarations, and would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. For context on how California's deletion right sits alongside other states, see our state-by-state privacy law comparison.

SB 690: who may sue under the pen register statute

SB 690 is by far the shortest of the five, and its scope is narrower than its subject line suggests. It would amend one section, Penal Code section 637.2, which is the private right of action for the whole Invasion of Privacy Act.

Section 637.2 currently lets a person injured by a violation of the chapter sue for the greater of $5,000 per violation or three times actual damages, and it provides that actual damages are not a prerequisite to suit. SB 690 would add a new subdivision (d), moving the existing savings clause on trade secret law to subdivision (e). Under the new subdivision, an action "against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General." Section 638.51 is the provision requiring a court order before installing or using a pen register or a trap and trace device.

Two limits are worth stating precisely. The carve-out would be tied to section 638.51 specifically, so by its terms it would not reach claims under Penal Code sections 631 or 632. And it would not repeal section 637.2, which would continue to supply statutory damages for other violations of the chapter. The bill would also provide that the amendment applies retroactively to any pending claim in an action commenced within two years before the legislation's operative date, and it would declare its provisions severable.

SB 1130: wearable recording devices

SB 1130 is the most structurally complex of the five. It would add Penal Code section 632.8, amend Penal Code sections 633, 633.1 and 633.5, and add a new Chapter 40 to Division 8 of the Business and Professions Code, commencing with section 22949.85.

Proposed section 632.8(b)(1) would provide that a person "shall not operate a wearable recording device to capture sound or video of any other person in any area within a place of business where the person has a reasonable expectation of privacy" without that person's explicit consent. Both key terms are defined narrowly in the bill. A "place of business" would mean any physical office or retail establishment in which members of the public receive goods or services from the business. A "wearable recording device" would mean a device designed to be worn on or attached to the body rather than held by the user, with the capacity to make sound or video recordings or to transmit sound or video to another device or to the internet.

The definition would carve out several categories: body-worn cameras used by public officers or peace officers in the course of their official duties; headsets, two-way radios and similar devices an employee operates during the normal course of business duties and that the employer provides for that purpose, though an employer that intentionally records a customer using such a device would have to inform the customer; and traditional wireless headphones or earphones. A separate paragraph would state that photographing or recording a public officer or peace officer in a public place, or from a place the person has a right to be, does not by itself violate the prohibition and does not by itself supply reasonable suspicion to detain or probable cause to arrest.

Subdivision (c) would prohibit disabling any light, sound or other indicator showing that a wearable device is capturing sound or video. A violation would carry a fine of up to $1,500 per violation, imprisonment in a county jail not exceeding one year, or both. The section would not apply to hearing aids, augmentative and alternative communication devices and similar assistive technology used by a person with impaired hearing, a communication disorder or a disability as defined in the Americans with Disabilities Act. It would not impose liability on device manufacturers or on providers of software or services that merely process, store or transmit recordings. It would not preclude prosecution under Penal Code section 632 or any other law providing a greater penalty. And subdivision (i) would state that, notwithstanding section 637.2, the section creates no private right of action.

The Business and Professions Code chapter would work on the supply side. Proposed section 22949.86 would bar manufacturing, selling, delivering, holding or offering for sale in California a wearable recording device without a light, sound or other indicator prominent enough that a reasonable person in the vicinity would be alerted to the capturing activity, and subdivision (b) states that this section would become operative on January 1, 2028. Proposed section 22949.87 would reach technology designed, marketed or likely used primarily to disable such indicators, and would also reach acquiring or using that technology. Section 22949.88 would set a civil penalty of up to $2,500 per knowing violation. These provisions would sit alongside the all-party consent tradition described in our guide to California's recording consent rules.

AB 1883: emotion recognition and neural data at work

AB 1883 would add Part 5.8 to Division 2 of the Labor Code, commencing with section 1580. Proposed section 1581(a) would provide that an employer "shall not use a workplace surveillance tool that uses artificial intelligence on employees" for either of two purposes: recognizing, or making inferences or predictions about, an individual's emotional state, or collecting neural data.

The bill would define "neural data" as information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information. A "workplace surveillance tool" would mean a system, application, instrument or device that collects or facilitates the collection of employee data, activities, communications, actions, biometrics or behaviors by means other than direct observation by a person, including video or audio surveillance, continuous incremental time-tracking tools, geolocation, and electromagnetic or photoelectronic tracking. The definition of "employer" would be broad, reaching all branches of state government, the University of California, the California State University, counties, charter cities, school and special districts, labor contractors and client employers.

Enforcement would run through the Labor Commissioner under the procedures in Labor Code sections 98.3, 98.7, 98.74 and 1197.1, and a public prosecutor could also enforce the part. A violating employer could face a penalty of up to $500 for each violation, and a petitioner in a civil action could seek temporary or preliminary injunctive relief, punitive damages, and reasonable attorney's fees and costs. The same penalty could be recovered as a statutory penalty paid to the employee or as a civil penalty, but not both for the same violation. Proposed section 1583 would exempt use relating to the development of aircraft for use in the national airspace and to products or services for national security, military, space or defense purposes, and only for operations covered by a federal statute, federal regulation or binding federal contract where the use is reasonably necessary to comply. The part would not preempt any city or county ordinance providing equal or greater protection.

AB 1331: surveillance tools and workplace bathrooms

AB 1331 would also add a Part 5.8 to Division 2 of the Labor Code, commencing with section 1560. Proposed section 1561(a) would provide that, unless directed by a court order, an employer "shall not use a workplace surveillance tool to monitor or surveil employees in a bathroom located in the workplace."

The bill would give an employee the right to leave behind workplace surveillance tools that are on their person or in their possession when entering a bathroom. That right would not apply where an employee is required to remain available during meal or rest periods under federal law or existing state law, and an employer could still check workplace surveillance tools for the one-time entry and exit of bathrooms in the workplace.

Two situations would not put an employer in violation. The first is where an employee voluntarily chooses to bring a workplace surveillance tool into a workplace bathroom. The second is where an employee brings in a tool such as a badge or personal alarm system because the employer has a policy requiring that tool to be in the employee's possession on work premises for identification or safety purposes, or because the tool is required to access a locked or secured bathroom, but only if that tool neither detects nor records audio or video and has no artificial intelligence physically embedded or attached.

AB 1331's definition of "workplace surveillance tool" would track AB 1883's closely but would expressly exclude smoke and carbon monoxide detectors and weapon detection systems that automatically screen a person's body. Enforcement would use the same architecture: the Labor Commissioner under sections 98.3, 98.7, 98.74 and 1197.1, a public prosecutor under Chapter 8 of Division 1, injunctive relief, punitive damages and attorney's fees, and a penalty of up to $500 per violation. Readers tracking the existing baseline can compare our page on California employee monitoring rules.

What California Law Requires Today

None of the five bills changes anything yet. The provisions below are the operative California law while the bills sit with the Governor.

The Invasion of Privacy Act. Penal Code section 630 opens the chapter with a legislative declaration that advances in science and technology have produced eavesdropping devices that pose a serious threat to the privacy of Californians, and states that the purpose of the chapter is to protect the right of privacy of the people of this state. Penal Code section 631 reaches wiretapping and unauthorized connections, and reading or attempting to learn the contents or meaning of a message while it is in transit, without the consent of all parties, as well as using information obtained that way. Penal Code section 632 makes it an offense to intentionally eavesdrop upon or record a confidential communication without the consent of all parties, and defines a confidential communication as one carried on in circumstances reasonably indicating that a party wants it confined to the parties, excluding public gatherings, official proceedings, and settings where the parties may reasonably expect to be overheard or recorded. Violations of sections 631 and 632 carry a fine of up to $2,500 per violation, county jail or state prison time, or both, rising to a fine of up to $10,000 per violation on a qualifying prior conviction. Our detailed treatment of how this plays out on calls is at recording phone calls in California.

Pen registers and trap and trace devices. Penal Code section 638.51(a) provides that, except as stated in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order under section 638.52 or 638.53. Subdivision (b) sets out exceptions for providers of electronic or wire communication service in connection with operating, maintaining and testing the service, protecting the service and its users, and with the consent of the user.

The private right of action. Penal Code section 637.2 currently allows a person injured by a violation of the chapter to recover the greater of $5,000 per violation or three times actual damages, and to bring an action to enjoin and restrain a violation. Subdivision (c) provides that having suffered or being threatened with actual damages is not a necessary prerequisite to suit. This is the section SB 690 would amend.

The deletion right. Civil Code section 1798.105(a) gives a consumer the right to request that a business delete any personal information about the consumer that the business has collected from the consumer, subject to a list of exceptions in subdivision (d) covering completing transactions and honoring warranties, security and integrity, debugging, free speech, the California Electronic Communications Privacy Act, certain research, internal uses reasonably aligned with consumer expectations, and legal obligations.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most useful way to read these five together is not as a single privacy package but as movement in two directions at once. Four of them would extend individual protections into territory the existing statutes do not clearly reach: information a company assembled about a person rather than collected from them, cameras worn on a face rather than mounted on a wall, inferences drawn about an employee's internal state, and one specific room where monitoring has long been contested. SB 690 runs the other way, removing a category of claim from private plaintiffs and reserving it to the Attorney General.

What connects them is enforcement architecture. SB 690 would channel website and app pen register claims to the Attorney General. SB 1130 says in its own text that it would create no private right of action, notwithstanding section 637.2, which is a notable drafting choice in a bill amending the Invasion of Privacy Act, the chapter whose statutory damages provision has driven a great deal of litigation. AB 1883 and AB 1331 both route enforcement through the Labor Commissioner and public prosecutors with a penalty of up to $500 per violation rather than creating a new private cause of action for employees. Whatever else these five bills would do, they lean toward public enforcers.

The drafting also shows how hard it is to legislate about a moving target. SB 1130 is technology-specific: it names wearable devices, defines them by how they are worn, and then spends much of its length carving out hearing aids, assistive technology, employer-provided headsets, two-way radios, ordinary wireless earphones and police body cameras. Its core prohibition is also considerably narrower than a phrase like "wearable camera ban" would suggest, because it would apply only inside a "place of business" as the bill defines that term, and only in areas within that place of business where a person has a reasonable expectation of privacy. AB 1883, by contrast, is written around a capability rather than a product, reaching emotion inference and neural data collection regardless of which device performs it. A similar tension runs through California's approach to synthetic media, which we track on our deepfake law page.

One structural detail is worth recording because it is visible on the face of both enrolled texts. AB 1883 would add "Part 5.8 (commencing with Section 1580)" to Division 2 of the Labor Code, titled "Workplace Surveillance Tools." AB 1331 would add "Part 5.8 (commencing with Section 1560)" to the same division, titled "Workplace Surveillance of Employees." The two parts carry different section ranges but the same part number, and the two bills use overlapping but not identical definitions of "workplace surveillance tool." Codification overlaps of this kind are ordinarily reconciled after the fact, and we note it here only as a feature of the texts as they now stand.

What Happens Next

The clock here is set by the California Constitution, not by a calendar convention, and the rule that governs these five bills is not the twelve-day rule most summaries cite.

Article IV, section 10(a) gives the Governor three paths on any bill presented to him. He may sign it, in which case it becomes a statute. He may veto it by returning it with his objections to the house of origin, which enters the objections in its journal and reconsiders the bill; if each house then passes it by a two-thirds rollcall vote, it becomes a statute over the veto. Or he may do nothing, and what happens then is governed by subdivision (b).

Subdivision (b)(2) is the paragraph that controls here. It reads: "Any bill passed by the Legislature before September 1 of the second calendar year of the biennium of the legislative session and in the possession of the Governor on or after September 1 that is not returned on or before September 30 of that year becomes a statute."

Both conditions are satisfied for all five, and each can be checked against the verified histories. 2026 is the second calendar year of the 2025-2026 biennium. Each bill received its final legislative action before September 1: SB 923 on August 27, SB 690 on August 28, AB 1883 on August 30, and SB 1130 and AB 1331 on August 31. Each was then presented to the Governor on or after September 1, on the dates in the table above. That places all five squarely within subdivision (b)(2).

Three consequences follow. First, the operative date is September 30, 2026 for all five, and it does not vary with the individual presentment dates. The twelve-day clock in subdivision (b)(3) applies to bills that do not meet the (b)(2) conditions, and the weekend and holiday extension in subdivision (b)(5) applies only to paragraphs (3) and (4), not to paragraph (2). Second, inaction here is not a pocket veto. If the Governor does not return a bill on or before September 30, the constitutional text provides that the bill becomes a statute anyway, without a signature. Third, a bill that becomes a statute that way is enacted just as a signed one is.

If any of these were enacted, article IV, section 8(c)(1) provides that a statute enacted at a regular session goes into effect on January 1 next following a 90-day period from the date of enactment, which for a statute enacted in late September 2026 would be January 1, 2027. The only date fixed inside the five texts themselves is in SB 1130, where proposed Business and Professions Code section 22949.86, the device indicator manufacturing requirement, states that it would become operative on January 1, 2028.

The event that converts this story from a pending matter into hard news is a new line on the official bill history. For a signature, that is an "Approved by the Governor" entry followed by a "Chaptered by Secretary of State" entry carrying a chapter number. For a rejection, it is a "Vetoed by Governor" entry with its date and the accompanying veto message. For inaction, it is the passing of September 30, 2026 without a return, after which the enrolled bill becomes a statute by operation of the provision quoted above. We will update this page against the official histories as those entries appear.

Disclaimer: This article is general legal information, not legal advice. It describes pending legislation that is not in force and may never take effect. Nothing here creates an attorney-client relationship or tells you how any provision would apply to your situation. Consult a licensed California attorney about your specific circumstances.

Related articles

• California Recording Laws
• Recording Phone Calls in California
• California Employee Monitoring Laws
• US State Privacy Laws Comparison
• Deepfake Laws

Last updated: 2026-09-24. This is a developing story; details verified as of 2026-09-24.