New California data privacy laws 2027: taking effect in 2027
11 new California laws on data privacy take effect in 2027. Each is listed below with its date, what it does and a link to the official text.
- 11 laws take effect on 1 January 2027.
Updated 25 October 2026
One-line summaries are drafted by software from the bill text and are not reviewed by an attorney.
New California data privacy laws in 2027
AB 1159: Student personal information.
Requires operators of websites, apps, and online services used for K-12, preschool, or higher education to protect student personal information and prohibits using student data to train artificial intelligence systems.
Some duties start later: the text names an operative date.
AB 1331: Workplace surveillance.
Requires employers to prohibit workplace surveillance tools in bathrooms, locker rooms, changing areas, and lactation spaces, and allows workers to leave surveillance devices behind when entering these areas and public bathrooms or during off-duty hours.
AB 1798: Genetic testing for life and disability insurance.
Life and disability insurers cannot cancel, limit, deny, or base underwriting decisions on genetic information or test results, except under specified criteria.
AB 1883: Workplace surveillance tools.
Requires employers to stop using workplace surveillance tools with artificial intelligence that collect neural data, recognize emotional states, make inferences based on gait, or identify protected characteristics, with exceptions for federal defense and security purposes.
AB 2448: Medical information: confidentiality.
Requires businesses that electronically store medical information to limit access to and segregate records related to gender affirming care, abortion services, and contraception.
AB 2561: Operating systems and applications: privacy settings.
Prohibits operating systems and applications from reversing a user's privacy setting choices without the user's consent.
AB 883: Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.
Requires data brokers to process deletion requests from the California Privacy Protection Agency within 30 days and authorizes attorneys to sue data brokers on behalf of elected officials and judges for violations.
Some duties start later: the text names an operative date.
SB 1114: Data collection: sexual orientation, gender identity, and intersex status: disclosure.
Requires state agencies and public universities to keep confidential information about sexual orientation, gender identity, and intersex status, prohibiting disclosure outside state government except under specified exceptions.
SB 354: Insurance Information and Privacy Protection Act.
Requires insurance licensees, surplus line insurers, reinsurers, and third-party service providers to provide privacy notices, obtain consumer consent, and allow consumers to access or delete personal information starting 1 July 2028.
Some duties start later: the text names an operative date.
SB 923: Consumer privacy requests: deletion request records and request submission methods.
Requires businesses to let consumers request deletion of all personal information collected about them and permits businesses to retain records of deletion requests and minimum necessary data to prevent unauthorized reuse.
SB 930: Student Test Taker Privacy Protection Act: end-to-end encryption.
Requires businesses providing proctoring services to school districts, county offices of education, or charter schools for classroom or course-based exams to use end-to-end encryption beginning 1 July 2027.
Next year's data privacy laws are bills now. Follow them in every state with the Data Privacy Legislation Tracker.
Questions about new California data privacy laws in 2027
When do new data privacy laws take effect in California in 2027?
Most take effect on 1 January 2027. Of the 11 laws listed here, 11 start on 1 January 2027. In California, a statute from a regular session takes effect on the 1 January after 90 days from enactment unless it is an urgency measure (Cal. Const. art. IV, sec. 8(c)(1)).
What new data privacy laws take effect on 1 January 2027 in California?
11 laws in data privacy, including California AB 1159 (Student personal information), California AB 1331 (Workplace surveillance), California AB 1798 (Genetic testing for life and disability insurance), California AB 1883 (Workplace surveillance tools) and California AB 2448 (Medical information: confidentiality). The full list, with what each one does, is above.
Is this legal advice?
No. Dates and the one-line summaries are drafted by software from the bill text and are not reviewed by an attorney. Each law links to the legislature’s own record: check the text before relying on it.
Know 2028's new data privacy laws while they are still bills
LawSignals follows data privacy bills in all 50 states and Congress, with a monthly report you can send to a client.