Cybersecurity Policy Report, Governor Vetoes California Bill on Sensitive Data-Sharing, (Sep 28, 2026)
California Gov. Gavin Newsom (D.) has vetoed a bill that sought to close a loophole in the California Consumer Privacy Act (CCPA) and prohibit businesses from selling or sharing sensitive personal information with third parties.
“While I support the author’s goal of protecting the sensitive personal information of Californians, a categorical ban on sharing that information is a step too far,” Gov. Newsom said in his veto message yesterday. “Under state law, companies are required to provide California consumers with the option to limit the sharing of such information, and I worry there may be unintended consequences if consumers are removed entirely for the decision process.”
The governor also noted that implementation and enforcement of this measure could have resulted in “significant costs” not included in the 2026 budget.
AB 1542 sought to prohibit businesses, service providers, or contractors from selling or sharing sensitive personal information with third parties except as otherwise specified by law. It would have required businesses to inform consumers at or before the point of collection about the categories and purposes of both personal and sensitive personal information being collected, as well as the intended retention period.
The bill (A.B. 1542, Reg Sess.) also sought to clarify that consumers had the right to limit the use of their sensitive personal information to only those uses necessary for providing requested goods or services, and businesses would have had to provide clear notice if sensitive information was to be used for additional purposes.
The bill was sponsored by Assembly member Chris Ward (D.).
News: StateLegislation DataPrivacy CCPA