20250AB__256198AMD INTRODUCED 2026-02-20 AMENDED_ASSEMBLY 2026-04-23 2025 AB AMD Introduced by Assembly Member Valencia LEAD_AUTHOR ASSEMBLY Valencia

An act to add

Chapter 22.9 (commencing with

Section 22683) to Division of the Business and Professions Code, relating to privacy. privacy Operating systems and applications: privacy settings. Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified.

Existing law, beginning January 1, 2027, prohibits a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. This bill would prohibit an operating system or an application from undoing a user’s affirmative configuration of a user’s privacy setting without the user’s consent.

The bill would define “privacy setting” to mean any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information. MAJORITY NO NO NO NO NO NO NO NO NO NO The people of the State of California do enact as follows:

SECTION 1.

Chapter 22.9 (commencing with

Section 22683) is added to Division of the Business and Professions Code , to read: 22.9. Operating System and Application Privacy Settings 22683. As used in this chapter: (a) “Application” means a software program, mobile app, or desktop app that collects, processes, or stores personal information about a user in the state and that provides privacy settings allowing the user to control the collection, use, sharing, or disclosure of that personal information. (b) “Consent” has the same meaning as defined in

Section 1798.140 of the Civil Code. (b)</xhtml:p>"?> (c) “Personal information” has the meaning defined in

Section 1798.140 of the Civil Code. (c)</xhtml:p>"?> (d) “Privacy setting” means any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information. 22684. (a)<xhtml:span class="EnSpace"/>An operating system or an application shall configure a user’s default privacy setting to be the most privacy protective setting offered by the operating system or application.</xhtml:p>"?> "?>An operating system or an application shall not undo a user’s affirmative configuration of a privacy setting without the user’s consent.