California Governor Signs Three Bills Amending CCPA Provisions on Sensitive Information and Opt-Out Preferences in the Context of Mergers

During the final days of the California legislative session, which ended on August 31, 2024, the California legislature passed several privacy bills, described below, that would amend the California Consumer Privacy Act ("CCPA"). Governor Gavin Newsom vetoed the two most controversial of these amendments, which would have established new restrictions on collection of personal information of consumers under the age of 18 and required online platforms to incorporate privacy opt-out mechanisms. 

But the governor signed important bills adding neural data to the definition of sensitive data and requiring entities that acquire personal information in a merger to respect opt-out choices that consumers made with the acquiring entity. These new laws join the artificial intelligence bills with privacy implications that the California Legislature also passed and that we analyze in our companion post and our follow-up regarding the governor's vetoes and signatures. Summaries of these bills and new laws follow:

Amendments to the Definitions of "Personal Information" and "Sensitive Personal Information," Including the New Category of "Neural Data" - Signed Into Law

The governor signed two bills,[1] and [2] amending the CCPA to (1) make clear that "personal information" can exist in various formats, including, but not limited to, physical (e.g., documents), digital, and abstract digital formats, including artificial intelligence systems that are capable of outputting personal information;[3] and (2) include "neural data" in the definition of "sensitive personal information."

Of these, the neural data amendment may have more impact. "Neural data" means "information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information." By passing these bills, California joins Colorado as the first states to specifically define neural data as sensitive personal information, which may encourage other state legislatures to follow suit.[4]

Neural data technology, which has many potential uses, is nascent but quickly gaining attention as a way to measure cognition, attention span, and focus, especially among employees. Unlike the Colorado Privacy Act, the CCPA regulates personal information in an employment context which creates a challenge for employers as they consider deployment of neural data technology.

Businesses That Receive Personal Information as an Asset in a Merger Must Recognize Consumers' Prior Opt-Outs - Signed Into Law

On September 29, the governor signed AB 1824, which requires businesses that receive personal information as an asset from another business in the context of a merger, acquisition, or other business transfer to comply with opt-out requests that consumers made to the transferring business. This provision becomes effective on January 1, 2025.

New Restrictions Related to Consumers Under 18 Years of Age - Vetoed

Governor Newsom vetoed AB 1949,[5] which would have amended the CCPA to prohibit businesses from collecting, using, disclosing, selling, or sharing the personal information of a consumer whom the business had actual knowledge was under 18 years of age unless – in the case of a consumer who is at least 13 and under 18 years of age – the consumer, or – in the case of a consumer who is under 13 years old – the parent, had affirmatively authorized such collection, use, disclosure, sale, or sharing. In passing this bill, the California legislature attempted to follow the growing number of states that are increasing regulations on processing personal information of individuals under the age of 18.

The bill provided that a business that willfully disregarded a consumer's age would be deemed to have actual knowledge. The amendment did not define "willfully disregard," however, so it is unclear what kind of information would have been needed to trigger this standard. But consumers who indicated through a signal (via platform, technology, or other mechanism) that they were under 18 would have to have been treated as such.

This would have been a significant expansion of the CCPA's current requirement that businesses must obtain consent from parents of consumers under 13, and from consumers who were at least 13 but under 16 years old, before selling or sharing their personal information. The amendment would have expanded not just the age of consumers up to 18, but also the scope of activities to which this restriction applies.

The governor issued a statement explaining his veto, saying that the bill "would fundamentally alter the structure of the CCPA to require businesses, at the point of collection, to distinguish between consumers who are adults and minors," with "unanticipated and potentially adverse effects."[6]

Browsers Must Be Designed To Recognize Opt-Out Preference Signals - Vetoed

The governor also vetoed AB 3048,[7] which would have required businesses to develop and maintain browsers or mobile operating systems that provided settings enabling consumers to send an opt-out preference signal that communicated the consumer's choice to opt out of sale or sharing or limit the use of the consumer's personal information. The California Privacy Protection Agency ("CPPA") would have had authority to adopt rules to implement this requirement.

The governor explained the veto by noting the absence of this technology on major mobile operating systems and adding that "it's best if design questions are first addressed by developers, rather than regulators."[8]

+ + +

DWT's privacy team continues to monitor California regulatory and legislative activities and will be helping businesses adapt to new obligations as they arise. If you have questions about this post or need additional assistance, please contact the authors.