Newsom Vetoes AB 1542 as California CCPA Deletion Bills Advance

Newsom Vetoes AB 1542 as California CCPA Deletion Bills Advance

Governor Gavin Newsom vetoed AB 1542 on September 27, 2026, rejecting a categorical ban on selling or sharing sensitive personal information. His office lists a data broker deletion bill as signed the same day. For California consumers today, the CCPA rules on sensitive data are unchanged.

Information last verified on September 28, 2026. This is a developing story; we update it as the record changes.

Status: AB 1542 (Ward) was vetoed on September 27, 2026, and the Legislature's action log records its measure status as "Inactive Bill - Vetoed." AB 883 (Lowenthal) appears on the Governor's signed list for September 27, 2026, but the action log still read "Active Bill - Enrolled" with no chapter number assigned when we checked on September 28, 2026. SB 923 (Becker) also read "Active Bill - Enrolled," presented to the Governor on September 2, 2026, and we found no record of gubernatorial action on it on any official source we reached as of September 28, 2026.

Jurisdiction scope: This article covers California law only. Sensitive data rules and deletion rights differ in every other state that has a consumer privacy statute, so nothing described here transfers automatically. Our California data privacy guide covers the state framework in full.

What Happened

Governor Newsom acted on California consumer privacy legislation on September 27, 2026, and the three bills below did not move in the same direction. The records also do not all agree with each other yet, which is why each bill is reported twice here: once from the Governor's office and once from the Legislature's own action log.

AB 1542 (Ward). The measure is titled "An act to amend Sections 1798.100 and 1798.121 of the Civil Code, relating to privacy," under the topic "Sensitive personal information." The Legislature's action log records the entry "Vetoed by Governor." on 09/27/26, and the measure status now reads "Inactive Bill - Vetoed." Before that, the Assembly recorded "Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 44. Noes 19. Page 6852.)." on 08/30/26, and the bill was "Enrolled and presented to the Governor at 1 p.m." on 09/09/26. This record is complete. AB 1542 is not law, and it never became law.

AB 883 (Lowenthal). The measure is "An act to amend Section 1798.99.86 of, and to add Section 1798.99.86.5 to, the Civil Code, relating to data brokers." The Governor's office listed AB 883 among the bills signed in its legislative update for September 27, 2026, identifying it by its official topic, "Data brokers: accessible deletion mechanism," and naming Assemblymember Josh Lowenthal. The Legislature's action log had not caught up when we checked on September 28, 2026. The measure status still read "Active Bill - Enrolled," the newest entry was "Enrolled and presented to the Governor at 4 p.m." on 09/04/26, and no chapter number had been assigned.

SB 923 (Becker). The measure is "An act to amend Sections 1798.105 and 1798.130 of the Civil Code, relating to privacy," under the topic "Consumer privacy requests: deletion request records and request submission methods." Its measure status also read "Active Bill - Enrolled" on September 28, 2026, with the newest entry "Enrolled and presented to the Governor at 3 p.m." on 09/02/26. SB 923 does not appear anywhere on the Governor's September 27, 2026 legislative update, in either the signed list or the vetoed list, and we found no other September 2026 release from the Governor's office referring to it. We cannot confirm that SB 923 has been signed, and we do not assert that it has been.

That gap has a deadline attached to it. Article IV, Section 10(b)(2) of the California Constitution provides that a bill "passed by the Legislature before September 1 of the second calendar year of the" biennium of the legislative session, and "in the possession of the Governor on or after September 1 that is not returned on or before September 30 of that year becomes a statute." SB 923 was passed on concurrence on 08/27/26 and presented on 09/02/26, so September 30, 2026 resolves it one way or the other.

What the CCPA Already Does About Sensitive Personal Information

Because AB 1542 was vetoed, the question that actually matters to a reader is what California law already provides. The answer is not "nothing," and getting this wrong in either direction misleads people.

Civil Code Section 1798.140 supplies the definition. "Sensitive personal information" means, among other enumerated categories:

• "A consumer's precise geolocation."
• "The processing of biometric information for the purpose of uniquely identifying a consumer."
• "Personal information collected and analyzed concerning a consumer's health."
• "A consumer's racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership."

Section 1798.121 then gives consumers a right to limit, which is a different instrument from a prohibition on sale. Subdivision (a) provides: "A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer's sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services set forth in paragraphs (2), (4), (5), and (8) of subdivision (e) of Section 1798.140, and as authorized by regulations adopted pursuant to subparagraph (C) of paragraph (18) of subdivision (a) of Section 1798.185."

Subdivision (b) gives that direction force. A business that has received it "shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from using or disclosing the consumer's sensitive personal information for any other purpose after its receipt of the consumer's direction unless the consumer subsequently provides consent for the use or disclosure of the consumer's sensitive personal information for additional purposes."

Subdivision (c) extends the restriction down the chain. A service provider or contractor assisting the business "may not use the sensitive personal information after it has received instructions from the business and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose."

Two limits belong in the same breath. First, the mechanism is consumer-initiated: the restriction in subdivision (b) attaches after the business receives the consumer's direction. Second, subdivision (d) removes a category from the section entirely: "Sensitive personal information that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to this section, as further defined in regulations adopted pursuant to subparagraph (C) of paragraph (18) of subdivision (a) of Section 1798.185, and shall be treated as personal information for purposes of all other sections of this act, including Section 1798.100."

So California consumers have a statutory right to limit the use and disclosure of sensitive personal information, subject to the exclusion in subdivision (d). What they do not have, after this veto, is a statutory ban that operates without the consumer acting. The broader opt-out machinery is covered in our guide to CCPA opt-out rights, and the framework as a whole in our explainer on what the CCPA is.

What AB 1542 Would Have Added, and the Veto

AB 1542 would have added a new subdivision (e) to Section 1798.121. Its operative paragraph read: "(e) (1) Subject to subparagraph (A) of paragraph (2) of subdivision (ad) of Section 1798.140, subparagraph (A) of paragraph (2) of subdivision (ah) of Section 1798.140, and paragraph (2), a business, service provider, or contractor shall not sell or share sensitive personal information to a third party."

The cross references are not decoration. Subdivisions (ad) and (ah) of Section 1798.140 are the CCPA's definitions of "sell" and "share," so the exclusions built into those definitions would have carried through the new prohibition. The bill added one express exception in paragraph (2): "A commercial credit reporting agency may sell a consumer's social security number to the extent the commercial credit reporting agency uses that information solely to identify the relationship of a consumer to a business that the consumer owns."

The Legislative Counsel's Digest put the change in one sentence: "This bill would, under the CCPA, prohibit a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, except as specified." The bill also declared that "The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020."

The veto message

We obtained and read the Governor's veto message for AB 1542, published as a PDF on the Governor's official site and date stamped SEP 27 2026. It opens: "I am returning Assembly Bill 1542 without my signature."

The message gives two reasons. The first is about the choice of instrument. The Governor wrote: "While I support the author's goal of protecting the sensitive personal information of Californians, a categorical ban on sharing that information is a step too far. Under state law, companies are required to provide California consumers with the option to limit the sharing of such information, and I worry there may be unintended consequences if consumers are removed entirely from the decision process."

The second is fiscal. The message states: "Further, because this bill would apply to businesses broadly, its implementation and enforcement would result in significant costs not included in the 2026 Budget Act." It then describes the administration's balanced budget and concludes that "it is vital that we remain disciplined when considering bills with significant fiscal implications that are not included in the budget, such as this measure." The message closes with the Governor's declination to sign and is signed Gavin Newsom.

Those are the stated reasons in full. We do not attribute any other rationale to the veto.

What Changes If SB 923 and AB 883 Take Effect

SB 923: a wider deletion right and an online request method

The current text of Section 1798.105(a) reads: "A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer." SB 923 changes two words in that sentence, so that it reads: "A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer."

The practical effect of "from or about" is that information a business obtained from a third party rather than from the consumer directly falls within the request. The bill then adds a compliance provision for exactly that situation: "A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal information remains deleted from the business's records and is not being used for any other purpose."

Note the closing limit in that sentence. The retained record is permitted to keep the information deleted, and the text states the data "is not being used for any other purpose."

The second change is to Section 1798.130, which governs how requests get submitted. The general rule in the current text requires a business to "Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number." The current text then carves out online-only businesses, which "shall only be required to provide an email address."

SB 923 rewrites that carve-out: "A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively." An email address alone would no longer satisfy the section for those businesses.

AB 883: 30 days instead of 45, and a new section for officials and judges

Section 1798.99.86(a) directs that "By January 1, 2026, the California Privacy Protection Agency shall establish an accessible deletion mechanism" for data broker deletion requests. The current text requires a data broker to access that mechanism "at least once every 45 days," and the section sets deletion and processing obligations on the same 45-day cadence.

AB 883 shortens the interval. Its amended text provides that "a data broker shall access the accessible deletion mechanism established pursuant to subdivision (a) at least once every 30 days," and the Legislative Counsel's Digest confirms the scope of the change: "This bill would change the above-described 45-day period to a 30-day period and make conforming changes."

The bill also adds a new Section 1798.99.86.5. The Digest describes its notice duties: the bill "would require the Secretary of State, certain local government officials, the Judicial Council, and the State Bar of California to notify any state elected official, local elected official, or judge, as applicable, that the person may submit a request to delete that person's personal information through the above-described accessible deletion mechanism, as prescribed." Subdivision (f) of the new section adds an enforcement route, providing that "The Attorney General, a county counsel, or a city attorney may bring a civil action, on behalf of a judge or elected official, against a data broker who violates Section 1798.99.86," and the text limits that action to violations with respect to the personal information of that judge or elected official.

Our data broker opt out hub covers how the broker side of this process works in practice.

When any of this would take effect

Neither bill is operative now. Article IV, Section 8(c) of the California Constitution provides that "a statute enacted at a regular session shall go into effect on January 1 next following a 90-day period from the date of enactment of the statute." For a bill enacted on September 27, 2026, that date is January 1, 2027.

AB 883's new Section 1798.99.86.5 sets its own later date. Subdivision (i) states: "This section shall become operative on July 1, 2027." The amendment to Section 1798.99.86 carries no separate operative clause, so the shortened 30-day interval would follow the general rule. Although the amended sentence retains the lead-in "Beginning August 1, 2026," the 30-day obligation itself cannot bind a data broker before the amendment takes effect.

Neither AB 883 nor SB 923 carried a chapter number on the Legislature's action log as of September 28, 2026, so neither can be cited to a chapter yet.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The split is coherent once you separate two kinds of privacy rule. AB 883 and SB 923 adjust the mechanics of a right the consumer already exercises: how often a data broker must check the deletion queue, how a consumer submits a request, how far a deletion reaches into data the business did not collect directly. AB 1542 would have done something different. It would have taken a decision out of the consumer's hands and settled it by statute for everyone.

The veto message names that distinction itself. The Governor wrote that under state law companies must already provide "the option to limit the sharing of such information," and that he worried about "unintended consequences if consumers are removed entirely from the decision process." Read on its own terms, that is a choice between two regulatory models: a permission that the consumer can withdraw, versus a prohibition that does not depend on the consumer at all.

The consequence for a reader is a burden question. Under Section 1798.121(a) the right is exercised by direction, and subdivision (b) restricts the business after it receives that direction. The work of limiting sensitive data use therefore sits with the person, business by business. AB 1542 would have shifted that work to businesses by rule. The veto leaves it where it was.

Two details deserve flagging rather than smoothing over. Section 1798.121(d) removes from the section's reach sensitive personal information "collected or processed without the purpose of inferring characteristics about a consumer," which means the right to limit does not reach every use of every category in the Section 1798.140 definition. And the fiscal objection in the veto message is tied to a specific document, the 2026 Budget Act, which is a narrower ground than a rejection of the underlying policy.

The record itself is the other thing worth knowing. The Governor's office reports AB 883 as signed while the Legislature's log still reports it as enrolled, and SB 923 appears on neither of the Governor's lists. Those are not contradictions so much as a publication lag on one side and an unexplained absence on the other. Article IV, Section 10(b)(2) supplies the outer bound for SB 923, and we will report the resolved record rather than infer it.

How This Affects You

Nothing a California consumer can do today changed because of the veto. What follows is a general description of how the cited statutes operate. It is not advice about any particular situation, and we do not draft request language for readers.

Deletion requests to a business. Section 1798.105(a) gives a consumer the right to request that a business delete personal information about the consumer that the business has collected from the consumer. Section 1798.130 governs how that request reaches the business, requiring most businesses to make available at least two designated methods "including, at a minimum, a toll-free telephone number," while a business that operates exclusively online with a direct consumer relationship "shall only be required to provide an email address" under the current text. Section 1798.105(d) sets out the circumstances in which a business need not comply, including where retention is reasonably necessary to complete a transaction, to maintain security and integrity, to comply with a legal obligation, and other enumerated purposes.

Data broker deletion requests. Section 1798.99.86(a) directs the California Privacy Protection Agency to establish the accessible deletion mechanism, and the section requires data brokers to access that mechanism on the stated interval and to act on the deletion requests they find there. That interval is 45 days under the current text and would become 30 days under AB 883 once it takes effect.

Sensitive personal information. Section 1798.121(a) is the operative right, and the same subdivision requires a business that uses or discloses sensitive personal information for purposes other than those specified to give notice to consumers "pursuant to subdivision (a) of Section 1798.135" that the information may be used for additional, specified purposes and that consumers have the right to limit its use or disclosure. Businesses subject to the CCPA describe their own request channels in their privacy notices. Our California data privacy guide sets out the full framework.

This is general legal information, not legal advice. It describes California statutes and pending or vetoed California bills as recorded on official state sources that we verified on September 28, 2026, and it is not advice about your situation. Bill status can change in a single day, and this story is still developing. Consult a licensed California attorney about your own circumstances.

Related articles

• California data privacy laws
• CCPA opt-out rights
• What is the CCPA
• Data broker opt-out hub

Last updated: 2026-09-28. This is a developing story; details verified as of 2026-09-28.

Frequently Asked Questions

Is it now illegal in California for a company to sell sensitive personal information?

No. AB 1542, which would have prohibited a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, was vetoed on September 27, 2026. A vetoed bill enacts nothing, so California law on this point is exactly what it was before.

Does that mean nothing stops a company from selling my sensitive data?

No, and this is the point that gets reported wrong. Civil Code Section 1798.121(a) gives a consumer the right, at any time, to direct a business that collects sensitive personal information to limit its use to the purposes the section specifies, and subdivision (b) then prohibits the business from using or disclosing that information for any other purpose after it receives the direction, unless the consumer later provides consent. What California does not have, after the veto, is a flat statutory ban that operates without the consumer acting. Subdivision (d) also excludes sensitive personal information collected or processed without the purpose of inferring characteristics about a consumer.

Did Governor Newsom say why he vetoed AB 1542?

Yes, and we read the message. He wrote that he supports the author's goal but that 'a categorical ban on sharing that information is a step too far,' pointed to the existing option under state law to limit sharing, and said he worried about 'unintended consequences if consumers are removed entirely from the decision process.' He added that the bill's implementation and enforcement 'would result in significant costs not included in the 2026 Budget Act.'

Is SB 923 law?

Not on any record we could reach. On September 28, 2026 the Legislature's action log showed SB 923 as 'Active Bill - Enrolled,' presented to the Governor on September 2, 2026, with no gubernatorial action recorded, and the bill did not appear on the Governor's September 27, 2026 legislative update in either list. Under Article IV, Section 10(b)(2) of the California Constitution, a bill in the Governor's possession on or after September 1 becomes a statute if it is not returned on or before September 30 of that year.

Has AB 883 been chaptered?

No chapter number appeared on the Legislature's action log for AB 883 when we checked on September 28, 2026, and the measure status still read 'Active Bill - Enrolled,' even though the Governor's office listed the bill among those signed on September 27, 2026. Chaptering entries on the action log run behind the Governor's own announcements, so the absence of a chapter number is not evidence that the bill was not signed.

When would the 30-day data broker deletion interval start?

Not on signature. Article IV, Section 8(c) of the California Constitution provides that a statute enacted at a regular session goes into effect on January 1 next following a 90-day period from the date of enactment, which for a bill enacted on September 27, 2026 is January 1, 2027. AB 883's new Section 1798.99.86.5, which covers notice to elected officials and judges, states separately in subdivision (i) that it 'shall become operative on July 1, 2027.'

Would SB 923 let me ask a company to delete data it bought about me?

That is the change the bill makes on its face, and it is not in effect. Section 1798.105(a) today covers personal information the business 'has collected from the consumer.' SB 923 would change that phrase to 'from or about the consumer,' and it adds a provision deeming a business in compliance, for data obtained from a source other than the consumer, if it retains a record of the deletion request and the minimum data necessary to ensure the information remains deleted and is not being used for any other purpose.

Does any of this apply outside California?

The three bills discussed here amend the California Civil Code and operate within the CCPA framework. Other states have their own consumer privacy statutes with different definitions, different deletion rules and different data broker regimes, so nothing described here should be assumed to apply elsewhere.