20250SB__095796AMD INTRODUCED 2026-02-02 AMENDED_SENATE 2026-03-26 AMENDED_SENATE 2026-04-27 AMENDED_ASSEMBLY 2026-06-18 2025 SB AMD Introduced by Senator Pérez LEAD_AUTHOR SENATE Pérez

An act to add

Chapter 31.7 (commencing with

Section 22946.5) to Division of the Business and Professions Code, relating to privacy. privacy Privacy: social media companies: administrative subpoenas: remedies. Existing law generally regulates social media platforms, including, among other laws, the Protecting Our Kids from Social Media Addiction Act that prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user, except as prescribed.

Existing law, the California Consumer Privacy Act of 2018, grants consumers various rights with respect to personal information, as defined, that is collected by a business, as defined. Existing law, the California Values Act, generally prohibits California law enforcement agencies from using their moneys or personnel for immigration enforcement purposes, except as specified.

Existing federal law authorizes specified federal officers to require, among other things, the attendance and testimony of witnesses before immigration officers and the production of books, papers, and documents relating to, among other things, the privilege of any person to enter, reenter, reside in, or pass through the United States. This bill would require a social media company, as defined, to promptly notify an individual whose personal information is requested by an administrative subpoena issued as described above.

The bill would require the social media company to provide the individual whose personal information is requested in an administrative subpoena with at least days to respond to or challenge the administrative subpoena before responding to the administrative subpoena. The bill would also require a social media platform, before responding to an administrative subpoena, to determine if the administrative subpoena is invalid for any of specified reasons, including that the information requested by the subpoena is too indefinite or broad.

This bill would require a social media company that discloses personal information in response to an administrative subpoena to provide notice to the individual whose information was disclosed and would require a social media company that responds to an administrative subpoena to notify the Attorney General of that response, as specified. The bill would prohibit a social media company from responding to an administrative subpoena for personal information while a legal challenge to the subpoena is pending if the social media company has actual knowledge of the challenge.

This bill would require the Attorney General to develop a process for a social media company to submit the notice described above, as specified. The bill would exempt notices submitted as described above from the California Public Records Act. The bill would authorize the Attorney General, and a person whose information has been shared in violation of the above provisions by a social media company, to bring an action for injunctive or declaratory relief, as specified. The bill would declare its provisions severable.

Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. MAJORITY NO YES NO NO NO NO NO NO NO NO The people of the State of California do enact as follows:

SECTION 1.

Chapter 31.7 (commencing with

Section 22946.5) is added to Division of the Business and Professions Code , to read: 31.7. Stopping Harmful Information Exploitation and Lawless Data Sharing Act 22946.5. (

a) This

chapter shall be known, and may be cited, as the “Stopping Harmful Information Exploitation and Lawless Data Sharing Act.” (

b) For purposes of this chapter, the following

definitions shall apply: (1) “Administrative subpoena” means a subpoena issued pursuant to either of the following: (

A) Subparagraph (

A) of paragraph (1) of subsection (

a) of

Section of Title of the United States Code, as that

section read on January 1, 2026. (

B) Subparagraph (

A) of paragraph (4) of subsection (

d) of

Section of Title of the United States Code, as that

section read on January 1, 2026. (2) “Individual” means a natural person who is a California resident. (3) “Maintain” includes maintain, acquire, use, or disclose. (4) “Personal information” means any information that is maintained by a social media company that is reasonably capable of identifying or describing an individual, including, but not limited to, the individual’s name, social security number, physical description, address, telephone number, IP address, online browsing history, location information, social media information, education, financial matters, and medical or employment history. “Personal information” does not include any record that is required by law or regulation for the entry of merchandise pursuant to subparagraph (

A) of paragraph (1) of subsection (

a) of

Section of Title of the United States Code, as that

section read on January 1, 2026. (5) “Social media company” means a social media company, as defined in

Section 22675. (c)

(1) A social media company shall promptly notify an individual whose personal information is requested by an administrative subpoena.

(2) Prior to disclosing personal information in response to an administrative subpoena requesting the personal information of an individual, a social media company shall provide the individual whose personal information is requested with at least days to respond to or challenge the administrative subpoena.

(3) If a social media company discloses personal information in response to an administrative subpoena, the social media company shall provide notice to the individual whose personal information was disclosed of all of the following: (

A) The reason the individual’s personal information was disclosed. (

B) The basis for determining that the administrative subpoena was valid. (

C) A description of the information that was disclosed. (

d) Notwithstanding any other law, prior to disclosing any personal information in response to an administrative subpoena requesting the personal information of an individual, a social media company shall determine if the administrative subpoena is invalid for any of the following reasons:

(1) The information requested by the administrative subpoena is not related to any purpose lawfully authorized pursuant to subparagraph (

A) of paragraph (4) of subsection (

d) of

Section of Title of the United States Code, as that

section read on January 1, 2026, or pursuant to subparagraph (

A) of paragraph (1) of subsection (

a) of

Section of Title of the United States Code, as that

section read on January 1, 2026, as applicable.

(2) The administrative subpoena is procedurally improper.

(3) The information requested by the administrative subpoena is irrelevant or immaterial to the purpose described in paragraph (1).

(4) The information requested by the administrative subpoena is too indefinite or broad. (e)

(1) If a social media company responds to an administrative subpoena for personal information, it must notify the Attorney General within five business days of the response.

(2) The Attorney General shall develop a process for a social media company to submit the notice described in paragraph (1), including specifications for what information the social media company must provide and in what format. (

f) A social media company shall not respond to an administrative subpoena for personal information while a legal challenge to the subpoena is pending if the social media company has actual knowledge of the challenge. (g)

(1) The Attorney General may bring an action for injunctive or declaratory relief against any social media company who violates this chapter.

(2) An individual whose information has been shared in response to an administrative subpoena by a social media company in violation of this

chapter may also bring a civil action against the social media company for injunctive or declaratory relief. (

h) Nothing in this

chapter shall be construed to prohibit a social media company from responding to an order issued by a court pursuant to subparagraph (

B) of paragraph (4) of subsection (

d) of

Section of Title of the United States Code, as that

section read on January 1, 2026, or any other law. (

i) Information submitted to the Attorney General pursuant to subdivision (

e) shall not be considered a public record and shall not be disclosed pursuant to a request under the California Public Records Act (Division 10 (commencing with

Section 7920.000) of Title of the Government Code).

SEC. 2. The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

SEC. 3. The Legislature finds and declares that

Section of this act, which adds

Chapter 31.7 (commencing with

Section 22946.5) to Division of the Business and Professions Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of

Section of

Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest: In order to protect sensitive personal information, it is necessary that this act limit the public’s right of access to that information.