Cybersecurity Policy Report, Legislation to Protect Sensitive Personal Info Advances in California, (Aug 17, 2026)
The California state Senate Appropriations Committee has passed a bill that would close a loophole in the California Consumer Privacy Act (CCPA) by prohibiting businesses from selling or sharing sensitive personal information with third parties.
AB 1542 specifically would prohibit businesses, service providers, or contractors from selling or sharing sensitive personal information with third parties, except as otherwise specified by law. It would require businesses to inform consumers at or before the point of collection about the categories and purposes of both personal and sensitive personal information being collected, as well as the intended retention period.
The bill further would require businesses to “ensure that any collection, use, retention, or sharing of personal information is reasonably necessary and proportionate to the disclosed purposes, and they must enter into agreements with third parties, service providers, or contractors to ensure compliance with privacy obligations.”
The bill also would clarify that consumers had the right to limit the use of their sensitive personal information to only those uses necessary for providing requested goods or services, and businesses would have to provide clear notice if sensitive information will be used for additional purposes.
The bill (A.B. 1542, Reg Sess.) is sponsored by Assembly member Chris Ward (D.).
News: StateLegislation DataPrivacy