Existing law requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, to establish a policy regarding participation in extracurricular and cocurricular activities by pupils in those grades as a condition for the receipt of specified school funding allocations.

This bill, commencing with the 202728 school year, would prohibit a school district, county office of education, or charter school from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, as defined.

Existing law provides that parents and guardians of children enrolled in public schools have the right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including by, among other things, to be notified on a timely basis if their child is absent from school without permission.

This bill, commencing with the 202728 school year, would prohibit a school district, county office of education, or charter school from using addictive feeds, as defined, as the only means of contacting pupils or pupils parents or guardians.

Existing law requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, to establish a policy regarding participation in extracurricular and cocurricular activities by pupils in those grades as a condition for the receipt of specified school funding allocations.

This bill, commencing with the 202728 school year, would prohibit a school district, county office of education, or charter school from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, as defined.

Existing law provides that parents and guardians of children enrolled in public schools have the right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including by, among other things, to be notified on a timely basis if their child is absent from school without permission.

This bill, commencing with the 202728 school year, would prohibit a school district, county office of education, or charter school from using addictive feeds, as defined, as the only means of contacting pupils or pupils parents or guardians.

Existing law requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, to establish a policy regarding participation in extracurricular and cocurricular activities by pupils in those grades as a condition for the receipt of specified school funding allocations.

This bill, commencing with the 202728 school year, would prohibit a local educational agency school district, county office of education, or charter school from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, as defined.

Existing law provides that parents and guardians of children enrolled in public schools have the right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including by, among other things, to be notified on a timely basis if their child is absent from school without permission.

This bill, commencing with the 202728 school year, would prohibit a school district, county office of education, or charter school from using addictive feeds, as defined, as the only means of contacting pupils or pupils parents or guardians.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would require the agency to obtain a list of all state and local elected officials that includes their contact information and officials, would require the Judicial Council to provide the agency with a list of all California judges that includes their contact information, judges, and would require the agency to allow elected officials or a judges to remove their information from those lists, as prescribed. The bill would require the lists to be kept confidential, as specified. The bill would also require the agency to upload the lists to the accessible deletion mechanism described above and, beginning August 1, 2026, require an entity receiving a notification that a deletion is required to do so within 5 days.

This bill would also prohibit a business from knowingly selling the personal information of a protected individual if the business knows, or reasonably should know, that selling the personal information poses an imminent and serious threat to the protected individual and certain harms result from the selling of the personal information. The bill would make a person who violates this provision liable for a civil penalty, as specified. authorize an elected official or judge who is on a list described above, the Attorney General, a county counsel, or a city attorney to bring an action for a violation of the bill, as prescribed.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

The Information Practices Act of 1977 regulates the use of personal information by certain state agencies, including by requiring a state agency to maintain in its records only personal information which that is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government.

This bill would authorize a protected individual, or the agency on behalf of a protected individual, to request that a person or governmental entity a business, as defined, to refrain from publishing or selling the protected individuals personal information information, as defined, or remove to delete the protected individuals personal information from any existing publication and would require a person or governmental entity to comply with that request, as specified. information, as specified. The bill would also authorize a protected individual, or the protected individuals authorized representative, to request a governmental entity, defined, in part, to mean a local agency, to refrain from publishing the protected individuals personal information or to remove the protected individuals personal information from any existing publication, as prescribed. Upon receipt of the request, the bill would require a governmental entity to take prescribed action, including taking steps reasonably necessary to ensure that the personal information is not published. By imposing additional duties on local agencies, the bill would impose a state-mandated local program. The bill would authorize a protected individual and certain public attorneys, including the Attorney General, to punish noncompliance with this provision those provisions with a certain civil action.

This bill would also prohibit a person business from knowingly publishing, as defined, or selling the personal information of a protected individual if the person business knows, or reasonably should know, that publishing or selling the personal information poses an imminent and serious threat to the protected individual and certain harms result from the publishing or selling of the personal information. The bill would make a person who violates this provision liable for a civil penalty, as specified.

This bill would define various terms for its purposes, including by defining protected individual to mean a current or former representative elected in the state, as determined by the Secretary of State, an appointed officer of a court or a magistrate in the state, or a spouse, a child, or a dependent who resides in the same household as those individuals.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

The Information Practices Act of 1977 regulates the use of personal information by certain state agencies, including by requiring a state agency to maintain in its records only personal information which is relevant and necessary to accomplish a purpose of the agency required or authorized by the California Constitution or statute or mandated by the federal government.

This bill would authorize a protected individual, or the agency on behalf of a protected individual, to request that a person or governmental entity refrain from publishing or selling the protected individuals personal information or remove the protected individuals personal information from any existing publication and would require a person or governmental entity to comply with that request, as specified. The bill would authorize certain public attorneys, including the Attorney General, to punish noncompliance with this provision with a certain civil action.

This bill would also prohibit a person from knowingly publishing, as defined, or selling the personal information of a protected individual if the person knows, or reasonably should know, that publishing or selling the personal information poses an imminent and serious threat to the protected individual and certain harms result from the publishing or selling of the personal information. The bill would punish a violation of this provision as a misdemeanor and would make a violator make a person who violates this provision liable for a civil penalty, as specified. By creating a new crime, the bill would impose a state-mandated local program.

This bill would define protected individual to mean a current or former representative elected in the state, as determined by the Secretary of State, an appointed officer of a court or a magistrate in the state, or a spouse, a child, or a dependent who resides in the same household as those individuals.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information, as defined, regarding a patient of the provider of health care or an enrollee or subscriber of the health care service plan without first obtaining an authorization, except as prescribed. The act punishes a violation of its provisions that results in economic loss or personal injury to a patient as a misdemeanor.

Existing law requires a provider of health care, a health care service plan, or a contractor to disclose medical information when specifically required by law or if the disclosure is compelled by, among other things, a court order or a search warrant lawfully issued to a governmental law enforcement agency.

This bill would revise the disclosure requirement relating to a court order to instead require disclosure if compelled by a court order issued by a California state court pursuant to an order of that court or a court order from another state based on another states law so long as that law does not interfere with California law, as specified. court, including California state court orders relating to foreign subpoenas, as defined. The bill would revise the disclosure requirement relating to a search warrant to require disclosure if compelled by a warrant from another state based on another states law so long as that law does not interfere with California law. law, and execution of the search warrant would not violate specified prohibitions against enforcement actions regarding lawful abortions. By narrowing the exceptions for disclosing medical information, and thereby expanding the crime of violating the act, this bill would impose a state-mandated local program.

Existing law prohibits a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using medical information for a purpose not necessary to provide health care services to the patient, except to the extent expressly authorized by a patient, enrollee, or subscriber, or if compelled pursuant to the above-described requirements. Existing law prohibits a contractor or corporation and its subsidiaries and affiliates from further disclosing medical information received under these provisions to a person or entity that is not engaged in providing direct health care services to the patient or the patients provider of health care or health care service plan or insurer or self-insured employer, except to the extent expressly authorized by a patient, enrollee, or subscriber, or if compelled pursuant to the above-described requirements.

This bill would delete the exceptions above-described exception allowing disclosure pursuant to an express authorization by a patient, enrollee, or subscriber. subscriber, and would instead prohibit a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally selling medical information or using medical information for marketing. By expanding prohibitions against disclosing medical information, and thereby expanding the crime of violating the act, this bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law, the Confidentiality of Medical Information Act, prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information, as defined, regarding a patient of the provider of health care or an enrollee or subscriber of the health care service plan without first obtaining an authorization, except as prescribed. The act punishes a violation of its provisions that results in economic loss or personal injury to a patient as a misdemeanor.

Existing law requires a provider of health care, a health care service plan, or a contractor to disclose medical information when specifically required by law or if the disclosure is compelled by, among other things, a court order or a search warrant lawfully issued to a governmental law enforcement agency.

This bill would instead require a provider of health care, a health care service plan, or a contractor to disclose medical information when specifically required by California law. The bill would revise the disclosure requirement relating to a court order to require disclosure if compelled by a California state court pursuant to an order of that court or a court order from another state based on another states law so long as that law does not interfere with California law, as specified. The bill would revise the disclosure requirement relating to a search warrant to require disclosure if compelled by a warrant from another state based on another states law so long as that law does not interfere with California law. By narrowing the exceptions for disclosing medical information, and thereby expanding the crime of violating the act, this bill would impose a state-mandated local program.

Existing law prohibits a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally sharing, selling, using for marketing, or otherwise using medical information for a purpose not necessary to provide health care services to the patient, except to the extent expressly authorized by a patient, enrollee, or subscriber, or if compelled pursuant to the above-described requirements. Existing law prohibits a contractor or corporation and its subsidiaries and affiliates from further disclosing medical information received under these provisions to a person or entity that is not engaged in providing direct health care services to the patient or the patients provider of health care or health care service plan or insurer or self-insured employer, except to the extent expressly authorized by a patient, enrollee, or subscriber, or if compelled pursuant to the above-described requirements.

This bill would delete the exceptions allowing disclosure pursuant to an express authorization by a patient, enrollee, or subscriber. By expanding prohibitions against disclosing medical information, and thereby expanding the crime of violating the act, this bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

CONCURRENCE IN SENATE AMENDMENTS

CSA2 Bill Id:AB 302

Author:(Bauer-Kahan)

As Amended Ver:June 30, 2026

Majority vote

SUMMARY

Original Committee of Reference: HEALTH and JUD.

Prohibits, beginning with the 2027-28 school year, a local educational agency (LEA) from excluding students who do not use addictive feeds from extracurricular activities, and from using addictive feeds as the only means of contacting students or parents and guardians.

Senate Amendments

Current Committee Recommendation: Concur.

1. Delete the Assembly version of the bill.
2. Prohibit, beginning with the 2027-28 school year, an LEA from excluding a student from participating in any extracurricular activity, including sports and clubs, due to the student not having or using addictive feeds.
3. Prohibit, beginning with the 2027-28 school year, an LEA from using addictive feeds as the only means of contacting pupils or pupils' parents or guardians.
4. Encourage LEAs to inform students and parents or guardians of the restrictions on addictive feed communications in a student handbook or similar document made generally available to students and their parents or guardians.
5. Define addictive feed in accordance with existing law.
6. Define LEA as a school district, county office of education (COE), or charter school.

COMMENTS

What are addictive feeds? This bill defines addictive feeds, in accordance with existing law, as services in which media is generated and shared by users, and then displayed to a user's device based on information provided by or associated with the user.

Addictive feeds are often used by social media platforms to capture a user's attention and prolong their engagement. They commonly include features like the ability to continuously scroll through an infinite amount of content and automatically playing new videos without a user hitting a start button. Examples of addictive feeds provided by the author's office include TikTok, Instagram, YouTube Shorts, and Snapchat.

Under AB 302, schools and their extracurricular activities would need to find alternatives to addictive feeds when contacting students and their parents or guardians. In practice, this could mean that if a school club exclusively uses Instagram to organize meetings and communicate with parents, a student who does not have Instagram could not be barred from participating, and the club would need to find an additional communication method.

How addictive feeds may be used in school communications. There is currently limited data on the extent to which schools rely on social media, which can include addictive feeds, to communicate. Generally, for matters involving an individual student, school administrators directly contact parents and guardians through traditional means of email, phone calls, or written notices sent home with students. Recently, many schools have also launched dedicated school messaging services and apps to streamline and standardize communication. Many LEAs also maintain official social media accounts and pages to share updates, school news, and general reminders with students, their families, and community members.

This bill prohibits LEAs from using addictive feeds as the only means of contacting students and their parents or guardians. It does not prohibit LEAs from utilizing platforms that use addictive feeds to continue sharing general updates with parents and community members.

Anecdotal data suggests that some school extracurriculars rely primarily on social media to communicate about meetings and events, which then places pressure on students and families to maintain social media accounts. The author's office provided the following examples of how this has occurred:

1. A Southern California student was required to create an Instagram account in order to communicate with their high school baseball team. The student's parent did not approve of Instagram, but after objecting was told to start a profile on the student's behalf. This was not feasible, as the parent already worked two jobs.
2. A Southern California student was required to create a Snapchat account in order to communicate with members of their high school water polo team.
3. A Northern California student shared that they were removed from their student leadership position due to them not having an Instagram account.

Extracurriculars are managed at the local level, and some are primarily run and organized by students themselves. As of 2024, the Pew Research Center found that 61% of U.S. teenagers used Instagram and 55% used Snapchat, two platforms that feature addictive feeds and have allegedly been required for participation in school extracurriculars (see above). It is perhaps not surprising that students self-organizing into clubs would use these platforms to communicate with each other.

Addictive feeds and youth mental health. In 2023, the U.S. Surgeon General issued an advisory about the effects of social media use on youth mental health. The advisory calls for urgent action by policymakers, technology companies, researchers, families, and young people to gain a better understanding of the full impact of social media use, maximize the benefits and minimize the harms of social media platforms, and create safer, healthier online environments. The advisory stated the following:

1. While social media may offer some benefits, there are ample indicators that social media can also pose a risk of harm to the mental health and well-being of children and adolescents.
2. Children are affected by social media in different ways, including based on cultural, historical, and socio-economic factors. Among the benefits, adolescents report that social media helps them feel more accepted (58%), like they have people who can support them through tough times (67%), like they have a place to show their creative side (71%), and be more connected to what's going on in their friends' lives (80%).
3. Studies have also shown a relationship between social media use and poor sleep quality, reduced sleep duration, sleep difficulties, and depression among youth. 
4. More research is needed to determine the full impact social media use has on nearly every teenager across the country.

According to a 2020 article in the Journal of Affective Disorders, Is social media screen time really associated with poor adolescent mental health?, a greater amount of time spent on social media was associated with an increased risk of self-harm, depression, and lower levels of self-esteem in girls aged 13-15. Findings were similar for weekday and weekend use.

These findings have increased public concern over children's use of social media. According to the Pew Research Center, 56% of Americans support a social media ban for children under the age of 16. However, requiring students to have and use social media addictive feeds in order to participate in school extracurriculars restricts the ability of students and families to limit their exposure to addictive feeds.

According to the Author

Schools are increasingly reliant on social media and addictive feeds for communication and networking with students and families. Children are forced to join addictive platforms in order to participate in school clubs and activities that enrich their school experience. By forcing teens onto platforms which prey on them, schools are feeding into the increasing mental health crisis largely caused by social media usage. AB 302 prohibits schools from using addictive feeds as the sole form of communication with students or parents/guardians and ensures that students have access to after school clubs and activities without having to join potentially dangerous platforms.

Arguments in Support

According to the organization Common Sense Media, "AB 302 seeks to ensure that no student is excluded from extracurricular activities because they do not have or use an addictive feed. Participation in sports, clubs, and enrichment activities should be based on interest and effort—not on whether a child has joined a platform designed to keep them scrolling.

The bill also prohibits schools from using addictive feeds as the only method of contacting students or parents. Families should not be required to join algorithm-driven platforms to receive essential information about their child's education, safety, or school activities. AB 302 preserves schools' ability to use social media for broad outreach while ensuring that families always have a non-addictive, accessible communication option."

Arguments in Opposition

None on file.

FISCAL COMMENTS

This bill has been keyed non-fiscal by the Office of Legislative Counsel.

VOTES

ASM HEALTH: 12-2-2

YES: Bonta, Addis, Aguiar-Curry, Rogers, Carrillo, Mark González, Krell, Patel, Celeste Rodriguez, Schiavo, Sharp-Collins, Stefani

NO: Patterson, Sanchez

ABS, ABST OR NV: Chen, Flora

ASM JUDICIARY: 9-3-0

YES: Kalra, Bauer-Kahan, Bryan, Connolly, Harabedian, Pacheco, Papan, Stefani, Zbur

NO: Dixon, Macedo, Sanchez

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

NO: Sanchez, Dixon, Ta, Tangipa

ASSEMBLY FLOOR: 56-11-12

YES: Addis, Aguiar-Curry, Ahrens, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Solache, Stefani, Wallis, Ward, Wilson, Zbur, Rivas

NO: Castillo, DeMaio, Dixon, Ellis, Gallagher, Hadwick, Lackey, Macedo, Patterson, Ta, Tangipa

ABS, ABST OR NV: Alanis, Bryan, Chen, Flora, Jeff Gonzalez, Hoover, Nguyen, Sanchez, Sharp-Collins, Soria, Valencia, Wicks

SENATE FLOOR: 39-0-1

YES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Gonzalez, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Umberg, Valladares, Wahab, Weber Pierson, Wiener

ABS, ABST OR NV: Strickland

ASM EDUCATION: 9-0-0

YES: Patel, Hoover, Alvarez, Bonta, Castillo, Garcia, Lowenthal, Pellerin, Zbur

UPDATED

VERSION: June 30, 2026

CONSULTANT: Sarah Cate Hawthorne / ED. / (916) 319-2087 FN: 0004367

Date of Hearing:

ASSEMBLY COMMITTEE ON EDUCATION

Darshana R. Patel, Chair

ABPCA Bill Id:AB 302 (

Author:Bauer-Kahan) – As Amended Ver:June 30, 2026

SUBJECT: Pupil and parental communication: extracurricular activities: addictive feeds

SUMMARY: Prohibits, beginning with the 2027-28 school year, a local educational agency (LEA) from excluding students who do not use addictive feeds from extracurricular activities, and from using addictive feeds as the only means of contacting students or parents and guardians. Specifically, this bill:

1. Prohibits, beginning with the 2027-28 school year, an LEA from excluding a student from participating in any extracurricular activity, including sports and clubs, due to the student not having or using addictive feeds.
2. Prohibits, beginning with the 2027-28 school year, an LEA from using addictive feeds as the only means of contacting pupils or pupils’ parents or guardians.
3. Encourages LEAs to inform students and parents or guardians of the restrictions on addictive feed communications in a student handbook or similar document made generally available to students and their parents or guardians.
4. Defines addictive feed in accordance with existing law.
5. Defines LEA as a school district, county office of education (COE), or charter school.

EXISTING LAW:

1. Defines addictive feed as an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommended, selected, or prioritized for display to a user based, in whole or in part, on information provided by the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met, alone or in combination with one another:
2. The information is not persistently associated with the user or user’s device, and does not concern the user’s previous interactions with media generated or shared by others.
3. The information consists of search terms that are not persistently associated with the user or user’s device.
4. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
5. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of such media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, in the case of audio or video content, is not automatically played.
6. The media consists of direct, private communications between users.
7. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, in the case of audio or video content, is not automatically played.
8. The recommendation, selection, or prioritization of the media is necessary to comply with this chapter or any regulations promulgated pursuant to this chapter. (Health and Safety Code (HSC) 27000.5)
9. Requires the governing board of a school district that serves any students in grades 7 to 12, inclusive, as a condition for the receipt of specified school funding allocations, to establish a policy regarding participation in extracurricular and cocurricular activities. (Education Code (EC) 35160.5)
10. Establishes the intent of the Legislature that opportunities to participate in athletics be provided on an equitable basis to all students. (EC 49021)
11. Authorizes the governing board or body of a school district, COE, or charter school to adopt a policy to limit or prohibit social media use by pupils when at a schoolsite or under the supervision and control of an employee. (EC 48901.8)
12. Requires, for purposes of the Protecting Our Kids from Social Media Addiction Act, the Attorney General to adopt regulations regarding age assurance by January 1, 2027. (HSC 27006)

FISCAL EFFECT: This bill has been keyed non-fiscal by the Office of Legislative Counsel.

COMMENTS:

Need for the bill. According to the author’s office, “Schools are increasingly reliant on social media and addictive feeds for communication and networking with students and families. Children are forced to join addictive platforms in order to participate in school clubs and activities that enrich their school experience. By forcing teens onto platforms which prey on them, schools are feeding into the increasing mental health crisis largely caused by social media usage. AB 302 prohibits schools from using addictive feeds as the sole form of communication with students or parents/guardians and ensures that students have access to after school clubs and activities without having to join potentially dangerous platforms.”

What are addictive feeds? This bill defines addictive feeds, in accordance with existing law, as services in which media is generated and shared by users, and then displayed to a user’s device based on information provided by or associated with the user.

Addictive feeds are often used by social media platforms to capture a user’s attention and prolong their engagement. They commonly include features like the ability to continuously scroll through an infinite amount of content and automatically playing new videos without a user hitting a start button. Examples of addictive feeds provided by the author’s office include TikTok, Instagram, YouTube Shorts, and Snapchat.

Under AB 302, schools and their extracurricular activities would need to find alternatives to addictive feeds when contacting students and their parents or guardians. In practice, this could mean that if a school club exclusively uses Instagram to organize meetings and communicate with parents, a student who does not have Instagram could not be barred from participating, and the club would need to find an additional communication method.

How addictive feeds may be used in school communications. There is currently limited data on the extent to which schools rely on social media, which can include addictive feeds, to communicate. Generally, for matters involving an individual student, school administrators directly contact parents and guardians through traditional means of email, phone calls, or written notices sent home with students. Recently, many schools have also launched dedicated school messaging services and apps to streamline and standardize communication. Many LEAs also maintain official social media accounts and pages to share updates, school news, and general reminders with students, their families, and community members.

This bill prohibits LEAs from using addictive feeds as the only means of contacting students and their parents or guardians. It does not prohibit LEAs from utilizing platforms that use addictive feeds to continue sharing general updates with parents and community members.

Anecdotal data suggests that some school extracurriculars rely primarily on social media to communicate about meetings and events, which then places pressure on students and families to maintain social media accounts. The author’s office provided the following examples of how this has occurred:

• A Southern California student was required to create an Instagram account in order to communicate with their high school baseball team. The student’s parent did not approve of Instagram, but after objecting was told to start a profile on the student’s behalf. This was not feasible, as the parent already worked two jobs.
• A Southern California student was required to create a Snapchat account in order to communicate with members of their high school water polo team.
• A Northern California student shared that they were removed from their student leadership position due to them not having an Instagram account.

Extracurriculars are managed at the local level, and some are primarily run and organized by students themselves. As of 2024, the Pew Research Center found that 61% of U.S. teenagers used Instagram and 55% used Snapchat, two platforms that feature addictive feeds and have allegedly been required for participation in school extracurriculars (see above). It is perhaps not surprising that students self-organizing into clubs would use these platforms to communicate with each other.

Addictive feeds and youth mental health. In 2023, the U.S. Surgeon General issued an advisory about the effects of social media use on youth mental health. The advisory calls for urgent action by policymakers, technology companies, researchers, families, and young people to gain a better understanding of the full impact of social media use, maximize the benefits and minimize the harms of social media platforms, and create safer, healthier online environments. The advisory stated the following:

• While social media may offer some benefits, there are ample indicators that social media can also pose a risk of harm to the mental health and well-being of children and adolescents.
• Children are affected by social media in different ways, including based on cultural, historical, and socio-economic factors. Among the benefits, adolescents report that social media helps them feel more accepted (58%), like they have people who can support them through tough times (67%), like they have a place to show their creative side (71%), and be more connected to what’s going on in their friends’ lives (80%).
• Studies have also shown a relationship between social media use and poor sleep quality, reduced sleep duration, sleep difficulties, and depression among youth. 
• More research is needed to determine the full impact social media use has on nearly every teenager across the country.

According to a 2020 article in the Journal of Affective Disorders, Is social media screen time really associated with poor adolescent mental health?, a greater amount of time spent on social media was associated with an increased risk of self-harm, depression, and lower levels of self-esteem in girls aged 13-15. Findings were similar for weekday and weekend use.

These findings have increased public concern over children’s use of social media. According to the Pew Research Center, 56% of Americans support a social media ban for children under the age of 16. However, requiring students to have and use social media addictive feeds in order to participate in school extracurriculars restricts the ability of students and families to limit their exposure to addictive feeds.

Arguments in Support. According to the organization Common Sense Media, “AB 302 seeks to ensure that no student is excluded from extracurricular activities because they do not have or use an addictive feed. Participation in sports, clubs, and enrichment activities should be based on interest and effort—not on whether a child has joined a platform designed to keep them scrolling.

The bill also prohibits schools from using addictive feeds as the only method of contacting students or parents. Families should not be required to join algorithm-driven platforms to receive essential information about their child’s education, safety, or school activities. AB 302 preserves schools’ ability to use social media for broad outreach while ensuring that families always have a non-addictive, accessible communication option.”

Related legislation. AB 1709 (Lowenthal) of this Session prohibits social media accounts that use addictive feeds for youth under age 16 and creates an e-Safety Advisory Commission.

SB 1412 (Rubio) of this Session provides that a parent or guardian of a student has the right to communicate with their child’s teacher using a two-way telephonic service or a two-way audiovisual platform if the parent or guardian is unable to attend a meeting in person with a teacher.

AB 1644 (Muratsuchi) of this Session would have prohibited the use of smartphones by students in grades kindergarten through 8^th grade. AB 1644 was held in the Senate Appropriations Committee.

AB 56 (Bauer-Kahan), Chapter 671, Statutes of 2025, requires, beginning on January 1, 2027, covered platforms to display to children mental health warning labels about the harms associated with social media when the child logs on to the platform and after extended use.

AB 3216 (Hoover), Chapter 500, Statutes of 2024, requires, rather than allows, a governing board of an LEA, COE, or a charter school no later than July 1, 2026, to develop, adopt, and update every five years a policy, as specified, to limit or prohibit the use by its pupils of smartphones while the pupils are at a schoolsite or while the pupils are under the supervision and control of an employee of that LEA, COE, and charter school.

SB 976 (Skinner), Chapter 321, Statutes of 2024, prohibits operators of “internet-based services or applications” from providing “addictive feeds,” as those terms are defined, to minors without parental consent and from sending notifications to minors at night and during school hours without parental consent, as provided. This bill requires operators to make available to parents a series of protective measures for controlling access to and features of the platform for their children. This bill also requires reporting on data regarding children on their platforms, as specified.

SB 1283 (Stern), Chapter 891, Statutes of 2024, authorizes a school district, COE or a charter school to adopt a policy to limit or prohibit students from using social media while at a schoolsite or under the supervision and control of an employee of the school district, county COE, or charter school.

REGISTERED SUPPORT / OPPOSITION:

Support

Common Sense Media

Distraction-Free Schools California

Healthier-Tech

Opposition

None on file.

Analysis Prepared by: Sarah Cate Hawthorne / ED. / (916) 319-2087

 THIRD READING  

Bill No: AB 302

Author: Bauer-Kahan (D)

Amended: 6/30/26 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello, Valladares

SENATE EDUCATION COMMITTEE: 6-0, 6/24/26

AYES: Pérez, Ochoa Bogh, Choi, Cortese, Gonzalez, Reyes

NO VOTE RECORDED: Cabaldon

SENATE PRIV., DIGITAL TECH. & CONS. PROT. COMMITTEE: 9-0, 6/29/26

AYES: Cabaldon, Seyarto, Gonzalez, McNerney, Ochoa Bogh, Padilla, Reyes, Umberg, Wiener

ASSEMBLY FLOOR: 56-11, 5/23/25 - See last page for vote

SUBJECT: Pupil and parental communication: extracurricular activities: addictive feeds

SOURCE: Author

DIGEST:

This bill, beginning with the 2027-28 school year, prohibits a local educational agency (LEA) from (1) excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds and (2) using addictive feeds as the only means of contacting pupils or pupils’ parents or guardians.

ANALYSIS:

Existing law:

1. Requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, as a condition for the receipt of specified school funding allocations, to establish a school district policy regarding participation in extracurricular and cocurricular activities by pupils in grades 7 to 12, inclusive. Requires that the criteria applied to extracurricular and cocurricular activities ensure that pupil participation is conditioned upon satisfactory educational progress in the previous grade level. (Education Code (EC) § 35160.5)
2. Defines “extracurricular activity” for the purposes of #1 above as a program that has all of the following characteristics:
   1. The program is supervised or financed by the school district.
   2. Pupils participating in the program represent the school district.
   3. Pupils exercise some degree of freedom in either the selection, planning, or control of the program.
   4. The program includes both preparation for performance and performance before an audience or spectators.
3. Authorizes the governing board of a school district to adopt, as part of its policy on participation in extracurricular and cocurricular activities, provisions that would allow a pupil who does not achieve satisfactory educational progress, as specified, in the previous grade period to remain eligible to participate in extracurricular or cocurricular activities during a probationary period. (EC § 35160.5)
4. Provides that the parents and guardians of pupils enrolled in public schools have a right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including the following:
   1. To be notified on a timely basis if their child is absent from school without permission.
   2. To receive the results of their child’s performance on standardized tests and statewide tests and information on the performance of the school that their child attends on standardized statewide tests.
   3. To be informed of their child’s progress in school and of the appropriate school personnel whom they should contact if problems arise with their child.
   4. To have access to the school records of their child.
   5. To receive information concerning the academic performance standards, proficiencies, or skills their child is expected to accomplish.
   6. To be informed in advance about school rules, including disciplinary rules and procedures, attendance policies, dress codes, and procedures for visiting the school. (EC § 51101)
5. Requires the governing board of each school district to annually notify the parent or guardian of a minor pupil regarding various rights or responsibilities of the parent or guardian relevant to the school environment. (EC § 48980)
6. Establishes the intent of the Legislature that opportunities for participation in athletics be provided on an equitable basis to all students. (EC § 49021)
7. Authorizes the governing board of a school district, a county board of education, or the governing body of a charter school to adopt a policy to limit or prohibit the use by its pupils of social media while the pupils are at a schoolsite or while the pupils are under the supervision and control of an employee or employees of that school district, county office of education (COE) or charter school. (EC § 48901.8)
8. Defines “addictive feed” as an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommended, selected, or prioritized for display to a user based, in whole or in part, on information provided by the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met, alone or in combination with one another:
   1. The information is not persistently associated with the user or user’s device and does not concern the user’s previous interactions with media generated or shared by others.
   2. The information consists of search terms that are not persistently associated with the user or user’s device.
   3. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
   4. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of such media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, in the case of audio or video content, is not automatically played.
   5. The media consists of direct, private communications between users.
   6. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, in the case of audio or video content, is not automatically played.
   7. The recommendation, selection, or prioritization of the media is necessary to comply with state law or regulation. (Health and Safety Code (HSC) § 27000.5)

This bill:

1. Prohibits an LEA from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, beginning with the 2027-28 school year.
2. Prohibits an LEA from using addictive feeds as the only means of contacting pupils or pupils’ parent or guardians.
3. Encourages LEAs to inform pupils and pupils’ parents or guardians about the pupils’ rights established by this bill in its pupil handbook or a similar document made generally available to pupils and their parents or guardians.
4. Defines “addictive feed” as meaning an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommend, select, or prioritize for display to a user’s device, in whole or in part, on information provided by a the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met:
   1. The information is not persistently associated with the user or the user’s device and does not concern the user’s previous interactions with media generated or shared by others.
   2. The information consists of search terms that are not persistently associated with the user or user’s device.
   3. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
   4. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of that media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, if the media is audio or video content, is not automatically played.
   5. The media consists of direct, private communications between users.
   6. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, if the media is audio or video content, is not automatically played.
   7. The recommendation, selection, or prioritization of the media is necessary to comply with state or federal law.

Comments

Need for the bill. According to the author, “Schools are increasingly reliant on social media and addictive feeds for communication and networking with students and families. Children are forced to join addictive platforms in order to participate in school clubs and activities that enrich their school experience. By forcing teens onto platforms which prey on them, schools are feeding into the increasing mental health crisis largely caused by social media usage. AB 302 prohibits schools from using addictive feeds as the sole form of communication with students or parents/guardians and ensures that students have access to after school clubs and activities without having to join potentially dangerous platforms.”

Addictive feeds. Consistent with existing law, this bill defines addictive feeds as websites, apps, and services in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommend, select, or prioritize for display to a user’s device, in whole or in part, on information provided by a the user, or otherwise associated with the user or the user’s device. Addictive feeds or algorithms are often utilized by social media platforms to capture the attention of a user and prolong their engagement and total use or screen time.

In 2023, the U.S. Surgeon General issued an advisory about the effects of social media use on youth mental health. In the advisory, the Surgeon General issued a call for urgent action by policymakers, technology companies, researchers, families, and young people alike to gain a better understanding of the full impact of social media use, maximize the benefits and minimize the harms of social media platforms, and create safer, healthier online environments to protect children. The advisory stated the following:

• While social media may offer some benefits, there are ample indicators that social media can also pose a risk of harm to the mental health and well-being of children and adolescents.
• Children are affected by social media in different ways, including based on cultural, historical, and socio-economic factors. Among the benefits, adolescents report that social media helps them feel more accepted (58%), like they have people who can support them through tough times (67%), like they have a place to show their creative side (71%), and be more connected to what’s going on in their friends’ lives (80%).
• Studies have also shown a relationship between social media use and poor sleep quality, reduced sleep duration, sleep difficulties, and depression among youth.
• More research is needed to determine the full impact social media use has on nearly every teenager across the country.

According to a 2020 article in the Journal of Affective Disorders, “Is social media screen time really associated with poor adolescent mental health?”, a greater amount of time spent on social media was associated with an increased risk of self-harm, depression, and lower levels of self-esteem in 13–15-year-old girls. Findings were similar for weekday and weekend use.

Some research has suggested that there is likely a correlation between the increased use of technology and smartphone use and the increased rates of teenage anxiety and depression. A widely cited book by Dr. Jean Twenge, a professor of psychology at San Diego State, iGen, presents evidence of an increase in depression and suicide among American teenagers that may be caused by increased mobile device screen time and social media use.

Examples of students being excluded. This bill prohibits an LEA from excluding a student from participating in extracurricular activities, including clubs and sports, due to the student not having or using addictive feeds. The author’s office has provided the following anecdotal examples of when students have been excluded or pressured due to their nonuse of platforms that utilize addictive feeds:

• 1. A Southern California student was required to create an Instagram account in order to communicate with members of their high school baseball team. When their parent indicated that they did not approve of their child using the app, the parent was advised to start a profile on the student’s behalf.
  2. A Southern California student was required to create a SnapChat account in order to communicate with members of their high school water polo team.
  3. A Northern California student shared that they were removed from their student leadership position due to them not having an Instagram account.

In these scenarios, it is not clear whether there was a formal policy enforced by the LEA requiring students to create social media accounts that use addictive feeds or if the requirement was more of an informal rule. Because the requirements for membership or participation in a student club or sport are determined locally, it is difficult to quantify how widespread these exclusions are.

Parent communications. Generally, for matters involving an individual student, school administrators and LEA staff directly contact parents and guardians through traditional means of email, phone call, or written notice sent home with students. Recently, many schools have also launched dedicated school messaging services and apps to streamline and standardized communication between parents, teachers, and school leaders. For more general updates intended for broader audiences, LEAs may also maintain official social media accounts and pages to share updates, school news, and general reminders with students, their families, and community members.

This bill prohibits LEAs from using addictive feeds as the only means of contacting students and their parents or guardians. It does not prohibit LEAs from utilizing platforms that use addictive feeds, such as Facebook, Instagram, Twitter, to continue sharing general updates with parents and community members.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 6/30/26)

Common Sense Media
Distraction-Free Schools California

Healthier-Tech

OPPOSITION: (Verified 6/30/26)

None received

ASSEMBLY FLOOR: 56-11, 5/23/25

AYES: Addis, Aguiar-Curry, Ahrens, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Solache, Stefani, Wallis, Ward, Wilson, Zbur, Rivas

NOES: Castillo, DeMaio, Dixon, Ellis, Gallagher, Hadwick, Lackey, Macedo, Patterson, Ta, Tangipa

NO VOTE RECORDED: Alanis, Bryan, Chen, Flora, Jeff Gonzalez, Hoover, Nguyen, Sanchez, Sharp-Collins, Soria, Valencia, Wicks

Prepared by: Therresa Austin / ED. / (916) 651-4105

7/2/26 8:41:28

**** END ****

SENATE PRIVACY, DIGITAL TECHNOLOGIES, AND CONSUMER PROTECTION COMMITTEE

Senator Christopher Cabaldon, Chair

2025-2026 Regular Session

Bill No: AB 302 (Author:Bauer-Kahan)

Version: June 11, 2026

Hearing Date: June 29, 2026

Fiscal: No

Urgency: No

Consultant: CK

SUBJECT

Pupil and parental communication: extracurricular activities: addictive feeds

DIGEST

This bill prohibits local educational agencies (LEAs) from excluding pupils from activities based on not having or using “addictive feeds” and from using such feeds as the only means of communicating with pupils and their families.

EXECUTIVE SUMMARY

People around the world use social media to connect with like-minded others, find various resources, and entertain themselves. However, these benefits did not come without a heavy price: a price that is felt the most by children. Youth mental health problems are skyrocketing, while digital consumption only increases. Social media use has been linked to increasing depression, anxiety, suicidality, eating disorders, and countless other harmful effects. Concerns have arisen that schools and school activities are increasingly relying on social media as the core tool for communication and participation.

This bill ensures that LEAs are not forcing children and their families into “addictive feeds” found on social media platforms and other websites in order to take part in a school community. Specifically, the bill prohibits LEAs from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds and from using addictive feeds as the only means of contacting pupils or pupils’ parents or guardians.

The bill is author-sponsored. It is supported by several advocacy groups, including Common Sense Media. No timely opposition was received by the Committee. The bill passed out of the Senate Education Committee on a vote of 6 to 0.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the Protecting Our Kids from Social Media Addiction Act, prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user. (Health & Saf. Code § 27000 et seq.)
2. Defines “addictive feed” as an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommended, selected, or prioritized for display to a user based, in whole or in part, on information provided by the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met, alone or in combination with one another:
3. The information is not persistently associated with the user or user’s device and does not concern the user’s previous interactions with media generated or shared by others.
4. The information consists of search terms that are not persistently associated with the user or user’s device.
5. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
6. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of such media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, in the case of audio or video content, is not automatically played.
7. The media consists of direct, private communications between users.
8. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, in the case of audio or video content, is not automatically played.
9. The recommendation, selection, or prioritization of the media is necessary to comply with the act. (Health & Saf. Code § 27000.5(a).)
10. Requires, for purposes of the Protecting Our Kids from Social Media Addiction Act, the Attorney General to adopt regulations regarding age assurance by January 1, 2027. (Health & Saf. Code § 27006(b).)
11. Requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, to establish a school district policy regarding participation in extracurricular and cocurricular activities by pupils in grades 7 to 12, inclusive. (Educ. Code § 35160.5(a).)
12. Defines “extracurricular activity” as a program that has all of the following characteristics:
    1. The program is supervised or financed by the school district.
    2. Pupils participating in the program represent the school district.
    3. Pupils exercise some degree of freedom in either the selection, planning, or control of the program.
    4. The program includes both preparation for performance and performance before an audience or spectators. (Educ. Code § 35160.5(a)(1).)

This bill:

1. Prohibits, commencing with the 2027–28 school year, an LEA from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds.
2. Prohibits, commencing with the 2027–28 school year, an LEA from using addictive feeds as the only means of contacting pupils or pupils’ parents or guardians.
3. Defines “addictive feed” in line with existing law. “Local educational agency” means a school district, county office of education, or charter school.

COMMENTS

1. Addictive feeds and their effects

In 2023, the Office of the Surgeon General published an advisory on social media and youth mental health. As it relates to problematic use, the Surgeon General’s advisory notes:

Excessive and problematic social media use, such as compulsive or uncontrollable use, has been linked to sleep problems, attention problems, and feelings of exclusion among adolescents. Sleep is essential for the healthy development of adolescents. A systematic review of 42 studies on the effects of excessive social media use found a consistent relationship between social media use and poor sleep quality, reduced sleep duration, sleep difficulties, and depression among youth. Poor sleep has been linked to altered neurological development in adolescent brains, depressive symptoms, and suicidal thoughts and behaviors. On a typical weekday, nearly 1-in-3 adolescents report using screen media until midnight or later. While screen media use encompasses various digital activities, social media applications are the most commonly used applications by adolescents.

In a recent narrative review of multiple studies, problematic social media use has also been linked to both self-reported and diagnosed attention-deficit/ hyperactivity disorder (ADHD) in adolescents, although more research is necessary to understand whether one causes the other. A longitudinal prospective study of adolescents without ADHD symptoms at the beginning of the study found that, over a 2-year follow-up, high-frequency use of digital media, with social media as one of the most common activities, was associated with a modest yet statistically significant increased odds of developing ADHD symptoms (OR 1.10; 95% CI, 1.05-1.15). Additionally, social media-induced fear of missing out, or “the pervasive apprehension that others might be having rewarding experiences from which one is absent,” has been associated with depression, anxiety, and neuroticism.^[1]

A New York Times article exposed how leadership at Facebook designed its platforms to achieve these outcomes :

To achieve its record-setting growth, [Facebook] had continued building on its core technology, making business decisions based on how many hours of the day people spent on Facebook and how many times a day they returned. Facebook’s algorithms didn’t measure if the magnetic force pulling them back to Facebook was the habit of wishing a friend happy birthday, or a rabbit hole of conspiracies and misinformation.

Facebook’s problems were features, not bugs.^[2]

Released documents from Instagram make clear that “Facebook is acutely aware that the products and systems central to its business success routinely fail”:

The features that Instagram identifies as most harmful to teens appear to be at the platform’s core.

The tendency to share only the best moments, a pressure to look perfect and an addictive product can send teens spiraling toward eating disorders, an unhealthy sense of their own bodies and depression, March 2020 internal research states. It warns that the Explore page, which serves users photos and videos curated by an algorithm, can send users deep into content that can be harmful.

“Aspects of Instagram exacerbate each other to create a perfect storm,” the research states.^[3]

The referenced documents revealed that Facebook’s own internal research found “1 in 8 of its users reported compulsive social media use that interfered with their sleep, work, and relationships— what the social media platform calls ‘problematic use’ but is more commonly known as ‘internet addiction.’”^[4]

There are various features of social media that are believed to contribute to excessive social media use and preoccupation and attendant mental health issues in children, and that are repeatedly highlighted as the most problematic for users, especially children. They are pinpointed by academic research,^[5] and lawsuits brought by most states’ Attorneys General,^[6] as the core of the problem. These include the display of “likes” and other feedback on posted media that drive minors’ unhealthy comparisons to others and their obsessive usage. In addition, the constant notifications that are sent to users nudge them back onto a platform throughout the day and night to seek the next hit of dopamine. The biggest and most central of them all is the algorithmic feeds that are fueled by a user’s own information and inferences drawn from their past behavior and data collected from other sources. While these features can effectively serve up content curated for a user’s personal tastes and create social connections among users, it is these types of features that are most concerning to advocates for reform. The addictive features of online sites and services are the target of this bill.

1. Addressing addictive feeds

The Legislature has responded to the addictive nature of these websites, applications, and services. SB 976 (Skinner, Ch. 321, Stats. 2024) prohibited operators of “internet-based services or applications” from providing “addictive feeds” to minors without parental consent and from sending notifications to minors at night and during school hours without parental consent, as provided. SB 976 required operators to make available to parents a series of protective measures for controlling access to and features of the platform for their children. It also required reporting on data regarding children on their platforms, as specified. The law remains in effect despite ongoing litigation.^[7]

This bill, using the definition provided in SB 976, seeks to ensure that LEAs are not driving children to the very feeds the Legislature is seeking to protect children from. The bill prohibits LEAs from excluding pupils from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds. It also prohibits LEAs from using addictive feeds as the only method of contacting pupils or pupils’ parents or guardians.

According to the author:

Schools are increasingly reliant on social media and addictive feeds for communication and networking with students and families. Children are forced to join addictive platforms in order to participate in school clubs and activities that enrich their school experience. By forcing teens onto platforms which prey on them, schools are feeding into the increasing mental health crisis largely caused by social media usage. AB 302 prohibits schools from using addictive feeds as the sole form of communication with students or parents/guardians and ensures that students have access to after school clubs and activities without having to join potentially dangerous platforms.

Writing in support, a coalition of advocacy groups, including Distraction-Free Schools California, argues:

Students and families who choose to avoid social media should have equal access to educational opportunities, athletics, clubs, and school communications. By requiring schools to provide alternative methods of communication and participation, AB 302 protects parental choice, promotes inclusion, and helps ensure that no student is disadvantaged because their family has concerns about the effects of social media on youth wellbeing.

1. Amendments

Amendments were agreed to by the author in the Senate Education Committee. Due to timing, those amendments will be taken in this Committee. Those amendments simply encourage LEAs to inform pupils and pupils’ parents or guardians about the pupils’ rights provided by the bill in their pupil handbook or a similar document made generally available to pupils and their parents or guardians.

SUPPORT

Common Sense Media

Distraction-Free Schools California

Healthier-TECH

Parent Collective

Schools Beyond Screens

ScreenSense
SMUSD Parents for Intentional Tech

OPPOSITION

None received

RELATED LEGISLATION

AB 2 (Lowenthal, 2025) increases the penalties that can be sought against a social media platform, as defined, if the platform fails to exercise ordinary care or skill and injures a child. AB 2 is currently in the Senate Judiciary Committee.

SB 976 (Skinner, Ch. 321, Stats. 2024) See Comment 2.

AB 3216 (Hoover, Ch. 500, Stats. 2024) required a governing board of an LEA to develop, adopt, and update every five years a policy, as specified, to limit or prohibit the use by its pupils of smartphones while the pupils are at a schoolsite or while the pupils are under the supervision and control of an employee of that LEA.

AB 2273 (Wicks, Ch. 320, Stats. 2022) established the California Age-Appropriate Design Code Act, placing a series of obligations and restrictions on businesses that provide online services, products, or features likely to be accessed by children. This includes a prohibition on using the personal information of any child in a way that the business knows or has reason to know is materially detrimental to the physical health, mental health, or well-being of a child. It also requires these businesses to “[e]stimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.”

AB 2408 (Cunningham, 2022) would have prohibited a social media platform from using a design, feature, or affordance that the platform knew, or which by the exercise of reasonable care it should have known, causes child users to become addicted to the platform. AB 2408 died in the Senate Appropriations Committee.

PRIOR VOTES:

Senate Education Committee (Ayes 6, Noes 0)

Additional votes irrelevant to the current version of the bill

**************

1. Social Media and Youth Mental Health (2023) Office of the Surgeon General, https://www.ncbi.nlm.nih.gov/books/NBK594759/. All internet citations are current as of June 23, 2026. ↑

2. Sheera Frenkel & Cecilia Kang, Mark Zuckerberg and Sheryl Sandberg’s Partnership Did Not Survive Trump (July 8, 2021) The New York Times, https://www.nytimes.com/2021/07/08/business/mark-zuckerberg-sheryl-sandberg-facebook.html. ↑

3. Georgia Wells et al., Facebook Knows Instagram Is Toxic for Teen Girls, Company Documents Show (September 14, 2021) The Wall Street Journal, https://www.wsj.com/articles/facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739?mod=article_inline. ↑

4. Kim Lyons, Facebook reportedly is aware of the level of ‘problematic use’ among its users (November 6, 2021) The Verge, www.theverge.com/2021/11/6/22766935/facebook-meta-aware-problematic-use-addiction-wellbeing. ↑

5. Kirsten Weir, Social media brings benefits and risks to teens. Here’s how psychology can help identify a path forward (September 1, 2023) American Psychological Association, https://www.apa.org/monitor/2023/09/protecting-teens-on-social-media. ↑

6. Matt Richtel, Is Social Media Addictive? Here’s What the Science Says (October 25, 2023) The New York Times, https://www.nytimes.com/2023/10/25/health/social-media-addiction.html. ↑

7. NetChoice, LLC v. Bonta (9th Cir. 2025) 152 F.4th 1002, 1025. ↑

SENATE COMMITTEE ON EDUCATION

Senator Sasha Renée Pérez, Chair

2025 - 2026 Regular

Bill No: AB 302 Hearing Date: June 24, 2026

Subject:

NOTE: This bill has been referred to the Committees on Education and Privacy, Digital Technologies, and Consumer Protection. A “do pass” motion should include referral to the Committee on Privacy, Digital Technology, and Consumer Protection.

SUMMARY

This bill, beginning with the 2027-28 school year, prohibits a local educational agency (LEA) from (1) excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds and (2) using addictive feeds as the only means of contacting pupils or pupils’ parents or guardians.

BACKGROUND

Existing law:

1. Requires the governing board of a school district that maintains one or more schools containing any of grades 7 to 12, inclusive, as a condition for the receipt specified school funding allocations, to establish a school district policy regarding participation in extracurricular and cocurricular activities by pupils in grades 7 to 12, inclusive. Requires that the criteria applied to extracurricular and cocurricular activities ensure that pupil participation is conditioned upon satisfactory educational progress in the previous grade level. (Education Code (EC) § 35160.5)
2. Defines “extracurricular activity” for the purposes of #1 above as a program that has all of the following characteristics:
   1. The program is supervised or financed by the school district.
   2. Pupils participating in the program represent the school district.
   3. Pupils exercise some degree of freedom in either the selection, planning, or control of the program.
   4. The program includes both preparation for performance and performance before an audience or spectators.
3. Authorizes the governing board of a school district to adopt, as part of its policy on participation in extracurricular and cocurricular activities, provisions that would allow a pupil who does not achieve satisfactory educational progress, as specified, in the previous grade period to remain eligible to participate in extracurricular or cocurricular activities during a probationary period. (EC § 35160.5)
4. Provides that the parents and guardians of pupils enrolled in public schools have a right and should have the opportunity, as mutually supportive and respectful partners in the education of their children within the public schools, to be informed by the school, and to participate in the education of their children, as specified, including the following:
   1. To be notified on a timely basis if their child is absent from school without permission.
   2. To receive the results of their child’s performance on standardized tests and statewide tests and information on the performance of the school that their child attends on standardized statewide tests.
   3. To be informed of their child’s progress in school and of the appropriate school personnel whom they should contact if problems arise with their child.
   4. To have access to the school records of their child.
   5. To receive information concerning the academic performance standards, proficiencies, or skills their child is expected to accomplish.
   6. To be informed in advance about school rules, including disciplinary rules and procedures, attendance policies, dress codes, and procedures for visiting the school. (EC § 51101)
5. Requires the governing board of each school district to annually notify the parent or guardian of a minor pupil regarding various rights or responsibilities of the parent or guardian relevant to the school environment. (EC § 48980)
6. Establishes the intent of the Legislature that opportunities for participation in athletics be provided on an equitable basis to all students. (EC § 49021)
7. Authorizes the governing board of a school district, a county board of education, or the governing body of a charter school to adopt a policy to limit or prohibit the use by its pupils of social media while the pupils are at a schoolsite or while the pupils are under the supervision and control of an employee or employees of that school district, county office of education (COE) or charter school. (EC § 48901.8)
8. Defines “addictive feed” as an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommended, selected, or prioritized for display to a user based, in whole or in part, on information provided by the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met, alone or in combination with one another:
   1. The information is not persistently associated with the user or user’s device and does not concern the user’s previous interactions with media generated or shared by others.
   2. The information consists of search terms that are not persistently associated with the user or user’s device.
   3. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
   4. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of such media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, in the case of audio or video content, is not automatically played.
   5. The media consists of direct, private communications between users.
   6. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, in the case of audio or video content, is not automatically played.
   7. The recommendation, selection, or prioritization of the media is necessary to comply with state law or regulation. (Health and Safety Code (HSC) § 27000.5)

ANALYSIS

This bill:

1. Prohibits an LEA from excluding a pupil from participating in any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, beginning with the 2027-28 school year.
2. Prohibits an LEA from using addictive feeds as the only means of contacting pupils or pupils’ parent or guardians.
3. Defines “addictive feed” as meaning an internet website, online service, online application, or mobile application, or a portion thereof, in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommend, select, or prioritize for display to a user’s device, in whole or in part, on information provided by a the user, or otherwise associated with the user or the user’s device, unless any of the following conditions are met:
   1. The information is not persistently associated with the user or the user’s device and does not concern the user’s previous interactions with media generated or shared by others.
   2. The information consists of search terms that are not persistently associated with the user or user’s device.
   3. The information consists of user-selected privacy or accessibility settings, technical information concerning the user’s device, or device communications or signals concerning whether the user is a minor.
   4. The user expressly and unambiguously requested the specific media or media by the author, creator, or poster of the media, or the blocking, prioritization, or deprioritization of that media, provided that the media is not recommended, selected, or prioritized for display based, in whole or in part, on other information associated with the user or the user’s device, except as otherwise permitted by this chapter and, if the media is audio or video content, is not automatically played.
   5. The media consists of direct, private communications between users.
   6. The media recommended, selected, or prioritized for display is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source and, if the media is audio or video content, is not automatically played.
   7. The recommendation, selection, or prioritization of the media is necessary to comply with state or federal law.

STAFF COMMENTS

1. Need for the bill. According to the author, “Schools are increasingly reliant on social media and addictive feeds for communication and networking with students and families. Children are forced to join addictive platforms in order to participate in school clubs and activities that enrich their school experience. By forcing teens onto platforms which prey on them, schools are feeding into the increasing mental health crisis largely caused by social media usage. AB 302 prohibits schools from using addictive feeds as the sole form of communication with students or parents/guardians and ensures that students have access to after school clubs and activities without having to join potentially dangerous platforms.”
2. Addictive feeds. Consistent with existing law, this bill defines addictive feeds as websites, apps, and services in which multiple pieces of media generated or shared by users are, either concurrently or sequentially, recommend, select, or prioritize for display to a user’s device, in whole or in part, on information provided by a the user, or otherwise associated with the user or the user’s device. Addictive feeds or algorithms are often utilized by social media platforms to capture the attention of a user and prolong their engagement and total use or screen time.

In 2023, the U.S. Surgeon General issued an advisory about the effects of social media use on youth mental health. In the advisory, the Surgeon General issued a call for urgent action by policymakers, technology companies, researchers, families, and young people alike to gain a better understanding of the full impact of social media use, maximize the benefits and minimize the harms of social media platforms, and create safer, healthier online environments to protect children. The advisory stated the following:

• While social media may offer some benefits, there are ample indicators that social media can also pose a risk of harm to the mental health and well-being of children and adolescents.
• Children are affected by social media in different ways, including based on cultural, historical, and socio-economic factors. Among the benefits, adolescents report that social media helps them feel more accepted (58%), like they have people who can support them through tough times (67%), like they have a place to show their creative side (71%), and be more connected to what’s going on in their friends’ lives (80%).
• Studies have also shown a relationship between social media use and poor sleep quality, reduced sleep duration, sleep difficulties, and depression among youth. 
• More research is needed to determine the full impact social media use has on nearly every teenager across the country.

According to a 2020 article in the Journal of Affective Disorders, Is social media screen time really associated with poor adolescent mental health?, a greater amount of time spent on social media was associated with an increased risk of self-harm, depression, and lower levels of self-esteem in 13–15-year-old girls. Findings were similar for weekday and weekend use.

Some research has suggested that there is likely a correlation between the increased use of technology and smartphone use and the increased rates of teenage anxiety and depression. A widely cited book by Dr. Jean Twenge, a professor of psychology at San Diego State, iGen, presents evidence of an increase in depression and suicide among American teenagers that may be caused by increased mobile device screen time and social media use.

1. Examples of students being excluded. This bill prohibits an LEA from excluding a student from participating in extracurricular activities, including clubs and sports, due to the student not having or using addictive feeds. The author’s office has provided the following anecdotal examples of when students have been excluded or pressured due to their nonuse of platforms that utilize addictive feeds:

• A Southern California student was required to create an Instagram account in order to communicate with members of their high school baseball team. When their parent indicated that they did not approve of their child using the app, the parent was advised to start a profile on the student’s behalf.
• A Southern California student was required to create a SnapChat account in order to communicate with members of their high school water polo team.
• A Northern California student shared that they were removed from their student leadership position due to them not having an Instagram account.

In these scenarios, it is not clear whether there was a formal policy enforced by the LEA requiring students to create social media accounts that use addictive feeds or if the requirement was more of an informal rule. Further, based on information provided by the author’s office, it is not clear whether the two scenarios related to sports teams resulted in the student’s ultimate removal from their respective teams. Because the requirements for membership or participation in a student club or sport are determined locally, it is difficult to quantify how widespread these exclusions are.

1. Parent communications. Generally, for matters involving an individual student, school administrators and LEA staff directly contact parents and guardians through traditional means of email, phone call, or written notice sent home with students. Recently, many schools have also launched dedicated school messaging services and apps to streamline and standardized communication between parents, teachers, and school leaders. For more general updates intended for broader audiences, LEAs may also maintain official social media accounts and pages to share updates, school news, and general reminders with students, their families, and community members.

This bill prohibits LEAs from using addictive feeds as the only means of contacting students and their parents or guardians. It does not prohibit LEAs from utilizing platforms that use addictive feeds, such as Facebook, Instagram, Twitter, to continue sharing general updates with parents and community members.

1. Committee amendments to be taken in Senate Privacy and Digital Technology, and Consumer Protection Committee. School clubs are typically student-led organizations that operate under the supervision of an advisor. Most schools have a formal process that students must follow to establish a club on their campus. This process often includes identifying an advisor, electing officers and defining their duties, and drafting and adopting club bylaws and policies. Because students take up the helm of creating those policies and bylaws, they may inadvertently come into conflict with the prohibitions included within this bill.

The Committee staff recommends that the bill be amended to encourage LEAs to include information about the prohibitions established in this bill within its student handbook or a similar document made generally available to students and their parents or guardians.

1. Prior and related legislation.

SB 1412 (Rubio, 2026) provides that a parent or guardian of a student has the right to communicate with their child’s teacher using a two-way telephonic service or a two-way audiovisual platform if the parent or guardian is unable to attend a meeting in person with a teacher. SB 1412 is pending a hearing in the Assembly Education Committee.

AB 1709 (Lowenthal, 2026) would prohibit social media accounts that use addictive feeds for youth under age 16 and creates an e-Safety Advisory Commission. AB 1709 is pending a hearing in the Senate Privacy, Digital Technologies, and Consumer Protection Committee.

AB 56 (Bauer-Kahan, Chapter 671, Statutes of 2025) requires, beginning on January 1, 2027, covered platforms to display to children mental health warning labels about the harms associated with social media when the child logs on to the platform and after extended use.

SB 976 (Skinner, Chapter 321, Statutes of 2024) (1) prohibits operators of “internet-based services or applications” from providing “addictive feeds,” as those terms are defined, to minors without parental consent and from sending notifications to minors at night and during school hours without parental consent, as provided, beginning January 1, 2027; (2) requires operators to make available to parents a series of protective measures for controlling access to and features of the platform for their children; and (3) requires reporting on data regarding children on their platforms, as specified.

SUPPORT

Common Sense Media

Distraction-Free Schools California

OPPOSITION

None received

-- END --

SENATE COMMITTEE ON

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

AB 302 (Bauer-Kahan) - Data brokers: elected officials and judges

Bill Summary:

AB 302 requires specified businesses and government entities to delete personal information of elected officials and judges, as specified.

Fiscal Impact:

• California Privacy Protection Agency (CPPA) anticipates requiring a $2.5 million contract for the first year and $500,000 ongoing with costs totaling: $3,491,000 in budget year and $1,451,000 ongoing (Data Broker Registry Fund, General Fund). Using funds from the Data Broker Registry Fund to cover these costs would require a significant increase in the data broker registration fees in January 2026. The CPPA will require an estimated $2.5 million for the first year and authorization to be exempt from the Public Contract Code competitive bidding requirements to collect the names and profile information of state and local elected officials by the March 2026 deadline, and to add a push notification feature to the accessible deletion mechanism by August 2026. Additionally, the CPPA will require $500,000 ongoing to collect the names and profile information of state and local elected officials following each election. For context, the state of New Jersey has enacted a similar law that allows covered individuals to submit requests to private, non-governmental websites to have their residential information taken down. That law created an office within the New Jersey Department of Community Affairs, called the Office of Information Privacy (OIP), to process these requests. OIP’s budget for FY 2026 is approximately $3 million, with a headcount of four.^[1] The OIP has processed approximately 10,000 requests since it was established in 2022.^[2] CPPA staff estimates that this bill would cover approximately 25,000 state and local elected officials, and a much broader set of protected personal information, which could include name, date of birth, zip code, email, phone number, mobile advertising ID, and vehicle information number. The CPPA estimates that it would need the following 5 permanent positions:
  
  • Staff Services Manager III and 2 Associate Governmental Program Analysts (AGPAs) to gather names and profile information from elected officials every year for submissions to the accessible deletion mechanism;
    
  • 1 AGPA in the Enforcement Division to coordinate requests with the Legal Division, judges, other requesters and to monitor and track any private enforcement efforts; and,
    
  • 1 Attorney III to investigate potential violations and bring enforcement actions.
• The Judicial Council anticipates minor and absorbable costs associated with collecting providing information on judges to the CPPA, as required by this bill.
  
• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. Creating a new private cause of action that allows for the recovery of attorney’s fees and potentially punitive damages, and by authorizing a new civil enforcement by state and local prosecutors, may lead to additional case filings that otherwise would not have been commenced. Expanding civil penalties and creating new causes of action could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.

Background:

The purpose of this bill is to provide enhanced protections for elected officials and judicial officers by requiring the CPPA and Judicial Council to collect their information and to request to specified businesses and government agencies of delete their personal information. While this bill a noble response to the targeted killings of elected officials in Minnesota, does cloaking public officials in a veil of secrecy undermine the core values of democracy?

Proposed Law:

• Requires, on or before March 1, 2026, the CPPA to obtain a list of all state and local elected officials, which shall serve as each elected official’s request to delete the elected official’s personal information. The list shall include each elected official’s name and other profile data, as defined by the CPPA, that has been shared voluntarily by the elected official.
• Requires the CPPA to provide each elected official an opportunity to request that the elected official’s name and profile data be removed from the list.
• Provides, following the certification of a final election, the CPPA shall comply with these provisions with respect to each newly elected official.
• Requires the Judicial Council to provide the California Privacy Protection Agency with a list of all California judges, which shall serve as each judge’s request to delete the judge’s personal information. The list shall include each judge’s name and other profile data, as defined by CPPA, that has been shared voluntarily by the judge.
• States that, before providing the list to the CPPA, the Judicial Council shall provide each judge an opportunity to request that the judge’s name and profile data be removed from the list. The list submitted to CPPA shall only include those judges that did not request to be removed from the list.
• Requires the Judicial Council shall provide an updated list after the appointment or election of any additional judge.
• Requires, after receipt of the lists required by this section, the CPPA, to upload the lists to the accessible deletion mechanism, as specified.
• Provides, beginning August 1, 2026, an entity receiving a notification that a deletion is required shall do so within five days.
• Requires any information shared to be in a secure and confidential exchange. The lists and the information in the lists shall be confidential and not subject to disclosure under the California Public Records Act.
• States that an elected official or judge who is on a list, the Attorney General, a county counsel, or a city attorney may bring an action for a violation for any of the following relief:
  • Declaratory relief;
  • Injunctive relief;
  • Reasonable attorney’s fees;
  • Actual damages; and,
  • In addition to the other relief, if a court finds that an entity willfully refused to provide for deletion as required, punitive damages.

Staff Comments: This bill seeks to protect government officials by establishing a process to have their information deleted from data brokers. However, as currently drafted the bill has substantial issues related to process, verification, and technical feasibility. The CPPA has indicated to staff that this bill be could be amended to place another entity in charge of developing and maintaining the list of elected officials; to establish a verification procedure for the deletion lists; and to adjust deadlines to reflect the technical development required or align technical requirements with the existing architecture to implement DROP – the Deletion Request and Opt-out Platform.

As drafted, this bill does not include exceptions for federally regulated transactions under the Gramm-Leach-Bliley Act (GLBA), Driver’s Privacy Protection Act (DPPA), Fair Credit Reporting Act (FCRA), and Health Insurance Portability and Accountability Act (HIPAA). Opponents of this bill contend that these transactions are non-public facing and are critical for identity verification, fraud detection, and other essential services. Personal information is routinely exchanged between businesses to fulfill contractual obligations and comply with existing regulatory requirements. These exchanges do not risk public exposure of data and include use cases such as validating identity for financial transactions or accessing government benefits. For example, information collected and processed under the FCRA or GLBA is necessary to meet legal requirements and ensure system integrity. Hawaii recently enacted similar legislation that included targeted exemptions for federally regulated transactions.^[3]

Opponents of this bill further contend that this bill apply to news outlets, and will not sufficiently protect constitutionally protected speech including news and other speech on a matter of public concern. Indeed, a similar statute has been held to violate the First Amendment. (Publius v. Boyer-Vine (E.D. Cal. 2017) 237 F.Supp.3d 997.) The First Amendment and federal preemption issues raised by this bill are assessed in further detail in the Senate Judiciary Committee analysis. Accordingly, this bill may result in additional trial court costs to the extent that cases are brought to litigate its constitutionality.

-- END --

1. https://pub.njleg.state.nj.us/bills/2024/AL25/74_.PDF ↑

2. https://www.nj.gov/dca/news/news/2025/approved/20250428.shtml ↑

3. https://data.capitol.hawaii.gov/sessions/session2024/bills/HB1916_SD1_.HTM ↑

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2025-2026 Regular Session

Bill No: AB 302 (Author:Bauer-Kahan)

Version: July 3, 2025

Hearing Date: July 8, 2025

Fiscal: Yes

Urgency: No

Consultant: AM

SUBJECT

Protected individuals

DIGEST

This bill seeks to provide enhanced privacy protections for elected official and judges by, among other things, requiring businesses and government agencies to delete their personal information upon request subject to a civil enforcement action for noncompliance.

EXECUTIVE SUMMARY

The recent events in Minnesota where elected politicians and their spouses were targeted in their homes and, in one instance, tragically killed provides a stark reminder that serving in public office poses risks for those who choose to serve and their family.^[1] In response to these recent events, this bill seeks to provide enhanced protections to protected individuals, defined as a former and current representative elected in this state, an appointed officer of a court or magistrate in this state, and the spouse, child, or dependent who resides in the same household. These protections include allowing a requirement that businesses and government agencies delete their personal information upon request subject to a civil enforcement action for noncompliance. The bill also requires the California Privacy Protection Agency, on behalf of a protected individual, to request a business to refrain from selling their personal information. Though the purpose of the bill is well intentioned and seeks to address a very timely and important issue, it raises constitutional issues and has several operational hurdles, which are described below. In response to these issues, the author has proposed amends to scale the bill back to allow the California Privacy Protection Agency to facilitate the uploading of elected officials and California judges to the accessible deletion mechanism established under SB 362 (Becker, Ch. 709, Stats. 2023.) These amendments are discussed below and a mock-up is provided.

The bill is author sponsored. The bill is opposed by a diverse group of organizations, including first amendment advocacy organizations, organizations that advocate for business, realtors, and technology, and the California Land Title Association.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Provides that the home addresses, home telephone numbers, personal cellular telephone numbers, and birthdates of all employees of a public agency are not public records and are not open to public inspection. (Gov. Code § 7928.300(a).)
2. Prohibits a person from knowingly posting the home address or telephone number of any elected or appointed official, or of the official’s residing spouse or child, on the internet knowing that person is an elected or appointed official and intending to cause imminent great bodily harm that is likely to occur or threatening to cause imminent great bodily harm to that individual, and provides that a violation is a misdemeanor, unless the violation leads to the bodily injury of the official, or their residing spouse or child, in which case the violation is a misdemeanor or a felony. (Gov. Code § 7928.210.)
3. Prohibits any person, business, or association from soliciting, selling, or trading on the internet the home address or telephone number of an elected or appointed official with the intent to cause imminent great bodily harm to the official or to any person residing at the official’s home address. Authorizes an official whose home address or telephone number is solicited, sold, or traded in violation of this prohibition to bring an action in court and provides that they can get specified damages. (Gov. Code § 7928.230.)
4. Prohibits a state or local agency from publicly posting the home address, telephone number, or both the name and assessor parcel number of any elected or appointed official on the internet without first obtaining the written permission of that individual. (Gov. Code § 7928.205.)
5. Defines an “elected or appointed official” to include, but not be limited to, all of the following:
   1. A state constitutional officer.
   2. A Member of the Legislature.
   3. A judge or court commissioner.
   4. A district attorney.
   5. A public defender.
   6. A member of a city council.
   7. A member of a board of supervisors.
   8. An appointee of the Governor.
   9. An appointee of the Legislature.
   10. A mayor.
   11. A city attorney.
   12. A police chief or sheriff.
   13. A public safety official.
   14. A state administrative law judge.
   15. A federal judge or federal defender.
   16. A member of the United States Congress or appointee of the President of the United States.
   17. A judge of a federally recognized Indian tribe. (Gov. Code §§ 7920.500.)
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code §§ 798.100 et seq.; Proposition 24 (2020).)
7. Provides consumers the right to request that a business delete any personal information about the consumer which the business has collected from the consumer. (Civ. Code § 1798.105(a).)
8. Provides that a business or service provider or contractor acting pursuant to its contract with the business, another service provider, or another contractor, shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is reasonably necessary for the business or service provider to maintain the consumer’s personal information in order to do certain things, including to comply with a legal obligation. (Civ. Code § 1798.105(d).)
9. Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
   1. the categories of personal information it has collected about that consumer;
   2. the categories of sources from which the personal information is collected;
   3. the business or commercial purpose for collecting or selling personal information;
   4. the categories of third parties with whom the business shares personal information; and
   5. the specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
10. Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
    1. the categories of personal information that the business collected about the consumer;
    2. the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
    3. the categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
11. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of the sale or sharing of their personal information. (Civ. Code § 1798.120.)
12. Provides that these provisions do not restrict a business’ ability to collect, use, retain, sell, share, or disclose consumers’ personal information that is deidentified or aggregate consumer information. (Civ. Code § 1798.145(a)(6).)
13. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including biometric information, geolocation data, and “sensitive personal information.” It does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. (Civ. Code § 1798.140(v).)
14. Extends additional protections to “sensitive personal information,” which is defined as personal information that reveals particularly sensitive information such as genetic data and the processing of biometric information for the purpose of uniquely identifying a consumer. (Civ. Code § 1798.140(ae).)
15. Provides various exemptions from the obligations imposed by the CCPA, including where they would restrict a business’ ability to comply with federal, state, or local laws. (Civ. Code § 1798.145.)
16. Requires a business, on or before January 31 following each year in which it meets the definition of a data broker, to register with the PPA, as provided. (Civ. Code § 1798.99.82.)
17. Defines “data broker” as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, except as specified.
    1. Aligns the definitions of “business,” “personal information,” “sale,” “collect,” “consumer,” and “third party” with those in the CCPA. (Civ. Code § 1798.99.80.)
18. Requires data brokers to provide to the PPA, and the PPA to include on its website, the name of the data broker and its primary physical address, email, and website. Data brokers may, at their discretion, also provide additional information concerning their data collection practices. (Civ. Code §§ 1798.99.82, 1798.99.84.)
19. Requires the PPA to establish an accessible deletion mechanism, as provided, that allows consumers, through a single request, to request all data brokers to delete any personal information related to the consumer, as specified. Data brokers are required to regularly access the mechanism and process requests for deletion, as specified. (Civ. Code § 1798.99.86.)
20. Provides that after a consumer has submitted a deletion request and a data broker has deleted the consumer’s data pursuant hereto, the data broker must delete all personal information of the consumer, except as provided, beginning August 1, 2026. After a consumer has submitted a deletion request and a data broker has deleted the consumer’s data, the data broker shall not sell or share new personal information of the consumer unless the consumer requests otherwise or the selling or sharing is otherwise permitted, as provided. (Id. at subd. (c)-(d).)
    1. Requires data brokers to undergo audits every three years to determine compliance with the data broker registry law beginning January 1, 2028. (Id. at subd. (e).)

This bill:

1. Defines the following terms:
   1. “Business” means a sole proprietorship, partnership, limited liability company, corporation, association, nonprofit entity, or other legal entity that collects individuals’ personal information, or on the behalf of which that information is collected, and that alone, or jointly with others, determines the purposes and means of the processing of personal information and does business in the state.
   2. “Governmental entity” means a state or local agency, including, but not limited to, a law enforcement entity or any other investigative entity, agency, department, division, bureau, board, or commission, or any individual acting or purporting to act for or on behalf of a state or local agency.
   3. “Personal information” means any of the following:
      1. A residential address.
      2. A personal email address.
      3. A personal telephone number.
      4. A driver’s license number.
      5. A passport number.
      6. Geolocation data.
      7. A license plate number or unique identifier of a vehicle.
      8. A birth, marital, or divorce record.
      9. A child, spouse, parent, or sibling’s name.
      10. A school or daycare.
      11. A place of worship.
      12. A place of employment.
   4. “Personal information” does not include:
      1. Information that has been publicly disclosed with the informed consent of the protected individual.
      2. Information that is relevant to, and displayed as part of, a news story, commentary, editorial, or any other speech on a matter of public concern.
      3. Information that is required by law to be made publicly available by a governmental entity.
   5. “Protected individual” means any of the following:
      1. A current or former representative elected in the state, as determined by the Secretary of State.
      2. An appointed officer of a court or a magistrate in the state.
      3. A spouse, a child, or a dependent who resides in the same household as an individual described in (i) or (ii).
   6. “Sell” means to sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, a protected individual’s personal information to a third party for monetary or other valuable consideration.
2. Authorizes a protected individual, or the PPA on behalf of a protected individual, to request a business to do either of the following:
   1. refrain from selling the protected individual’s personal information; and
   2. delete the protected individual’s personal information.
3. Requires, on receipt of a request under (2), above, a business to delete the personal information within 72 hours of receiving the request.
4. Requires the PPA to obtain a list of all state and local elected officials that includes their contact information. Requires the Judicial Council to provide the PPA with a list of all California judges that includes their contact information.
5. Requires the PPA to submit a request on behalf of any elected official or judge to any registered data broker to delete the personal information of those individuals upon receipt of the lists described in 4), above.
6. Authorizes a protected individual to provide a list of businesses that they want the PPA to request deletion of their personal information or any other deletion request. Requires the PPA to provide an elected official or judge with a notice regarding the process for requesting the deletion of the personal information of that individual’s family members and the process for requesting assistance with requesting the deletion of personal information from a business that is not a registered data broker.
7. Authorizes a representative to request a governmental entity to do the following:
   1. refrain from publishing the protected individual’s personal information; and
   2. remove the protected individual’s personal information from any existing publication.
8. Requires a governmental entity to promptly acknowledge receipt of the request in writing by certified mail or by email and do both of the following:
   1. take steps reasonably necessary to ensure that the personal information is not published; and
   2. if the personal information is already published, remove the personal information within 72 hours after receipt of the request.
9. Prohibits a business from knowingly selling the personal information of a protected individual if both of the following are true:
   1. the business knows, or reasonably should know, that selling the personal information poses an imminent and serious threat to the protected individual; and
   2. the selling of the personal information results in an assault in any degree, harassment, trespass, or malicious destruction of property.
10. Provides that a person who violates 9), above, is subject to a civil penalty not exceeding $5,000 in an action brought only by the Attorney General.
11. A protected individual, the Attorney General, a county counsel, or a city attorney may bring an action for a violation of 2)-3), above, and 8), above, for any of the following:
    1. declaratory relief;
    2. injunctive relief;
    3. reasonable attorney’s fees; and
    4. actual damages.
12. If a court finds, in an action under 11), above, that a business or governmental entity willfully refused to provide for the removal of personal information knowing that the individual on behalf of whom the request was made was a protected individual, the court may award punitive damages.

COMMENTS

1. Stated need for the bill

The author writes:

On June 14th, a gunman entered the home of two Minnesota lawmakers, killing House Speaker Emerita Melissa Hortman, her husband Mark Hortman and wounding State Senator John Hoffman and Yvette Hoffman. After the alleged shooter was apprehended, law enforcement found notes listing the names of dozens of Minnesota State and federal elected officials along with their home addresses. Along with the names and addresses was a list of search platforms used for finding home addresses and other personal information. Sites like these and the broader data broker industry have made nearly all personal information available with a few clocks of a button.

With the rising political violence in our country, elected officials are particularly at risk given the public nature of their roles. At a time when democratic representation is more important than ever, we must ensure that as elected representatives, we can keep your selves and our families safe. AB 302 authorizes an elected official and members of their family to request that a company or government entity stop publishing or selling personal information. This bill strengthens privacy protections, ensuring that all elected representatives are safe to serve their communities.

1. Intimidation and threats against elected officeholders and public officials is on the rise

A report published by the Combating Terrorism Center at West Point found that threats against public officials have steadily increased since 2017, which corresponds with an increase in polarization in this country since the 2016 presidential election.^[2] The report found that in 2013-2016 there were an average of 38 federal charges per year, but that number almost doubled during 2017-2022. Several high profile incidents have occurred against federal officials. In 2017, U.S. Representative Steve Scalise was shot at a congressional baseball practice. There was the January 6 insurrection at the Capitol and the hammer attack on U.S. Representative Nancy Pelosi’s husband in their home. The California Legislature has also had its fair share of violent incidents. In late August of 2019, former Senator Richard Pan was shoved by an anti-vaccine activist who was videotaping Senator Pan while walking in downtown Sacramento.^[3]

A little over a month ago, two Minnesota legislators—Senator John Hoffman and Representative Melissa Hortman— were shot in their homes. Senator Hoffman and his wife Yvette survived the attack, but were hospitalized for needed medical care. Representative Hortman and her husband Mark succumbed to their injuries. The suspect was apprehended and faces federal and state murder charges. Minnesota Governor Tim Walz called the shooting an “act of targeted political violence.”^[4] Court documents in the case show that the suspect used “online people search services to find the home addresses of his intended targets. Police found the names of 11 registered data brokers—or companies that gather and sell people’s information, including addresses, emails and phone numbers—in [the suspect’s] abandoned car after the shootings. Police also found a list of dozens of state and federal lawmakers, and their addresses, according to the criminal complaint.”^[5] On the last night of the 2019 legislative session, the Senate had to shut down for several hours after a protestor in the Senate Gallery “threw a feminine hygiene device containing what appeared to be blood onto the Senate floor.”^[6]

A 2024 report from the Brennan Center for Justice that conducted surveys in October 2023 from over 1,700 local and state elected officials from all 50 state and across ages, party affiliations, ideologies, genders, sexual orientations, racial and ethnic identities, and religions found alarming rates of threats against elected officials. The report highlights:

Officeholders across these demographic categories reported experiencing threats or attacks within the past three years. And the volume and severity of abuse have increased in recent years, they said. More than 40 percent of state legislators experienced threats or attacks within the past three years, and more than 18 percent of local officeholders experienced threats or attacks within the past year and a half. The numbers balloon to 89 percent of state legislators and 52 percent of local officeholders when less severe forms of abuse — insults or harassment such as stalking — are included.^[7]

A report conducted by the Joan B. Kroc School of Peace Studies at the University of San Diego that focused on local elected officials in San Diego, Riverside, and Imperial Counties found:

• 66% of all elected officials reported being on the receiving end of threats and harassment.
• 69% of women report experiencing threats and harassment monthly, compared to 38% of their male counterparts.
• 83% of respondents said that threats and harassment are a major issue that require a public response.
• 46% of women and 39% of men have considered leaving public service as a direct result of the threats and harassment they have experienced.^[8]

As the Brennan Center for Justice Report explains, “threats and attacks [on elected officials] constrain how freely officeholders interact with constituents, narrow the spectrum of policy positions they feel safe to support, and make them less willing to continue in public service. Unaddressed, the problem stands to endanger not just individual politicians but, more broadly, the free and fair functioning of representative democracy — at every level of government.”^[9]

1. This bill seeks to provide enhanced protections for elected officials and judicial officers and their family

The bill is intended to provide enhanced protections for elected officials and judicial officers by requiring the PPA to make deletion requests of personal information for a protected individual to a registered data broker. The bill also authorizes a protected individual or the PPA, on behalf of the protected individual, to request a business to do either of the following: a) refrain from selling the protected individual’s personal information; and b) delete the protected individual’s personal information. The bill requires a business to delete the personal information within 72 hours of receiving the request, or the business is subject to a civil cause of action brought by a protected individual, the AG, or other public prosecutors. Business under the bill is defined very broadly, more broadly than under the CCPA, and includes nonprofits.

Under the bill, the PPA is required to obtain a list of all state and local elected officials that includes their contact information. The bill does not specify how the PPA will obtain this information, nor does it authorize this information to be shared by either the Secretary of State or local election officials with the PPA. Additionally, the bill requires the Judicial Council to provide the PPA a list of all California judges that includes their contact information, and provide an updated list after the appointment or election of any additional judge. The bill does not provide any confidentiality provisions to the list either obtained by the PPA or provided by the Judicial Council. Additionally the bill does not provide for consent of a protected individual to have their information sent or not sent to the PPA.

The bill provides civil liability for a business that knowingly sells the personal information of a protected individual if both of the following are true:

• • • • the business knows, or reasonably should know, that selling the personal information poses an imminent and serious threat to the protected individual; and
      • the selling of the personal information results in an assault in any degree, harassment, trespass, or malicious destruction of property.

A governmental entity is also subject to the provisions of the bill and must refrain from publishing a protected individuals personal information and remove their information from any existing publication upon a request from the protected individual or their authorized representative. A request must be made in writing by certified mail or email. Upon receipt of a request, the governmental entity must take steps to ensure the information is not published and, if already published, remove it within 72 hours. A government entity that does not comply is subject to a civil action brought by brought by a protected individual, the AG, or other public prosecutors. “Government entity” is defined as a state or local agency, including, but not limited to, a law enforcement entity or any other investigative entity, agency, department, division, bureau, board, or commission, or any individual acting or purporting to act for or on behalf of a state or local agency. This definition does not seem to encompass the Legislature. The mechanism for submitting a request under this provision lacks guardrails. First, there is no requirement for the governmental entity to verify that the requester is a protected individual. Additionally, simply allowing any government employee to receive an email and that triggering a 72-hour timeline to remove personal information is problematic. Existing law already prohibits a state or local agency from publicly posting the home address, telephone number, or both the name and assessor parcel number of any elected or appointed official on the internet without first obtaining the written permission of that individual. (Gov. Code § 7928.205.) There is no liability attached to this existing provision of law.

1. This bill raises First Amendment issues
2. First Amendment jurisprudence

The federal and state Constitutions prohibit the government from abridging the freedom of speech and the right to peaceably assemble.^[10] “The vitality of civil and political institutions in our society depends on free discussion…it is only through free debate and free exchange of ideas that government remains responsive to the will of the people and peaceful change is effective. The right to promote diversity of ideas and programs is therefore one of the chief distinctions that sets us apart from totalitarian regimes.”^[11] And “[i]f there is a bedrock principle underlying the First Amendment, it is that the government may not prohibit the expression of an idea simply because society finds the idea itself offensive or disagreeable.”^[12]

Although the First Amendment’s speech guarantee is written as an absolute, there are certain narrow categories of speech that fall outside of the First Amendment’s protections.^[13] Relevant to this analysis, these categories include:

• “True threats” of violence: “[w]hen a reasonable person would foresee that the context and import of the words will cause the listener to believe he or she will be subjected to physical violence, the threat falls outside First Amendment protection.”^[14] While the rationale behind the true threats doctrine is based on the harm to the listener—“[t]rue threats subject individuals to ‘fear of violence’ and to the many kinds of ‘disruption that fear engenders’ ”—the Court recently held that “the First Amendment precludes punishment, whether civil or criminal, unless the speaker’s words were ‘intended’ (not just likely) to produce imminent disorder.”^[15]
• Inciting imminent lawless action: a state may “forbid advocacy of the use of force or of law violation” “where such advocacy is directed to inciting or producing imminent lawless action and is likely to incite or produce such action.”^[16] The “mere abstract teaching of the moral propriety or even moral necessity for a resort to force and violence, is not the same as preparing a group for violent action and steeling it to such action.”^[17]

These doctrines have been used to uphold state laws criminalizing false bomb threats;^[18] hate speech, where the speech itself threatened violence and the speaker had the apparent ability to carry out the threat;^[19] and other threats that cause the listener to believe they will be subjected to physical violence.^[20]

“First Amendment freedoms need breathing space to survive.”^[21] “The threat of sanctions may deter their exercise almost as potently as the actual application of sanctions,”^[22] because people will necessarily give a wide berth to any speech that might run afoul of the law—which leads to the chilling of legitimate speech.^[23] As a result, prohibitions on matters that closely touch on First Amendment-protected activities must be both so clear as to clearly inform individuals as to what conduct is proscribed and so precise so as not to sweep in protected conduct.^[24]

1. Prior similar statute was held in violation of the First Amendment

Under the California Public Rerecords Act a statute was enacted to prohibit a person, business, or association from publicly posting or publicly displaying on the internet the home address or telephone number of any elected or appointed official if that official has, either directly or through an agent, made a written demand of that person, business, or association to not disclose the official’s home address or telephone number. (Gov. Code § 7928.215(b); previously Gov. Code § 6254.21(c)(1).)^[25] In 2017, this statute was challenged on several grounds, including that it violates the First Amendment of the U.S. Constitution. (Publius v. Boyer-Vine (E.D. Cal. 2017) 237 F.Supp.3d 997.) In Publius, the plaintiff, maintained a political blog and in response to the Legislature enacting gun control legislation posted the names, home addresses and phone numbers of all Legislators who voted for the legislation. (Id. at 1004.) The legislation in question required the creation of a database that would contain the driver’s license, residential address, telephone number, and date of birth of anyone who purchased or transferred ammunition in California. (Id. at 1003-04.) Shortly after the plaintiff posted the Legislator’s personally identifying information, members of the Legislature received threatening phone calls and social media messages. (Id. at 1004-05.) Representatives for the Legislature sent a written demand seeking the immediate take down of the posted information and WordPress, the blogging platform, immediately removed the blog entry. (Id. at 1005-06.)

The plaintiff brought a suit alleging several causes, including that the statute violated the First Amendment of the U.S. Constitution. The basis for enacting this provision was to protect the personal safety of covered officials and their families, which is a state interest of the highest order; however, a federal district court held that the statute violated the First Amendment’s overbreadth doctrine. (Id. at 1019.) The district court found that the statute was not narrowly tailored; and that is was both overinclusive because it prohibited publication of the information, regardless of whether the information was widely available to the public or had previously been disclosed, and underinclusive because it irrationally punished just publication on the internet but did not address other forms of publication, such as in newspapers. (Id. at 1020.)

This bill raises the same issues as highlighted in the Plubius case above. In fact, AB 1521, the Assembly Judiciary Committee civil law omnibus bill, is removing the preempted statute in the CPRA form the codes specifically because it has been found to be unconstitutional. Under this bill, a protected individual can request a business delete their personal information, subject to civil penalties for noncompliance. The term delete is not defined under the bill. Merriam Webster’s dictionary defines it as “to eliminate especially by blotting out, cutting out, or erasing.”^[26] Under the plain meaning of this statute a business would be required to erase or remove and personal information, whether from the internet or other publication, document, or writing. Some of the information included under the definition of “personal information” in the bill is a public record or readily accessible otherwise, such as birth, marital, and divorce records. Additionally, as demonstrated by the Plubius case, a statute that prohibits publication of information, regardless of whether the information was widely available to the public or had previously been disclosed, makes a statute overbroad and violative of the First Amendment. The author has noted that this bill was modeled off Daniel’s Law form New Jersey, which did survive a challenge at the New Jersey Supreme Court, but is currently being challenge on First Amendment grounds in the U.S. 3rd Circuit Court of Appeals.

1. Prior restraint

Concerns have been raised to the Committee that the fact a court could order a business to remove information under the bill essentially allows courts to issue a censorship order, which could be considered a prior restraint on speech. The courts are highly suspect of prior restraints and they bear “a heavy presumption against its constitutional validity.”^[27] Additionally, allowing an elected official to require that their place of employment not be provided to the public may raise concerns that this is infringing on a person’s right to petition the government under the First Amendment.

1. Section 230 and federal preemption issues

Section 230 of the Communications Decency Act, also known as Section 230, was enacted in 1996. Designed to prevent burgeoning internet sites from being liable for material posted by users, Section 230 (1) prohibits a website from being treated as the publisher or speaker of information provided by users, and (2) clarifies that, if a website engages in content moderation of objectionable content, it does not lose its protection under (1). Section 230 expressly preempts state law, stating that “[n]o cause of action may be brought and no liability may be imposed under any State law that is inconsistent with this section.”

This provision has been hailed as the law that created the modern internet, fostering free expression online and allowing an array of innovative services and spaces to flourish, from search engines to social media.^[28] To summarize:

For a statute that has caused so much confusion, the basic idea behind § 230 is simple. Generally speaking, the law shields websites from being held legally responsible for content that others post—a protection not available for print material or television broadcasts. If I post something defamatory about you on Twitter, for example, you can sue me, but you can’t sue Twitter.

. . .

In brief, as courts have interpreted the law, § 230 (c)(1) protects platforms from civil liability for leaving content up; § 230 (c)(2) protects them if they choose to take content down.^[29]

Relevant here, Section 230 not only provides protection against federal civil claims, but it also protects against litigation “under any State or local law that is inconsistent with this section.” This preemptive effect has kept states from meaningfully regulating in this space, absolving platforms of responsibility for virtually all third-party harms arising from the use of their services. Some advocates have argued that the bill could violate Section 230 if it places liability on a platform for not deleting information that it did not post.

1. Proposed Author Amendments

In light of the issues raised above, the author has proposed to amend the bill to remove all provisions related to businesses and governmental entities and instead require the PPA to upload an elected official’s or a judge’s information into the accessible deletion mechanism. The bill would amend the data broker registry statutes to require the PPA to obtain a list of all state and local elected officials, which is to serve as the elected official’s request to delete their information under the accessible deletion mechanism. By placing this provision in the data broker registry law, all existing definitions, exceptions, and understandings of what personal information entails will apply.

The proposed amendments require the list obtained by the PPA to include the elected official’s name and profile data as defined by the PPA. The PPA is required allow an elected official the opportunity to be removed from the list. The bill requires the Judicial Council to also provide a list to the PPA of judges and their information, and provide an opportunity to remove their name from the list before submitting it.

After receipt of the lists described above, the PPA is required to upload the lists to the accessible deletion mechanism the PPA is required to establish by January 1, 2026. (see Civ. Code § 1798.99.86.) Under the proposed amendments, an entity receiving a notification that deletion is required must do so within five days beginning August 1,2026, which is when existing law currently requires a data broker to delete information of a person registered on the accessible deletion mechanism. (see Civ. Code § 1798.99.86(d).) The proposed amendments authorize an elected official or judge, the Attorney General, a county counsel, or a city attorney to bring an action for a violation for any of the following relief: declaratory relief; injunctive relief; reasonable attorney’s fees; and actual damages. For a willful refusal to delete, punitive damages can be awarded.

Lastly, the proposed amendments provide that all information sharing is to be a secure and confidential exchange, and that the lists and the information contained therein are confidential and subject to disclosure under the California Public Records Acts. California generally recognizes that public access to information concerning the conduct of the people’s business is a fundamental and necessary right. At the same time, the state recognizes that this right must be balanced against the right to privacy. The general right of access to public records may, therefore, be limited where the Legislature finds a public policy reason necessitating the limit on access. In light of the purpose of this bill, it seems imminently reasonable to ensure that the lists and the information in the lists are not public records and are kept confidential and exchanged in a confidential manner.

A mock-up of the proposed amendments can be found at the end of this analysis.

1. Statements in opposition

The First Amendment Coalition and Freedom of the Press Foundation write in opposition, stating:

[…] AB 302 runs up against the protections of the First Amendment because it directly prohibits speech based on its content.

The Supreme Court has said that “ state action to punish the publication of truthful information seldom can satisfy constitutional standards.” “More specifically, [the Supreme Court] has repeatedly held that ‘if a newspaper lawfully obtains truthful information about a matter of public significance then state officials may not constitutionally punish publication of the information, absent a need . . . of the highest order.’” Any such law must also be narrowly tailored, meaning it is “the least restrictive means to further a compelling interest.”

In addition, the Supreme Court has held that “[c]ontent-based laws—those that target speech based on its communicative content—are presumptively unconstitutional and may be justified only if the government proves that they are narrowly tailored to serve compelling state interests.” As the Court recently confirmed, this strict scrutiny for content-based laws “is fatal in fact absent truly extraordinary circumstances.” Free Speech Coal., Inc. v. Paxton, No. 23-1122, 2025 U.S. LEXIS 2497, at *25 (Jun. 27, 2025).

Under the First Amendment, the Supreme Court has repeatedly prohibited attempts to bar or punish the publication of truthful information on matters of public concern, including when privacy interests are at stake. In Cox Broadcasting v. Cohn, for instance, the Court held that the First Amendment barred holding a newspaper civilly liable under a state statute that made it a crime to publish the name of a rape victim in order to protect the privacy of the victim and the victim’s family, citing the risk of “self-censorship” and likely “suppression of many items that would otherwise be published and that should be made available to the public.”20

In addition, a federal court in California has held that a state law that restricted publishing the home addresses and telephone numbers of certain California government officials was likely unconstitutional. In Publius v. Boyer-Vine, the Eastern District of California held that California Government Code § 6254.21(c) was a content-based restriction on speech and was not narrowly tailored in part because it made “no attempt to prohibit or prevent true threats” and because it did not “differentiate between acts that ‘make public’ previously private information and those that ‘make public’ information that is already publicly available.”21 (This statute is being repealed in AB 1521, the Assembly Judiciary Committee’s Omnibus bill.)

Although it contains an ostensible carveout for speech of public concern, AB 302 is not narrowly tailored under strict scrutiny because it is not limited to attempting to prohibit or prevent true threats. While Section 3273.79 appears to be aimed at prohibiting the sale of personal information that poses an imminent and serious threat to an individual and results in certain specified harms, the rest of the bill is not so limited. For instance, Section 3273.76 applies regardless of whether the personal information could contribute to a true threat or result in harm to a protected individual.

To the extent that AB 302 applies to personal information that has previously been made publicly available, it is not narrowly tailored. It is also not narrowly tailored because it prohibits publication of information that is not normally considered private, such as place of employment. […]

A coalition of business organizations, including the California Chamber of Commerce and TechNet, write in opposition unless amended, stating:

As drafted, AB 302 would prohibit businesses from retaining information solely used for security and integrity purposes, such as fraud prevention and consumer protection. The bill also does not include necessary exceptions for federally regulated transactions under the Gramm-Leach-Bliley Act (GLBA), Driver’s Privacy Protection Act (DPPA), Fair Credit Reporting Act (FCRA), and Health Insurance Portability and Accountability Act (HIPAA). These transactions are non-public facing and are critical for identity verification, fraud detection, and other essential services.

Personal information is routinely exchanged between businesses to fulfill contractual obligations and comply with existing regulatory requirements. These exchanges do not risk public exposure of data and include use cases such as validating identity for financial transactions or accessing government benefits. For example, information collected and processed under the FCRA or GLBA is necessary to meet legal requirements and ensure system integrity.

While we recognize the highly visible and sensitive nature of serving in public office, elected officials and appointed court officers, like all individuals, participate in financial and economic activities that require lawful data transfers—such as paying taxes, purchasing homes, or verifying insurance claims. Prohibiting the sale or

transfer of such information, even when done in compliance with federal law, would disrupt essential services and economic participation.

Additionally, requiring the deletion of records used solely for verification and fraud prevention within 72 hours of a request could degrade our members’ ability to communicate with their customers and clients. Without narrowly tailored exceptions, this bill risks unintended harm to both consumers and the businesses that serve them. […]

SUPPORT

None received

OPPOSITION

California Chamber of Commerce

California Association of Realtors

California Chamber of Commerce

California Land Title Association

Computer & Communications Industry Association

Computer and Communications Industry Association

First Amendment Coalition

Freedom of the Press Foundation

State Privacy and Security Coalition

TechCA

TechNet

Technology Industry Association of California

RELATED LEGISLATION

Pending Legislation:

AB 789 (Bonta, 2025) allows candidates for office and elected officials to use unlimited amounts of campaign funds for security purposes until January 1, 2029, and $10,000 per year thereafter. AB 789 is set to be heard in the Senate Elections and Constitutional Amendment Committee on the same day as this bill.

AB 1392 (Sharp-Collins, 2025) exempts the residence address, telephone number, and email address of a federal, state, or local elected official or candidate for an elected federal, state, or local office from being disclosed on voter rolls, as specified. AB 1392 is set to be heard in this Committee on the same day as this bill.

Prior Legislation:

SB 362 (Becker, Ch. 709, Stats. 2023), among other things, required the PPA establish an accessible deletion mechanism, as provided, that allows consumers, through a single request, to request all data brokers to delete any personal information related to the consumer, as specified.

AB 1202 (Chau, Ch. 753, Stats. 2019) established California’s data broker registry.

PRIOR VOTES

Assembly Floor (Ayes 56, Noes 11)

Assembly Appropriations Committee (Ayes 11, Noes 4)

Assembly Judiciary Committee (Ayes 9, Noes 3)

Assembly Health Committee (Ayes 12, Noes 2)

**************

MOCK-UP OF PROPOSED AUTHOR AMENDMENTS^[30]

The proposed author amendments would delete the current contents of the bill and instead add a new Section to Title 1.81.48 of the Civil Code, which will read as provided under Amendment 1.

Amendment 1

(a) (1) On or before March 1, 2026, the California Privacy Protection Agency shall obtain a list of all state and local elected officials, which shall serve as the elected official’s request to delete their information pursuant to Section 1798.99.86(b)(1). The list shall include the elected official’s name and profile data as defined by the California Privacy Protection Agency.

(2) The California Privacy Protection Agency shall provide an elected official an opportunity to request that their name and information be removed from the list.

(3) Following the certification of a final election, the California Privacy Protection Agency shall obtain a list of elected officials as provided under paragraph (1) and (2).

(b) (1) The Judicial Council shall provide the California Privacy Protection Agency with a list of all California judges, which shall serve as the judge’s request to delete their information pursuant to Section 1798.99.86(b)(1). The list shall include the judge’s name and other profile data as defined by the California Privacy Protection Agency that has been shared voluntarily by the judges.

(2) Prior to providing the list to the California Privacy Protection Agency, the Judicial Council shall provide the judge an opportunity to request that their name and information be removed from the list. The list submitted to the California Privacy Protection Agency shall only include those judges that did not request to be removed from the list.

(3) The Judicial Council shall provide an updated list after the appointment or election of any additional judge.

(c) (1) After receipt of the lists required by this section, the California Privacy Protection Agency shall upload the lists required by this section to the accessible deletion mechanism established pursuant to Section 1798.99.86.

(2) Beginning August 1, 2026, entities receiving a notification that such a deletion is required, shall do so within five days.

d) All information sharing in this section shall be a secure and confidential exchange. The lists and the information in the lists shall be confidential and not subject to disclosure under the California Public Records Act (commencing with Section 7920.000 of the Government Code).

(e) An elected official or judge who is on the list described in subdivision (a) or (b), the Attorney General, a county counsel, or a city attorney may bring an action for a violation of this section for any of the following relief:

(1) Declaratory relief.

(2) Injunctive relief.

(3) Reasonable attorney’s fees.

(4) Actual damages.

(b) In addition to the other relief provided under this section, if a court finds that an entity willfully refused to provide for deletion as required under this section, the court may award punitive damages.

Amendment 2

The Legislature finds and declares that Section 1 of this act imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:

In order to protect the confidential and private information of an elected official or judge, it is necessary that this act limit the public’s right of access to that information.

1. Steven Karnowski, et. al, The man suspected of shooting 2 Minnesota lawmakers is in custody after surrendering to the police, AP News, (June 16, 2025), available at https://apnews.com/article/minnesota-lawmakers-shot-8ce70a94c9eb90688baaa1a71faef6cc. ↑

2. Pete Simi, et. al, Rising Threats to Public Officials: A Review of 10 Years of Federal Data, Vol. 17, Issue 5, (May 2024), available at https://ctc.westpoint.edu/rising-threats-to-public-officials-a-review-of-10-years-of-federal-data/. ↑

3. KCRA Staff, 'I don't regret pushing him': Man cited for shoving California state senator, KCRA News, (Aud. 22, 2019), available at https://www.kcra.com/article/california-state-senator-richard-pan-assault/28777200. ↑

4. Meg Anderson & Avie Schneider, Suspect named in targeted shootings of Minnesota lawmakers, NPR, (Jun. 14, 2025), available at https://www.npr.org/2025/06/14/nx-s1-5433645/minnesota-state-legislators-lawmaker-shootings. ↑

5. Alfred Ng, Alleged shooter found Minnesota lawmakers’ addresses online, court docs say, Politico, (Jun. 16, 2025, available at https://www.politico.com/news/2025/06/16/alleged-shooter-found-minnesota-lawmakers-addresses-online-court-docs-say-00409260. ↑

6. Angela Hart & Colby Bermel, Protester throws apparent blood at legislators, shutting down California Senate, Politico, (Sept. 13, 2019), available at https://www.politico.com/states/california/story/2019/09/13/protester-throws-red-liquid-at-legislators-shutting-down-california-senate-1188537. ↑

7. Intimidation of State and Local Officeholders, Brennan Center for Justice, (Jan. 25, 2024), available at https://www.brennancenter.org/our-work/research-reports/intimidation-state-and-local-officeholders. ↑

8. Assessing Threats and Harassment Towards Locally Elected Officials, Joan B. Kroc School of Peace Studies, University of San Diego, available at https://www.sandiego.edu/peace/institute-for-peace-justice/violence-inequality-power-lab/san-diego-threats.php. ↑

9. Intimidation of State and Local Officeholders, Brennan Center for Justice, (Jan, 25, 2024), available at https://www.brennancenter.org/our-work/research-reports/intimidation-state-and-local-officeholders. ↑

10. U.S. Const., 1st & 14th Amends.; Cal. Const., art. I, §§ 2, 3. ↑

11. Terminiello v. City of Chicago (1949) 337 U.S. 1, 4 (1949) (Terminiello). ↑

12. Texas v. Johnson (1989) 491 U.S. 397, 414 (Johnson). ↑

13. Counterman v. Colorado (2023) 600 U.S. 66, 73. ↑

14. In re M.S. (1995) 10 Cal.4th 698, 711. ↑

15. Counterman, supra, 600 U.S. at pp. 74, 76. ↑

16. Brandenburg v. Ohio (1969) 395 U.S. 444, 447 (Brandenburg). ↑

17. Id. at p. 448 (cleaned up). ↑

18. In re J.M. (36 Cal.App.5th 668, 677-679 (speech was a true threat that fell outside First Amendment protections). ↑

19. In re M.S., supra, 10 Cal.4th at pp. 714-715. ↑

20. People v. Toledo (2001) 26 Cal.4th 221, 223. ↑

21. National Ass’n for the Advancement of Colored People v. Button (1963) 371 U.S. 415, 433 (Button). ↑

22. Ibid. ↑

23. Keyishian v. Bd. of Regents of University of State of N.Y. (1967) 385 U.S. 589, 604. ↑

24. Button, supra, 371 U.S. at p. 433. ↑

25. In 2021 the CPRA was recodified by AB 473 (Chow, Ch. 614, Stats. 2021). Prior to the recodification, the equivalent to Section 7928.215 of the Government Code was Section 6254.21(c)(1) of that code. As such, the Plubius case refers to Section 6254.21(c)(1) throughout. ↑

26. Definition of “Delete”, Merriam Webster, available at https://www.merriam-webster.com/dictionary/delete. ↑

27. Epona v. County of Ventura (9th Cir. 2017) 876 F.3d 1214, 1222. ↑

28. See e.g., Kosseff, The Twenty-Six Words that Created the Internet (2019). ↑

29. Quinta Jurecic, The politics of Section 230 reform: Learning from FOSTA’s mistakes (Mar. 1, 2022) Brookings, https://www.brookings.edu/articles/the-politics-of-section-230-reform-learning-from-fostas-mistakes. ↑

30. The amendments may also include technical, nonsubstantive changes recommended by the Office of Legislative Counsel as well as the addition of co-authors. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 302

Author:(Bauer-Kahan)

As Amended Ver:May 1, 2025

Majority vote

SUMMARY

Requires a provider of health care, health care service plan (health plan), or contractor to disclose medical information when specifically required by California law. Revises disclosure requirements relating to court orders and search warrants, as specified. Deletes existing authorizations to disclose medical information pursuant to an express authorization by a patient, enrollee, or subscribe and instead prohibits a provider of health care, health plan, contractor, or corporation and its subsidiaries and affiliates from intentionally selling medical information or using medical information for marketing.

Major Provisions

COMMENTS

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that sets national standards for protecting sensitive health information from disclosure without patient's consent. The Confidentiality of Medical Information Act (CMIA) is a state law that adds to federal law, further protecting the confidentiality of individually identifiable medical information obtained by health plans, health care providers, and their contractors. Ensuring strong privacy protections is critical to maintaining individuals' trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.

Federal law and guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. The HIPAA Rules apply only when PHI is created, received, maintained, or transmitted by covered entities and business associates.

State law. In California, protection for PHI comes from a combination of both federal and state law. HIPAA sets the baseline, but in enacting HIPAA Congress expressly provided that stronger state health privacy laws could also be enforced. Under this authority CMIA provides enhanced protections for Californian's PHI. According to the California Health Care Foundation, the legal doctrine of preemption – the overriding of state law by federal law on the same subject – is relatively simple in the area of health information privacy. Under HIPAA it is explicit that state regulations that are more protective of patient rights than HIPAA's are enforceable. For California, that means to the extent that HIPAA and CMIA provide different, but not conflicting protections, both apply. It also means that when the provisions of either law are more protective than the other's on the same matter, the more stringent rule will set the legal standard.

According to the Author

This bill ensures that patients' medical information is not being used as a commodity. Technology companies are increasingly expanding into the healthcare space by developing new communication tools using artificial intelligence. These companies rely on private medical information for marketing purposes and to train and refine their systems. Current law requires entities to obtain consent from patients regarding the use, sharing and sale of their medical information. Patients are often asked to consent without being provided a clear understanding of what they are giving permission for. This bill updates the CMIA in two important ways. First, it removes an exemption that allows health care entities to share or sell medical information for purposes other than to provide health care services to patients, if they obtain consent from the patient and prohibits the disclosure of medical information regarding a patient to any entity that is not engaged in providing direct health care services. Second, the bill also updates the exemptions to information sharing by prohibiting the sharing of medical information with a court or law enforcement entity outside of California unless they have either obtained a California court order or have a court order that does not contradict California's laws.

Arguments in Support

Oakland Privacy supports this bill, stating that California has been engaged in an ongoing process to protect Californians and visitors to the state who are engaging in activities legal under California law that have been criminalized in other states and sometimes by federal authorities. Oakland Privacy continues that among those activities are some medical procedures including the medical termination of pregnancy, or abortion, and gender-affirming medical care. Oakland Privacy notes that it is possible that other medical procedures will also become subject to divergences between California law and the laws of other states. Oakland Privacy continues that when that happens, it is important that state law clearly indicate what is to happen when other jurisdictions try to enforce their laws outside their boundaries. Oakland Privacy states that this bill also relates to the complex question of consumer consent. Oakland Privacy contends that the long privacy policies to which we are all subjected are supposed to explain what people need to know for meaningful consent, but the length, frequency and legal jargon of such documents has caused them to largely fail at that purpose. Oakland Privacy states that people just don't read them. Oakland Privacy continues that with all of the factors in play, sometimes the simple yes/no I consent/I don't consent checkbox is simply not sufficient to empower people to protect themselves. Oakland Privacy concludes that at a minimum, we should ensure that consent processes are maximally robust and that it is made clear to people when they are getting medical care that they do not have to grant consent and that their medical care will not be delayed or impaired if they withhold consent.

Arguments in Opposition

TechNet is opposed to this bill, stating that California has historically led the nation in safeguarding privacy while preserving individual agency. TechNet continues that the California Consumer Privacy Act (CCPA) and its enhancement under the California Privacy Rights Act (CPRA) enshrine a clear principle: consumers should have the right to opt in or opt out of sharing or selling their personal data. TechNet states that these laws empower individuals with meaningful choices, including the ability to allow the use of their information when they see the benefit. TechNet argues that without rationale, this bill contradicts these principles by eliminating CMIA's robust consent mechanism for medical information in a wide array of contexts. Where CCPA, CPRA, and HIPAA reinforce autonomy, this bill overrides it, denying

Californians the opportunity to choose how their health data is used, even when doing so would improve their care, access to services, or health outcomes.

FISCAL COMMENTS

According to the Assembly Appropriations Committee there are no state costs.

VOTES

ASM HEALTH: 12-2-2

YES: Bonta, Addis, Aguiar-Curry, Rogers, Carrillo, Mark González, Krell, Patel, Celeste Rodriguez, Schiavo, Sharp-Collins, Stefani

NO: Patterson, Sanchez

ABS, ABST OR NV: Chen, Flora

ASM JUDICIARY: 9-3-0

YES: Kalra, Bauer-Kahan, Bryan, Connolly, Harabedian, Pacheco, Papan, Stefani, Zbur

NO: Dixon, Macedo, Sanchez

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

NO: Sanchez, Dixon, Ta, Tangipa

UPDATED

VERSION: May 1, 2025

CONSULTANT: Riana King / HEALTH / (916) 319-2097 FN: 0000412

Date of Hearing: May 14, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 302

Author:(Bauer-Kahan) – As Amended Ver:May 1, 2025

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill places several limits on the disclosure of medical information by health care providers and related entities.

Specifically, this bill:

1. Requires a health care provider, health plan, or contractor to disclose medical information only if the disclosure is compelled by the following:
   1. A court order issued by a California state court, including an order relating to a foreign subpoena.
   2. A search warrant lawfully issued to a governmental law enforcement agency, including a warrant from another state if based on another state’s law that does not interfere with California law, including the Reproductive Privacy Act, and execution of the search warrant would not constitute a violation of the limitations on state and local law enforcement cooperation with the enforcement of the laws of other states.
2. Clarifies that a health care provider, health plan, or contractor must not comply with a court order that constitutes a foreign subpoena absent a court order issued by a California state court.
3. Prohibits a health care provider, health plan, contractor, or corporation and its subsidiaries and affiliates from intentionally selling medical information or using medical information for marketing.
4. Defines certain terms for the purposes of this bill.

FISCAL EFFECT:

No state costs.

COMMENTS:

Purpose. According to the author, in our current climate where personal freedoms, particularly related to reproductive care and gender affirming care are constantly under threat, personal data privacy has become a key mechanism for defending access to health care in California. The author argues that while California has made significant progress towards creating strong protections for these rights, there are still important ways that we must shore up individual’s medical information against current and future threats. The author concludes this bill brings the California Medical Information Act (CMIA) medical privacy protections up to date to ensure that patients’ medical information is not being used as a commodity.

Analysis Prepared by: Allegra Kim / APPR. / (916) 319-2081

Date of Hearing: April 29, 2025

ASSEMBLY COMMITTEE ON JUDICIARY

Ash Kalra, Chair

ABPCA Bill Id:AB 302

Author:(Bauer-Kahan) – As Introduced Ver:January 23, 2025

As Proposed to be Amended

SUBJECT: Confidentiality of Medical Information Act

KEY ISSUE: IN ORDER TO PREVENT THE POTENTIALLY HARMFUL DISCLOSURE OF MEDICAL INFORMATION, SHOULD STATE LAW ENSURE THAT (1) ONLY A COURT ORDER ISSUED OR VALIDATED BY A CALIFORNIA STATE COURT CAN COMPEL DISCLOSURE OF MEDICAL RECORDS; (2) PROVIDERS OF HEALTHCARE DO NOT SELL MEDICAL INFORMATION FOR MARKETING PURPOSES; AND (3) UNLESS EXPRESSLY AUTHORIZED BY THE PATIENT, PROVIDERS DO NOT DISCLOSE MEDICAL INFORMATION TO ANYONE WHO IS NOT ENGAGED IN PROVIDING DIRECT HEALTHCARE SERVICES?

SYNOPSIS

As a result of the U.S. Supreme Court overturning Roe v. Wade, and a series of state laws that have functionally outlawed abortion, millions of Americans cannot access needed healthcare in their own states, and therefore must travel to states such as California in order to receive vital medical treatments. Seeking to limit the effect of overreach of these extreme states, California has enacted numerous laws in recent years that limit disclosure of both medical information about patients who receive sensitive medical services, including abortion care and gender-affirming care, and also information about the medical provider who provides the service. One such law was enacted by AB 2091 (Bonta), Chap. 628, Stats. 2022, which prohibited the validation of foreign (i.e. out-of-state) subpoenas pertaining to some out-of-state laws that are considered “foreign penal civil actions” and prohibited the sharing of specified information in response to subpoenas related to out-of-state anti-abortion statutes or foreign penal civil actions.

This author-sponsored bill makes several important changes and clarifications to existing law in order to avoid potentially harmful and unintentional disclosures of health information. First, it specifies which type of court order mandates a provider of health care to release medical information in response to a court order. Second, it prohibits a provider of healthcare from selling a patient’s medical information for marketing purposes. Third, it prohibits a provider of medical care from disclosing medical information to a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health care service plan or insurer or self-insured employer, unless expressly authorized by the patient to do so.

The bill was recently heard and passed (as proposed to be amended) by the Assembly Committee on Health (with amendments) by a vote of 12-2 (with two members not voting). To expedite the bill reaching this Committee, the Health Committee amendments will be taken in this Committee. The author proposes an additional series of amendments to strengthen and clarify the current wording of the bill. The amendments (including those taken in the Health Committee) are incorporated into the bill SUMMARY, below, and the amendments to be taken in this Committee are explained in the analysis.

The bill is supported by a number of organizations advocating for health access and privacy. It is opposed by TechNet and Our Duty. Two organizations, ATA Action and the California Hospital Association, write in opposition to the bill, unless it is amended. Both organizations express concern about the limitations that the bill in print places on the ability of a patient to consent to the disclosure of their medical information. Given that the amendments taken in the Health Committee are not yet in print, but attempt to address these issues, it is unclear whether the concerns of these groups have been addressed and whether they remain opposed to the bill.

SUMMARY: Places several limits on the disclosure of medical information by providers of healthcare. Specifically, this bill:

1. Requires a provider of health care, health plan, or contractor to disclose medical information only if the disclosure is compelled by the following:
   1. A court order issued by a California state court;
   2. A court order issued by a California state court relating to a foreign subpoena;
   3. A search warrant lawfully issued to a governmental law enforcement agency, including a warrant from another state based on another state’s law so long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act and execution of the search warrant would not constitute a violation of the limitations on state and local law enforcement cooperation with the enforcement of the laws of other states pursuant to existing law.
2. Clarifies that a provider of health care, health care service plan, or contractor shall not comply with a court order that constitutes a foreign subpoena absent a court order issued pursuant to the process described in 1b), above.
3. Prohibits a provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates from intentionally selling medical information or using medical information for marketing.
4. Provides that, except to the extent expressly authorized by a patient or enrollee or subscriber or as provided by existing law, a contractor or corporation and its subsidiaries and affiliates shall not further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health care service plan or insurer or self-insured employer.
5. Defines the following for purposes of the bill:
   1. “Court order” means a document, however denominated, and including a subpoena, issued under authority of a court of record requiring a person to do any of the following:
      1. Attend and give testimony at a deposition.
      2. Produce and permit inspection, copying, testing, or sampling of designated books, documents, records, electronically stored information, or tangible things in the possession, custody, or control of the person.
      3. Permit inspection of premises under the control of the person.
   2. “Foreign penal civil action” has the same meaning as provided in subdivision (b) of Section 2029.200 of the Code of Civil Procedure.
   3. “Foreign subpoena” means a subpoena or other court order issued under authority of a court of record of a foreign jurisdiction.

EXISTING LAW:

1. Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (Title 45, Code of Federal Regulations § 164.500 et seq.)
2. Prohibits, under the Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civil Code Section 56 et seq.)
3. Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. (Civil Code Section 56.05 (i).)
4. Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civil Code Section 56.10 (a).)
5. Prohibits a provider of health care, health care service plan, contractor, or employer from releasing medical information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act or a foreign penal civil action. (Civil Code Section 56.108 (a).)
6. Prohibits a provider of health care, health care service plan, contractor, or employer from releasing medical information that would identify an individual or that is related to an individual seeking or obtaining an abortion to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited by 5):
   1. Enforcement of another state’s law that would interfere with a person’s rights under the Reproductive Privacy Act.
   2. Enforcement of a foreign penal civil action. (Civil Code Section 56.108 (b).)
7. Prohibits a provider of health care, health care service plan, contractor, or employer from cooperating with any inquiry or investigation by, or provide medical information to, any individual, agency, or department from another state or, to the extent permitted by federal law, to a federal law enforcement agency that would identify an individual and that is related to an individual seeking or obtaining an abortion or abortion-related services that are lawful under the laws of this state, unless the request for medical information is authorized under Section 56.110. (Civil Code Section 56.108 (c).)
8. Clarifies that 5) – 7) do not prohibit compliance with the investigation of activity that is punishable as a crime under the laws of this state. (Civil Code Section 56.108 (d).)
9. Defines the following for purposes of the Interstate and International Depositions and Discovery Act set forth in Sections 2029.100 - 2029.900 of the Code of Civil Procedure:
   1. “Foreign penal civil action” means a civil action authorized by the law of a state other than this state in which the sole purpose is to punish an offense against the public justice of that state. (Code of Civil Procedure Section 2029.200 (b).)
   2. “Foreign subpoena” means a subpoena issued under authority of a court of record of a foreign jurisdiction. (Id., at (c).)
   3. “Subpoena” means a document, however denominated, issued under authority of a court of record requiring a person to do any of the following:
      1. Attend and give testimony at a deposition.
      2. Produce and permit inspection, copying, testing, or sampling of designated books, documents, records, electronically stored information, or tangible things in the possession, custody, or control of the person.
      3. Permit inspection of premises under the control of the person. (Id., at (f).)
10. Establishes the Reproductive Privacy Act, which provides that the state cannot deny or interfere with a women's right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the woman, and makes legislative findings and declarations that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, and that every woman has the fundamental right to choose to bear a child or to choose and to obtain an abortion, as specified. (Health & Safety Code 123460 et seq.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: This author-sponsored bill makes several important changes and clarifications to existing law in order to avoid potentially harmful and unintentional disclosures of health information. First, it specifies which type of court order mandates a provider of health care to release medical information in response to a court order; second, it prohibits a provider of healthcare from selling a patient’s medical information for marketing purposes. Third, it prohibits a provider of medical care from disclosing medical information to a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health care service plan or insurer or self-insured employer, unless expressly authorized by the patient to do so. According to the author:

AB 302 brings the California Medical Information Act (CMIA) medical privacy protections up to date to ensure that patients’ medical information is not being used as a commodity.

. . .

AB 302 updates the CMIA in two important ways. It limits the use of medical information for marketing purposes. In addition, it prohibits a contractor, corporation, and its subsidiaries from disclosing medical information regarding a patient to any entity that is not engaged in providing direct health care services to the patient. Secondly, AB 302 updates the exemptions to information sharing by prohibiting the sharing of medical information with a court or law enforcement entity outside of California unless they have either obtained a California court order or have a court order that does not contradict California’s laws.

The bill was recently heard and passed (as proposed to be amended) by the Assembly Committee on Health (with amendments) by a vote of 12-2 (with two members not voting). To expedite the bill reaching this Committee, the Health Committee amendments – which are incorporated into items 3) and 4) of the bill SUMMARY, above and included verbatim, below – will be processed in this Committee. Issues regarding a patient’s ability to consent to the release of their medical information are in the jurisdiction of the Health Committee and are thoroughly analyzed in the Health Committee’s analysis of this bill. Therefore, this analysis will focus on the first issue: the enforceability of court orders in California, including orders issued by courts in other states.

The inspiration for this bill. This bill is reportedly based on a personal experience that the author had with a consent/release form that she was presented to sign at her child’s pediatrician’s office. The author observes that patients (or their parents) may not have all of the information they need to meaningfully consent to the release of their confidential medical information, especially given the proliferation of artificial intelligence (AI) in the health care field. According to the author, technology companies rely on private medical information for marketing and for training and refining their AI systems, among other non-medical purposes. While current law requires entities to obtain consent from patients regarding the disclosure of their medical information, patients are asked to consent without being provided a clear understanding of the consequences of their consent. The author reasonably argues that it is important to balance the development of tools designed to improve patient care with the need to keep the information shared between patients and medical providers confidential.

According to the author, in our current climate where personal freedoms, particularly related to reproductive care and gender affirming care are constantly under threat, personal data privacy has become a key mechanism for defending access to health care in California. While California has made significant progress towards creating strong protections for these rights, there are still important ways that we must shore up individual’s medical information against current and future threats.

Background - existing protections against the unauthorized disclosure of health care information and California-specific limits on the disclosure of sensitive patient information in response to out-of-state court orders. HIPAA is a federal law that sets national standards for protecting sensitive health information from disclosure without patient’s consent. HIPAA protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). According to the Assembly Committee on Health, HIPAA allows states to strengthen protections of private health information under state law; but preempts state efforts to weaken it. HIPAA expressly grants individuals the right to direct the transmission of their information to other people or entities.

The Confidentiality of Medical Information Act (CMIA) is a state law that adds to federal law, further protecting the confidentiality of individually identifiable medical information obtained by health plans, health care providers, and their contractors. Ensuring strong privacy protections is critical to maintaining individuals’ trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.

The United States Supreme Court’s decision in Dobbs v. Jackson Women’s Health Org. (2022) 141 S. Ct. 2619, represented the first time the Court has ever revoked a previously held constitutional right. In the wake of that radical decision, dozens of states have moved to prohibit abortion and enact a series of draconian measures seeking to punish those who seek safe and reliable healthcare in other states. Similarly, fueled by the never-ending need to gain an advantage in this nation’s culture wars, many of those same states are passing legislation to prohibit their residents from being able to access gender affirming healthcare. As a result, millions of Americans cannot access needed healthcare in their own states, and therefore must travel to states such as California in order to receive vital medical treatments. Even more troubling, many of these states have now adopted laws targeting doctors who provide care to their residents outside their jurisdiction, or sought to punish persons who assist patients who need to leave their home state, where vital healthcare is not offered, in order to obtain the care in another state, where they can obtain it.

Seeking to limit the effect of overreach of these extreme states, California has enacted numerous laws in recent years (see below) that limit disclosure of both medical information about patients who receive sensitive medical services, including abortion care and gender-affirming care, and also information about medical providers who provide it. These include legislative measures to limit the enforceability of some out-of-state court orders and subpoenas within the state. In 2022, as a result of AB 2091 (Bonta), Chap. 628, Stats. 2022, California prohibited the validation of foreign subpoenas pertaining to a foreign penal civil action and prohibited the sharing of specified information in response to subpoenas related to out-of-state anti-abortion statutes or foreign penal civil actions. A foreign penal action is defined as “a civil action authorized by the law of a state other than this state in which the sole purpose is to punish an offense against the public justice of that state.” (Code of Civil Procedure Section 2029.200 (b).) While the process outlined in 2029.200 of the Code of Civil Procedure for issuance of a California court order that effectuates enforcement of a court order or subpoena issued outside of California, as a result of AB 2091, that process is inapplicable to enforce a foreign penal action in California. For criminal cases, the author’s 2022 bill, AB 1242 (Bauer-Kahan), Chap. 627, Stats. 2022, prohibits law enforcement from cooperating with, or providing information to, out-of-state entities regarding any abortion that is lawful under California law.

The process for enforcing of out-of-state court orders in California. Existing law provides a process for states outside of California to obtain information and depose individuals in California by obtaining a subpoena issued under the Interstate and International Depositions and Discovery Act. (Code of Civil Procedure Section 2029.100 et seq.) This act, a version of which has been adopted by 43 states, enumerates two processes whereby out-of-state litigants may take depositions and obtain discovery from individuals and entities located in California. One process entails obtaining a subpoena from the clerk of a superior court. The out-of-state party must submit a subpoena issued under the authority of a court or record in their state (a “foreign subpoena”) to the clerk of the superior court in the county in which discovery is sought to be conducted, complete an application, and pay a fee. The clerk must then promptly issue a subpoena containing the terms used in the foreign subpoena and other specified information. Alternatively, if an out-of-state party retains an attorney who is licensed to practice in California and is an active member of the State Bar, the attorney may issue a subpoena upon receipt of a foreign subpoena. As in the first process, this subpoena must incorporate the terms of the foreign subpoena and contain other specified information.

This bill proposes to limit the ability for California courts to enforce subpoenas issued by out-of-state courts. Because subpoenas are judicial actions, a limit to their enforcement implicates the provisions of the Full Faith and Credit Clause found in Article IV, Section 1 of the United States Constitution. The clause reads: “full faith and credit must be given in each state to the public acts, records, and judicial proceedings of every other state, and that the United States Congress may by general laws prescribe the manner in which such acts, records and proceedings must be proved, and the effect thereof.” (U.S. Const. art. IV, sec. 1.) As it pertains to judicial proceedings, dating back to 1813, the United States Supreme Court has generally held that one state must recognize and enforce the judicial determination of another state. (Mills v. Duryee (1813) 7 Cranch 481, 484-485.) However, the United States Supreme Court has surmised that states are not necessarily required to enforce civil judgments rendered based on another state’s civil statute if the judgment is aimed at punishing a person for an offense against the “public justice” of that state. (Huntington v Attrill (1892) 146 U.S. 657, 673-674.) In other words, if another state’s civil laws are essentially disguised criminal laws, or penal laws, the Supreme Court has suggested that if a civil statute was “intended as a punishment for doing any acts forbidden,” then another state may have the ability to refuse to enforce the judgment. (Id. at 664.) Although the Supreme Court has never deemed a state law to be a “penal statute” the Huntington decision was just the first of a series of cases in which the court did examine whether or not a statute was aimed at civilly punishing a party for violating the “public justice.” (See Milwaukee County v. M. E. White Company (1935) 296 U.S. 268.)

One such out-of-state statute is Texas’ SB 8, the fetal “heartbeat” law. When examining statutes like the Texas fetal “heartbeat” law, one can indeed see the “penal” nature of those statutes. For example, the statute requires no showing of an individual harm on the part of the plaintiff which is generally required for a civil action, and the statute confers standing on any person so long as they are not an agent of Texas state or local government, even if they have no relation to any of the parties involved in a woman receiving or attempting to receive an abortion. In this case, the person is basically acting as a vigilante. Indeed, some of the strongest evidence that the Texas “fetal heartbeat” law is a penal statute masquerading as private civil action comes from the very man who drafted the bill, John Seago, the legislative director of Texas Right to Life, a sponsor of the Texas measure. In an interview in The Atlantic magazine, Mr. Seago stated the following in response to a question about the novel legal approach employed by the bill:

“There are two main motivations. The first one is lawless district attorneys that the pro-life movement has dealt with for years. In October, district attorneys from around the country publicly signed a letter saying they will not enforce pro-life laws. They said that even if Roe v. Wade is overturned, they are not going to use resources holding the abortion industry to account. That shows that the best way to get a pro-life policy into effect is not by imposing criminal penalties, but civil liability.” (Green, What Texas Abortion Foes Want Next (Sept. 2021) The Atlantic, available at https://www.theatlantic.com/politics/archive/2021/09/texas-abortion-ban-supreme-court/619953/.)

Mr. Seago’s own acknowledgement that district attorneys, and other state actors, are the traditional enforcers of criminal abortion laws highlights the penal nature of abortion statutes, and makes clear that the Texas statute is designed to enact a punishment while avoiding state enforcement that he perceives as too weak. Furthermore, by highlighting the perceived weakness of state officials, Mr. Seago suggests the Texas law deputizing private persons to enforce the public justice will result in greater enforcement actions against abortion providers, even if those private persons have no cognizable personal injury or suffer no violation of their personal rights.

Sadly, laws like SB 8 that effectively police behavior, seeking to outlaw abortion or gender-affirming care by authorizing private rights of action, have proliferated. In order to protect California residents from being targeted by these laws, it is reasonable to consider such statutes as “foreign penal civil actions”. AB 2091 introduced and defined the term “foreign penal civil action”; and now prohibits the issuance of state subpoenas validating pursuant to the Interstate and International Depositions and Discovery Act, a foreign subpoena based on such an action. (See Code of Civil Procedure Section 2029.100 et seq.) Given that California can credibly argue that SB 8 and its progeny are purely penal in nature, in keeping with the Supreme Court’s indication that a state need not enforce judgements from penal statutes, California has opted to refuse to validate a foreign subpoena issued in civil actions arising under those laws. As a result of AB 2091 (and the other bills listed below), Californians are largely protected from the whims and overreach of out-of-state legislators and their desire to regulate the conduct of Californians through overly broad civil actions.

This bill requires that health care providers disclose health care information in response to only specified court orders. The bill amends Civil Code Section 56.10, one of several statutes in existing law that address disclosure of medical information by a provider of health care, health care service plan, or contractor. Subdivision (b) of Section 56.10 provides that, “A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:” [with emphasis added]. It then goes on to list a number of conditions, including in paragraph (1), “A court order.” Given how California has clarified and strengthened its laws regarding disclosure of sensitive health information in recent years, this wording may not be sufficiently specific. The bill in print attempts to clarify and strengthen the wording by augmenting the language as follows:

(1) A California state court order. pursuant to an order of that court or a court order from another state based on another state’s law so long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

The wording is confusing and fails to acknowledge both the requirement that, pursuant to the Interstate and International Depositions and Discovery Act (Code of Civil Procedure Section 2029.100 et seq.), foreign court orders must be validated by a California court to be enforceable in California and the limit to issuance of “foreign penal civil actions” enacted by AB 2091.

The bill leaves in place, but proposes to amend, another condition under which a provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled: paragraph (6) of subdivision (b) of Section 56.10, which currently reads as follows:

(6) A search warrant lawfully issued to a governmental law enforcement agency.

The bill in print proposes to modify the language as follows:

(6) A search warrant lawfully issued to a governmental law enforcement agency, including a warrant from another state based on another state’s law so long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

While this language is helpful to limit the application of paragraph (6) in order to reflect some of the limitations on law enforcement cooperation with enforcement of the laws of other states that conflict with California’s public policies, it does not reflect all of them, including the limits imposed by the author’s own AB 1242 (Bauer-Kahan), Chap.627, Stats. 2022. As a result of that measure being signed into law and amending Section 13778.2 of the Penal Code, California’s state and local law enforcement agencies are prohibited from, among other things, cooperating with, or providing information to, out-of-state entities regarding a lawful abortion under California law, and from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion.

Finally, the bill in print proposes to amend paragraph (9) of Section 56.10, a catch-all for conditions under which a provider of health care, a health care service plan, or a contractor shall disclose medical information, which currently reads: “(9) When otherwise specifically required by law.” The bill in print would modify this language so that its mandate would be limited to the following: “(9) When otherwise specifically required by California law.” Given the supremacy of federal laws over state laws, this addition – while well-intentioned – probably is inappropriate. In a case where federal law required medical information to be disclosed, a state law could not prohibit compliance with such a law. And given that enforcement with out-of-state laws is thoroughly addressed by the bill (and other laws), the addition of “California” in paragraph (9) is unnecessary.

Author’s amendments. In order to address the issues discussed above, the author proposes to amend Section 1 of the bill as follows:

56.10. (a) A provider of health care, health care service plan, or contractor shall not disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization, except as provided in subdivision (b) or (c).

(b) A provider of health care, a health care service plan, or a contractor shall disclose medical information if the disclosure is compelled by any of the following:

1. (A) (i) A court order issued by a California state court pursuant to an order of that court.

(ii) A court order issued by a California state court pursuant of Section 2029.300 of the Code of Civil Procedure, relating to a foreign subpoena.

(B) A provider of health care, health care service plan, or contractor shall not comply with a court order that constitutes a foreign subpoena as defined in Section 2029.200 of the Code of Civil Procedure absent a court order issued pursuant to Section 2029.300 of the Code of Civil Procedure.

, a court order from another state based on another state’s law so long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).

. . .

(6) A search warrant lawfully issued to a governmental law enforcement agency, including a warrant from another state based on another state’s law so long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code) and execution of the search warrant would not constitute a violation of Section 13778.2 of the Penal Code.

. . .

(9) When otherwise specifically required by California law.

The bill also adds definitions for the following terms as they are defined for purposes of the bill as they are defined in Section 2029.200 of the Code of Civil Procedure:

• • • 1. “Court order.”
      2. “Foreign penal civil action.”
      3. “Foreign subpoena.”

Health Committee amendments (to subdivisions (d) and (e) of Civil Code Section 56.10 read as follows:

(d) Except as provided by subdivisions (b) and (c), A provider of health care, health care service plan, contractor, or corporation and its subsidiaries and affiliates shall not intentionally share, sell medical information or use medical information for marketing., or otherwise use medical information for a purpose not necessary to provide health care services to the patient.

(e) Except to the extent expressly authorized by a patient or enrollee or subscriber or as provided by subdivisions (b) and (c), a contractor or corporation and its subsidiaries and affiliates shall not further disclose medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan or insurer or self-insured employer received under this section to a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health care service plan or insurer or self-insured employer.

Additional amendments requested by stakeholders. Two organizations, ATA Action and the California Hospital Association, write in opposition to the bill, unless it is amended. Both organizations express concern about the limitations that the bill in print places on the ability of a patient to consent to the disclosure of their medical information. Given that the amendments taken in the Health Committee are not yet in print, but attempt to address these issues, it is unclear whether the concerns of these groups have been addressed and whether they remain opposed to the bill.

Prior Legislation: SB 487 (Atkins), Chap. 261, Stats. 2023, prohibited health plans and health insurers from terminating, discriminating against, or otherwise penalizing a provider based on a civil judgment, criminal conviction, or another disciplinary action in another state if the judgment, conviction, or disciplinary action is solely based on the application of another state’s law that interferes with a person’s right to receive care that would be lawful if provided in California, among other provisions.

SB 345 (Skinner), Chap. 260, Stats. 2023, enacted various safeguards against the enforcement of other states’ laws that prohibit, criminalize, sanction, authorize civil liability against, or otherwise interfere with a person, provider, or other entity in California that offers reproductive health care services or gender-affirming health care services.

AB 1707 (Pacheco), Chap. 258, Stats. 2023, protected licensed health care professionals, clinics, and health facilities from being denied a license or subjected to discipline on the basis of a civil judgment, criminal conviction, or disciplinary action imposed by another state based solely on the application of a law that interferes with a person's right to receive sensitive services that would be lawful in California.

AB 352 (Bauer-Kahan), Chap. 255, Stats. 2023, required specified businesses that electronically store or maintain medical information on the provision of sensitive services, as specified, on or before July 1, 2024, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services, and contraception, among other provisions.

AB 254 (Bauer-Kahan), Chap. 254, Stats. 2023, prohibited businesses that provide digital health services from intentionally sharing, selling, and/or otherwise using users' medical information for any purpose not necessary to provide health care services to the user, among other provisions.

SB 107 (Wiener), Chap. 810, Stats. 2022, enacted various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California.

AB 2091 (Bonta), Chap. 628, Stats. 2022, prohibited providers, health care service plans, contractors, employers from releasing medical information related to abortion services or information related to a person allowing a minor to receive gender-affirming health care and gender-affirming mental health care in response to a subpoena/investigation-related request seeking to impose liability under another state's law for an abortion lawful in CA or for allowing a minor to receive gender-affirming health care and gender-affirming mental health care, among other provisions.

AB 1242 (Bauer-Kahan), Chap. 627, Stats. 2022, prohibited law enforcement from cooperating with, or providing information to, out-of-state entities regarding a lawful abortion under California law, and from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion, and prohibited specified corporations from providing information to out-of-state entities regarding an abortion that is lawful under California law, except as specified.

AB 1666 (Bauer-Kahan), Chap. 42, Stats. of 2022, prohibited California courts from applying another state's laws authorizing civil action for receiving, seeking, providing, and/or aiding abortion in deciding the cases before them or from enforcing civil judgments under those laws, and thus designates those laws contrary to California public policy, among other provisions.

ARGUMENTS IN SUPPORT: The American College of Obstetricians and Gynecologists (ACOG) District IX writes in support of the bill, saying that it “strengthens patient privacy protections under the Confidentiality of Medical Information Act (CMIA) by tightening the circumstances under which medical records may be disclosed, especially in the context of increasing threats to reproductive and gender-affirming care.” Their letter of support continues:

As physicians who provide essential reproductive health services, we are especially concerned about the growing misuse of patient health information by entities in other states seeking to criminalize or penalize care that is legal and protected in California. AB 302 addresses this vulnerability by clarifying that disclosure of medical information may only occur when compelled under California law or by a court or warrant from another state only if that request does not conflict with California’s public policy and legal protections. The bill also protects medical information from being disclosed for purposes unrelated to direct care, ensuring that sensitive information cannot be exploited for marketing or third-party interests.

Protecting the confidentiality of medical records is fundamental to the physician-patient relationship. Without such protection, patients may delay or forgo necessary care out of fear that their private health information could be used against them.

ARGUMENTS IN OPPOSITION: TechNet characterizes the bill as a “a step backward from California’s privacy legacy,” writing:

Currently, disclosure of medical information is permitted only when the detailed

requirements of the CMIA's robust authorization process are met[.]

. . .

Without rationale, AB 302 contradicts these principles by eliminating CMIA’s robust

consent mechanism for medical information in a wide array of contexts. Where

CCPA, CPRA, and HIPAA reinforce autonomy, AB 302 overrides it, denying

Californians the opportunity to choose how their health data is used, even when

doing so would improve their care, access to services, or health outcomes.

REGISTERED SUPPORT / OPPOSITION:

Support

American College of Obstetricians & Gynecologists - District Ix
California State Association of Psychiatrists (CSAP)
Oakland Privacy
Privacy Rights Clearinghouse

Opposition

ATA Action (unless amended)

California Hospital Association (unless amended)

Our Duty
TechNet-Technology Network

Two Individuals

Analysis Prepared by: Alison Merrilees / JUD. / (916) 319-2334

Date of Hearing: April 22, 2025

ASSEMBLY COMMITTEE ON HEALTH

Mia Bonta, Chair

ABPCA Bill Id:AB 302

Author:(Bauer-Kahan) – As Introduced Ver:January 23, 2025

SUBJECT: Confidentiality of Medical Information Act.

SUMMARY: Requires a provider of health care, health care service plan (health plan) or contractor to disclose medical information when specifically required by California law. Revises disclosure requirements relating to court orders and search warrants, as specified. Deletes existing authorizations to disclose medical information pursuant to an express authorization by a patient, enrollee, or subscriber. Specifically, this bill:

1. Requires a provider of health care, health plan, or contractor to disclose medical information if the disclosure is compelled by:
   1. A California state court pursuant to an order of that court or a court order from another state based on another state’s law, as long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act;
   2. A search warrant lawfully issued to a governmental law enforcement agency, including a warrant from another state based on another state’s law, as long as that law does not interfere with California law, including, but not limited to, the Reproductive Privacy Act; or,
   3. When otherwise specifically required by California law.
2. Deletes exceptions allowing disclosure of medical information pursuant to an express authorization by a patient, enrollee, or subscriber under the following conditions:
   1. To share, sell, use for marketing, or otherwise for a purpose not necessary to provide health care services to the patient; or
   2. To a person or entity that is not engaged in providing direct health care services to the patient or the patient’s provider of health care or health plan or insurer or self-insured employer.

EXISTING LAW:

1. Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA covered entity may not condition the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. [Title 45, Code of Federal Regulations § 164.500, et. seq.]
2. Prohibits, under the Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. [Civil Code (CIV) § 56, et. seq.]
3. Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health app information, mental or physical condition, or treatment. [CIV § 56.05(i)]
4. Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. [CIV § 56.10(a)]
5. Establishes the Reproductive Privacy Act, which provides that the state cannot deny or interfere with a women's right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the woman, and makes legislative findings and declarations that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, and that every woman has the fundamental right to choose to bear a child or to choose and to obtain an abortion, as specified. [Health & Safety Code 123460 et seq.]

FISCAL EFFECT: Unknown. This bill has not yet been analyzed by a fiscal committee.

COMMENTS:

1. PURPOSE OF THIS BILL. According to the author, this bill ensures that patients’ medical information is not being used as a commodity. The author states that technology companies are increasingly expanding into the healthcare space by developing new communication tools using artificial intelligence. The author continues that these companies rely on private medical information for marketing purposes and to train and refine their systems. The author notes that current law requires entities to obtain consent from patients regarding the use, sharing and sale of their medical information. The author argues that patients are often asked to consent without being provided a clear understanding of what they are giving permission for. The author states that this bill updates the CMIA in two important ways. First, it removes an exemption that allows health care entities to share or sell medical information for purposes other than to provide health care services to patients, if they obtain consent from the patient and prohibits the disclosure of medical information regarding a patient to any entity that is not engaged in providing direct health care services. Second, the bill also updates the exemptions to information sharing by prohibiting the sharing of medical information with a court or law enforcement entity outside of California unless they have either obtained a California court order or have a court order that does not contradict California’s laws.
2. BACKGROUND. HIPAA is a federal law that sets national standards for protecting sensitive health information from disclosure without patient’s consent. CMIA is a state law that adds to federal law, further protecting the confidentiality of individually identifiable medical information obtained by health plans, health care providers, and their contractors. Ensuring strong privacy protections is critical to maintaining individuals’ trust in their health care providers and willingness to obtain needed health care services, and these protections are especially important where very sensitive information is concerned, such as mental health and reproductive health information.
   1. Federal law and guidance. According to the U.S. Department of Health and Human Services Agency (HHSA), the HIPAA protects the privacy and security of medical and other health information when it is transmitted or maintained by covered entities (health plans, most health care providers, health care clearinghouses) and business associates (people and companies that provide certain services for covered entities). This information is referred to as protected health information (PHI), and it includes individually identifying information, such as name, address, age, social security number, and location, as well as information about health history, any diagnoses or conditions, current health status, and more. The HIPAA Rules apply only when PHI is created, received, maintained, or transmitted by covered entities and business associates.
   2. State law. In California, protection for PHI comes from a combination of both federal and state law. HIPAA sets the baseline, but in enacting HIPAA Congress expressly provided that stronger state health privacy laws could also be enforced. Under this authority CMIA provides enhanced protections for Californian’s PHI. According to the California Health Care Foundation, the legal doctrine of preemption – the overriding of state law by federal law on the same subject – is relatively simple in the area of health information privacy. Under HIPAA it is explicit that state regulations that are more protective of patient rights than HIPAA’s are enforceable. For California, that means to the extent that HIPAA and CMIA provide different, but not conflicting protections, both apply. It also means that when the provisions of either law are more protective than the other’s on the same matter, the more stringent rule will set the legal standard.
3. SUPPORT. Oakland Privacy supports this bill, stating that California has been engaged in an ongoing process to protect Californians and visitors to the state who are engaging in activities legal under California law that have been criminalized in other states and sometimes by federal authorities. Oakland Privacy continues that among those activities are some medical procedures including the medical termination of pregnancy, or abortion, and gender-affirming medical care. Oakland Privacy notes that it is possible that other medical procedures will also become subject to divergences between California law and the laws of other states. Oakland Privacy continues that when that happens, it is important that state law clearly indicate what is to happen when other jurisdictions try to enforce their laws outside their boundaries. Oakland Privacy states that this bill also relates to the complex question of consumer consent. Oakland Privacy contends that the long privacy policies to which we are all subjected are supposed to explain what people need to know for meaningful consent, but the length, frequency and legal jargon of such documents has caused them to largely fail at that purpose. Oakland Privacy states that people just don’t read them. Oakland Privacy continues that with all of the factors in play, sometimes the simple yes/no I consent/I don’t consent checkbox is simply not sufficient to empower people to protect themselves. Oakland Privacy concludes that at a minimum, we should ensure that consent processes are maximally robust and that it is made clear to people when they are getting medical care that they do not have to grant consent and that their medical care will not be delayed or impaired if they withhold consent.
4. OPPOSED UNLESS AMENDED. The California Hospital Association (CHA) is opposed to this bill unless it is amended. According to CHA, this bill would eliminate a patient’s right to require that their health information be sent directly to a third party of their choosing, in violation of federal law. CHA states that the federal Health Information Technology for Economic and Clinical Health Act requires a hospital, doctor, or other HIPAA covered entity to comply with a patient’s direction to transmit their health information to another person. CHA continues that HIPAA preempts state law to the extent that HIPAA gives the patient more control over their own health information than state law does. But CHA argues that the proposed changes in this bill to Civil Code Sections 56.10 (d) and (e), if enacted, would be preempted by federal law, rendering them invalid. CHA continues that even if HIPAA did not preempt the proposed revisions to Civil Code, individuals must be allowed to require hospitals and doctors to transmit their health information (or the health information of their deceased family member) directly to entities that are not listed in Civil Code. CHA gives the example that patients often ask that their medical record be transmitted to the Social Security Administration so they can qualify for Social Security disability benefits. Similarly, a person making a claim for accidental death benefits may need to submit their deceased spouse’s medical record to an accidental death insurance company. CHA concludes that these are but two examples illustrating why patients must have control over their medical records.
5. PREVIOUS LEGISLATION.
   1. AB 2089 (Bauer-Kahan), Chapter 690, Statutes of 2022, amends the CMIA to include mental health application (app) information. Defines mental health app information as information related to a consumer's inferred or diagnosed mental health or substance use disorder, as defined in existing law, collected by a mental health digital service; and, mental health digital service as a mobile-based application or internet website that collects mental health app information from a consumer, markets itself as facilitating mental health services to a consumer, and uses the information to facilitate mental health services to a consumer. Deems any business that offers a mental health digital service to a consumer for the purpose of allowing the individual to manage the individual's information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be a health care provider, as specified. Requires any business that offers a mental health digital service to provide to the health care provider information regarding how to find data breaches reported, as specified, on the Attorney General’s website.
   2. AB 2091 (Bonta), Chapter 628, Statutes of 2022, prohibits compelling a person to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action, as defined. Prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state’s laws that interfere with a person’s rights to choose or obtain an abortion or a foreign penal civil action. AB 2091 also prohibits issuance of a subpoena if the submitted foreign subpoena relates to a foreign penal civil action and the submitted foreign subpoena would require disclosure of information related to sensitive services, as defined.
   3. AB 1184 (Chiu), Chapter 190, Statutes of 2021, revises and recasts provisions to require a health care service plan (health plan) or health insurer, effective July 1, 2022, to accommodate requests for confidential communication of medical information regardless of whether there is a situation involving sensitive services or a situation in which disclosure would endanger the individual. Prohibits a health plan or health insurer from requiring a protected individual, as defined, to obtain the policyholder, primary subscriber, or other enrollee or insured's authorization to receive health care services or to submit a claim, if the protected individual has the right to consent to care. Requires the health plan or health insurer to direct all communications regarding a protected individual's receipt of sensitive health care services directly to the protected individual, and prohibits the disclosure of that information to the policyholder, primary subscriber, or any plan enrollees or insureds without the authorization of the protected individual, as provided. Expands the definition of sensitive services to identify all health care services related to mental health, reproductive health, sexually transmitted infections, substance use disorder, transgender health, including gender affirming care, and intimate partner violence, and includes services, as specified.
   4. SB 1301 (Kuehl), Chapter 385, Statutes of 2002, enacts the Reproductive Privacy Act which provides that every individual possesses a fundamental right of privacy with respect to reproductive decisions, including the fundamental right to choose or refuse birth control, and the fundamental right to choose to bear a child or obtain an abortion.
6. COMMITTEE AMENDMENTS. HIPAA allows states to strengthen PHI protections under state law; however, it is unclear if this bill, as drafted, strengthens or weakens patient rights. HIPAA expressly grants individuals the right to direct the transmission of their information to other people or entities. This bill broadly revokes an individual’s right to authorize the release of their information to people or entities that aren’t engaged in providing direct health care services to the patient. According to background submitted to the committee, this bill is based on a personal experience the author had with a consent/release form she was presented to sign. The author argues that patients are often asked to consent to release their information without being provided a clear understanding of what they are giving permission for. While the author’s goal is to ensure patients have a full understanding of what they are releasing their PHI for and to limit the release of PHI to third parties who may be inappropriately using it for purposes of artificial intelligence or other technological pursuits, this broad revocation of a patient’s right to transmit their information could have unintended consequences. For example, some stakeholders have indicated this bill could limit a patient’s ability to authorize the release of their PHI to government entities and schools for purposes of determining eligibility for benefits and programs, clinical trials, medical research, and more. This bill also brings into question if individuals should be barred from releasing their PHI for purposes of advancing technology if they so choose. The committee may wish to amend this bill to narrow the scope of limiting PHI sharing and preserve necessary pathways for patients to authorize the release of their own PHI.

REGISTERED SUPPORT / OPPOSITION:

Support

American College of Obstetricians & Gynecologists – District IX

Oakland Privacy

Privacy Rights Clearinghouse

Opposition

One individual

Analysis Prepared by: Riana King / HEALTH / (916) 319-2097