The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information that is collected by a business, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information, as defined, to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. delete personal information. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law provides for the licensure and regulation of residential care facilities for the elderly by the State Department of Social Services. Existing law requires residential care facilities for the elderly to have an emergency and disaster plan and requires the plan to include specified elements, including plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. A violation of these provisions is punishable as a misdemeanor.

This bill, which would take effect on January 1, 2027, would require commencing January 1, 2028, would require a 2030, a for-profit residential care facility for the elderly licensed to provide care for 16 or more residents in an assisted living unit, as defined, to have an alternative source of power, as defined, to protect residents health and safety for no fewer than 72 hours during any type of power outage. The bill would make that provision applicable to a nonprofit residential care facility for the elderly that provides care for 16 or more residents in an assisted living unit commencing January 1, 2032. The bill would impose specific compliance requirements based on whether the facility uses a generator as its alternative source of power, or batteries or a combination of batteries in tandem with a renewable electrical generation facility. The The bill would authorize a civil penalty, as specified, for a facility that fails to comply with these requirements, and would authorize the department to suspend or revoke the licensees license and permanently revoke a licensees ability to operate or act as an administrator of a facility anywhere in the state. The bill would specify that, for facilities with more than assisted living facilities, these requirements only apply to the assisted living portion of the facility.

This bill would require a facility licensed to provide care for 16 or more residents in an assisted living unit to comply with these requirements and include information regarding the alternative source of power within the emergency and disaster plan beginning January 1, 2028. By 2030, for a for-profit facility, and beginning January 1, 2032, for a nonprofit facility.

By expanding the scope of an existing crime, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law provides for the licensure and regulation of residential care facilities for the elderly by the State Department of Social Services. Existing law requires residential care facilities for the elderly to have an emergency and disaster plan and requires the plan to include specified elements, including plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. A violation of these provisions is punishable as a misdemeanor.

This bill, commencing January 1, 2027, 2028, would require a residential care facility for the elderly licensed for 16 or more residents to have an alternative source of power, as defined, to protect residents health and safety for no fewer than 72 hours during any type of power outage. The bill would impose specific compliance requirements based on whether the facility uses a generator as its alternative source of power, or batteries or a combination of batteries in tandem with a renewable electrical generation facility. The bill would require a facility licensed for 16 or more residents to comply with these requirements and include information regarding the alternative source of power within the emergency and disaster plan beginning January 1, 2027. 2028. By expanding the scope of an existing crime, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law provides for the licensure and regulation of residential care facilities for the elderly by the State Department of Social Services. Existing law requires residential care facilities for the elderly to have an emergency and disaster plan and requires the plan to include specified elements, including plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. A violation of these provisions is punishable as a misdemeanor.

This bill, commencing January 1, 2027, would require a residential care facility for the elderly licensed for 16 or more residents to have an alternative source of power, as defined, to protect residents health and safety for no fewer than 72 hours during any type of power outage. The bill would impose specific compliance requirements based on whether the facility uses a generator as its alternative source of power, or batteries or a combination of batteries in tandem with a renewable electrical generation facility. The bill would require a facility licensed for 16 or more residents to comply with these requirements and include information regarding the alternative source of power within the emergency and disaster plan beginning January 1, 2027. By expanding the scope of an existing crime, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law provides for the licensure and regulation of residential care facilities for the elderly by the State Department of Social Services. Existing law requires residential care facilities for the elderly to have an emergency and disaster plan and requires the plan to include specified elements, including plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. A violation of these provisions is punishable as a misdemeanor.

This bill, commencing January 1, 2027, would require a residential care facility for the elderly to have an alternative source of power, as defined, to protect residents health and safety for no fewer than 72 hours during any type of power outage. The bill would impose specific compliance requirements based on whether the facility uses a generator as its alternative source of power, or batteries or a combination of batteries in tandem with a renewable electrical generation facility. The bill would require a facility to comply with these requirements and include information regarding the alternative source of power within the emergency and disaster plan beginning January 1, 2027. By expanding the scope of an existing crime, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Date of Hearing: August 5, 2026

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

SBPCA Bill Id:SB 435

Author:(Wahab) – As Amended Ver:June 9, 2026

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill narrows the definition of “publicly available” information that the California Consumer Privacy Act (CCPA) excludes from “personal information,” thereby extending CCPA protections to a broader range of consumer information.

FISCAL EFFECT:

1. Minor and absorbable costs to the California Privacy Protection Agency to implement and enforce the CCPA in light of the broadened scope of “personal information” (General Fund). This bill makes a definitional change and does not, by its terms, require the agency to adopt new regulations. Based on overall compliance with the requirements of the measure, CCPA anticipates enforcement may require additional resources, potentially in excess of this committee’s $150,000 suspense threshold.
2. Costs of an unknown amount, likely minor, to the Department of Justice for any enforcement actions arising under the broadened definition (General Fund). Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.

COMMENTS:

1. Purpose. According to the author:

Senate Bill 435 addresses the loopholes in the CCPA by amending the definition of “publicly available information,” which will enhance consumer privacy and security while establishing clearer boundaries regarding what, when, and how information is considered publicly available.

1. Background. The Legislature enacted the CCPA in 2018 (AB 375 (Chau), Chapter 55, Statutes of 2018), giving consumers rights to know what personal information businesses collect, to request deletion, and to opt out of the sale of their information. As originally enacted, the CCPA defined “publicly available” narrowly — information lawfully made available from federal, state, or local government records. AB 874 (Irwin), Chapter 874, Statutes of 2019, refined that language the following year but kept the exception anchored to government records.

The California Privacy Rights Act (CPRA, Proposition 24), which the voters approved in 2020, broadened the exception. In addition to government-records information, the CPRA carved out two new categories: information a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed the information if the consumer did not restrict the audience. The CPRA also extended the publicly-available exception to the new category of “sensitive personal information.”

This bill removes the “reasonable basis to believe” qualifier from the first added category and deletes the second category entirely, returning the definition closer to the government-records-anchored formulation that existed under AB 874 before the CPRA’s 2020 expansion. The CPRA established the CCPA as a floor rather than a ceiling, so the Legislature may amend the act by majority vote only if the amendment is consistent with and furthers the CCPA’s purpose of protecting consumer privacy — a standard at the center of the competing arguments below.

1. Support and Opposition. Consumer Reports, the Privacy Rights Clearinghouse, Oakland Privacy, and a range of civil society organizations support the bill, arguing the current definition lets data brokers overclassify sensitive information as publicly available and sell it, including to government agencies, and that the change restores meaningful opt-out and deletion rights. A coalition of business associations, including the California Chamber of Commerce, the Consumer Data Industry Association, and TechNet, opposes the bill. The coalition argues the change replaces the CCPA’s objective reasonable-belief standard with a de facto strict-liability regime turning on facts outside a business’s knowledge, disrupts established compliance frameworks, and burdens access to lawfully public information in tension with the First Amendment and the California Public Records Act. The coalition further contends the bill upends the voter-approved balance struck in Proposition 24.

Analysis Prepared by: Shiran Zohar / APPR. / (916) 319-2081

Date of Hearing: June 23, 2026

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 435

Author:(Wahab) – As Amended Ver:June 9, 2026

SENATE VOTE: 39-0

SUBJECT: California Consumer Privacy Act of 2018: personal information: exemptions

SYNOPSIS

The Legislature enacted the California Consumer Privacy Act (CCPA) in 2018 and the voters amended it by an initiative measure, the California Privacy Rights Act (CPRA), in 2020. The CPRA introduced the concept of “sensitive information” – such as social security numbers, credit card numbers, geolocation, sexual orientation, immigration status, and certain health information – and granted consumers the right to restrict the use of such information on a business-by-business basis and, like personal information, provided that consumers may “opt out” of the sharing and sale of such information.

The CPRA also broadened a key exception to the definitions of “personal information” and “sensitive information.” That exception is for “publicly available information,” defined as information that (1) is made lawfully available from government records, (2) a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or (3) is made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

Arguing that the latter two categories give businesses nearly unfettered license to monetize sensitive information of vulnerable communities, including immigrants, LGBTQ+ individuals, and children, the author recently amended this bill to modify the definition of “publicly available information” to better ensure that CCPA’s protections, should a consumer opt to exercise them, are more consistently observed by businesses. Specifically, the bill would remove the phrase “a business has a reasonable basis to believe” from (2) and altogether delete (3). This brings the provision more closely in line with the initial version of the CCPA, as amended by AB 874 (Irwin, Stats. 2019, Ch. 874).

The previous version of this bill was heard by this Committee in 2025 and failed passage on a 7-5 vote. The bill was granted reconsideration. The bill was recently amended in its entirety to pose a new question related to the CCPA and Californians’ privacy rights. As a result, it is being heard in the Committee as though it is a new bill.

This bill is supported by Consumer Reports, Privacy Rights Clearinghouse, Oakland Privacy, and a number of additional civil society organizations. The bill is opposed by a coalition of business organizations including the California Chamber of Commerce, the Consumer Data Industry Association, and TechNet.

EXISTING LAW:

1. Provides, pursuant to the U.S. Constitution, that “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched and the persons or things to be seized.” (U.S. Const., Fourth Amend; see also Cal. Const. art. 1, § 13.)
2. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these is the fundamental right to privacy. (Cal. Const. art. I, § 1.)
3. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
4. Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
5. Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Civ. Code § 1798.12.)
   5. The right to direct a business that collects sensitive personal information about the consumer to limit its use of that information to specified necessary uses. (Civ. Code § 1798.121.)
   6. The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
6. States that both personal information and sensitive personal information that is “publicly available” is not considered personal or sensitive. (Civ. Code § 1798.140,)
7. Defines the following terms under the CCPA:
   1. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
      1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
      2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
      3. Biometric information.
      4. Internet activity information, including browsing history and search history.
      5. Geolocation data.
      6. Audio, electronic, visual, thermal, olfactory, or similar information.
      7. Professional or employment-related information. (Civ. Code § 1798.140(v).)
   2. “Publicly available” means any of the following:
      1. Information that is lawfully made available from federal, state, or local government records.
      2. Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
      3. Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Civ. Code § 1798.140(v)(2)(B).)
   3. “Sensitive personal information” means:
      1. Personal information that reveals:
         1. A consumer’s social security, driver’s license, state identification card, or passport number.
         2. A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
         3. A consumer’s precise geolocation.
         4. A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
         5. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
         6. A consumer’s genetic data.
         7. A consumer’s neural data.
            1. “Neural data” means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.
         8. The processing of biometric information for the purpose of uniquely identifying a consumer.
         9. Personal information collected and analyzed concerning a consumer’s health.
         10. Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. (Civ. Code § 1798.140(ae).)
8. States that “personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. (Civ. Code § 1798.140(v)(2)(A).)
9. States that “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (Civ. Code § 1798.140(v)(2)(B).)
10. Establishes the California Privacy Protection Agency (Privacy Agency), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
11. Establishes the Data Broker Registration Law (DBRL). (Civ. Code §§ 1798.99.80-1798.99.88.)
12. Defines a “data broker” as a business that knowingly collects and sells the personal information of a consumer to a third party that the business does not have a direct relationship with. (Civ. Code § 1798.99.80.)
13. Requires data brokers to register annually with the Privacy Agency and provide specified information. (Civ. Code § 1798.99.82.)
14. Requires the Privacy Agency, by January 1, 2026, to develop an accessible deletion mechanism that allows a consumer to request that every registered data broker delete any personal information held by the broker. (Civ. Code § 1798.99.86.)

THIS BILL: Narrows the “publicly available” exclusion from “personal information” under the CCPA by:

1. Removing the phrase “a business has a reasonable basis to believe” from the subcategory of “publicly available” information that has been lawfully made available to the general public by the consumer or from widely distributed media.
2. Deleting the subcategory of information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

COMMENTS:

1) Author’s statement. According to the author:

As Californian's becomes more dependent on technology, providing consumers with the ability to decide what information they want to make publicly available is essential to preserve the privacy, safety, and autonomy to control their personal information.

Currently, the California Consumer Privacy Act (CPPA) allows data brokers and corporations to determine what personal information they consider publicly available. As a result, data brokers can collect in mass any personal information and sell it to the highest bidder, including government agencies which bypass legal processes and procedures to access this information. This is especially alarming as governmental agencies are increasingly surveilling and targeting Californians, especially undocumented immigrants and activist.

Senate Bill 435 addresses the loopholes in the CCPA by amending the definition of "publicly available information," which will enhance consumer privacy and security while establishing clearer boundaries regarding what, when, and how information is considered publicly available.

2) Historical perspective. To fully understand how completely people in California and throughout the country have ceded the right to live their lives in private, free from both government and private surveillance, privacy experts reflect on the concerns raised by federal and state lawmakers 50 years ago when debating the creation of the FBI’s National Crime Information Center’s computerized data collection system (NCIC). This database that was so controversial at the time allowed local, state, and federal law enforcement agencies to share personal data related to suspected criminal activities. Congress held “days and days” of hearings over two years. Members warned of the “threat of the dictatorship of dossiers.”^[1]

During the debates, Senator Barry Goldwater of Arizona lamented, “Where will it end? . . . Will we permit all computerized systems to interlink nationwide so that every detail of our personal lives can be assembled instantly for use by a single bureaucrat or institution?”^[2] Senator Charles H. Percy of Illinois in foreshadowing of what would come to pass in the 21st century warned:

I hope that we never see the day when a bureaucrat in Washington or Chicago or Los Angeles can use his organization’s computer facilities to assemble a complete dossier of all known information about an individual. But, I fear that is the trend. . . . Federal agencies have become omnivorous fact collectors—gathering, combining, using, and trading information about persons without regard for his or her rights of privacy. Simultaneously, numerous private institutions have also amassed huge files . . . of unprotected information on millions of Americans.^[3]

During the same period when Congress was expressing concern about the erosion of individuals’ privacy protections, the people of California used the initiative process to add “privacy” to the list of “inalienable rights” in the state constitution in 1972.^[4] Proponents noted the initiative was specifically designed to preserve Californians’ private lives and fundamental rights in the face of technological advances. They argued: “The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . .”^[5]

Presently, California voters face an even greater “dictatorship of dossiers”^[6] than their predecessors, with not only global governments’ ability to monitor individuals’ private lives, but also the near ubiquitous access to these dossiers afforded to private businesses and individuals willing to pay for them. There are more than 4,000 data brokers with dossiers on 98% of the people in the United States.^[7] The largest data broker, Acxiom, has more than 10,000 data attributes on over 2.5 billion people in more than 60 countries.^[8] The amount of data being collected on people has increased dramatically over the last decade as businesses have figured out how to monetize this natural resource.^[9]

3) California Consumer Privacy Act. In 2018, the Legislature enacted the CCPA (AB 375; Chau, Chap. 55, Stats. 2018), which gave consumers certain rights regarding their personal information,^[10] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

In addition, the CCPA defined “publicly available” as “information that is lawfully made available from federal, state, or local government records. This definition excluded biometric information collected by a business about a consumer without the consumer’s knowledge. With regard to the issue of “publicly available” information, the CCPA, as originally enacted, provided:

(2) “Personal information” does not include publicly available information. For these purposes, “publicly available” means information that is lawfully made available from federal, state, or local government records, if any conditions associated with such information. “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. Information is not “publicly available” if that data is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained. “Publicly available” does not include consumer information that is deidentified or aggregate consumer information.

In 2019, AB 874 (Irwin, Stats. 2019, Ch. 874) amended that language as follows:

“Personal information” does not include publicly available information. For these purposes,  purposes of this paragraph,  “publicly available” means information that is lawfully made available from federal, state, or local government records, if any conditions associated with such information.  records.  “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. Information is not “publicly available” if that data is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained. “Publicly available” does not include consumer information that is deidentified or aggregate consumer information. 

In 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which both established additional privacy rights for Californians and arguably weakened other privacy rights. Chief among these additional rights was the right of a consumer to limit a business’s use of sensitive personal information.^[11] However, the CPRA also expanded the exemption for “publicly available” information to include, in addition to lawfully available information from government records, the following:

1. Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
2. Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

In addition, the exemption for publicly available personal information was also applied to a new category – sensitive personal information. While these changes to the publicly-available exemption, theoretically, were designed to exempt information that a person posts on a social media platform, proponents of SB 435 argue that a company could claim that it believed someone’s sensitive information was made available to the general public or that the person disclosed the information to a second party and had not requested that the sharing be restricted. Oakland Privacy explains the challenges in this manner:

[T]he removal of a bullet point about information made available by the consumer if the consumer has not restricted the distribution of the information [is responsive to] current realities, where information is widely scraped from digital platforms and it is, at best, unclear what if anything, a consumer can do to prevent that scraping. The clause was written as if privacy control mechanisms were crystal clear and fully transparent to consumers who can clearly indicate exactly what they intend. But our reality, especially online and in the wooly world of social media, is nowhere near that cut and dried. A privacy law intended to be protective of our personal information can not be effective if it places a formidable gauntlet in front of a user/consumer that they must cross in order to receive the protections of the law. And we know that users/consumers that are the most vulnerable are often the ones that are poorly positioned to navigate confusing privacy controls and distribution limits successfully, including young people, the elderly and limited English fluency populations.

One of the most important components of Proposition 24 was establishing that the CCPA, as amended, was a floor and not a ceiling for privacy protection. Essentially, to protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy.^[12]

4) Publicly available information and privacy in public spaces. A major problem with US privacy laws, including California’s, is its continued embrace of the belief “that anything exposed to the public, or data available to the public, or even information shared with others lacks any privacy interest because it is not totally secret. This flawed understanding of privacy creates two common and severe limitations of privacy law—a failure to protect privacy in public or publicly-available data.”^[13]

As Professor Daniel Solove notes, “most people do not live like hermits; they engage in their life’s activities in places where other people congregate. People expect that their activities are private because they are obscure – others won’t be paying attention or watching or listening.”^[14] As demonstrated throughout this paper, modern surveillance technologies have eroded this sense of obscurity. Contributing to the erosion of any semblance of privacy in public spaces is the notion that information that is “publicly available” is no longer private and becomes fair game.^[15]

As Professor Solove warns:

Companies are scraping vast quantities of personal data from the internet. . . . Scrapers argue that public information is fair game, and many privacy laws permit scraping by excluding publicly available data from their protections. The principle of obscurity, however, emphasizes that just because data is publicly accessible does not mean privacy is forfeited. Although the information may not be secret, its obscurity imposes significant limits on accessibility. Collecting personal data and making it easily discoverable fundamentally alters the level of privacy associated with that information.^[16]

He urges policy makers:

Rethinking the notion of publicly available information would close a gaping hole in privacy protection; it would prevent companies and the government from vacuuming up vast quantities of personal data; it would protect personal data online with important privacy safeguards and limitations.^[17]

5) What this bill would do. This bill makes the following changes to the CCPA’s definition of “publicly available” information that is excluded from the definition of “personal information”:

Civ. Code Section 1798.140. (v)(2)(B) (i) For purposes of this paragraph, “publicly available” means any either of the following:

(I) Information that is lawfully made available from federal, state, or local government records.

(II) Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.

(III) Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

By narrowing this exclusion from the definition of “personal information,” the bill expands the protections of the CCPA to encompass a broader range of information, enabling consumers to more effectively exercise their opt-out and deletion rights. This change is more in line with the “publicly available” definition in the original CCPA. As amended by AB 874 (Irwin, Stats. 2019, Ch. 874), definition applied only to “information that is lawfully made available from federal, state, or local government records.” 

6) The need for this bill. In their support letter, Consumer Reports articulates the challenges with the current definition of “publicly available” information in the CCPA and the need for changes:

Under the current law, CCPA privacy rights do not apply to “publicly available information” which is defined as:

• information that is lawfully made available from federal, state, or local government records,
• information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, OR
• information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

The third provision above is the most problematic: under the CCPA, any information you provide to any single other person or company is arguably “publicly available information” — and thus outside the scope of CCPA — unless you specifically instruct the recipient not to provide that information to others. Given the modern data ecosystem where consumers interact with dozens (if not hundreds) of companies every day and there is often no automated or standardized way to restrict resharing, this exception could potentially swallow the whole of CCPA and render it moot. Such an interpretation is clearly inconsistent with the purpose and structure of CCPA which provides opt-out rights over certain processing and sharing of data, but nevertheless grants other rights (such as access, deletion, and correction) over data not subject to such opt outs. SB 435 would fix this inconsistency in the law by eliminating this potential loophole.

The second provision above could also potentially be abused, by imposing a subjective test from the perspective of a company as to whether data has been made publicly available by a consumer or the media. Whether data has been made available or not is an objective matter of fact — it is not the personal opinion of a data broker or advertising company. If a company makes a good faith error as to whether certain data is public or not, it is still an error and should be a technical violation of the law — just as other data processing errors are under the CCPA.

7) Analysis. Some may consider sharing their private information, including websites they visit, purchases, employment history, menstrual cycles, name, pictures, locations and movements, social media posts and reactions, and other seemingly innocuous information a reasonable price to pay for freely accessing the internet. However, failing to actively protect our private information can have real world consequences. As an example, dating app, Grindr, was fined 10 percent of its global annual revenue by the Norwegian Data Protection Authority in 2021 for sharing deeply personal information with advertisers, including location, sexual orientation and mental health details.^[18] This was not the first time Grindr had failed to protect their users’ private information. Several years earlier, it was revealed that the company had shared HIV status and the location data from their users with two companies who were contracted to optimize the Grindr platform.^[19]

Catherine Powell in a 2023 blog post for the Council on Foreign Affairs highlights the ubiquitous plundering of people’s personal, intimate data:

If you’ve engaged with any form of technology recently—whether through a smartphone, social media, a fitness tracker, even a seemingly innocuous game like Candy Crush—you have accumulated a substantial amount of intimate privacy data. Intimate data ranges from your location, to when you fall asleep, to even more closely guarded information like your menstrual cycle or sexual partners. And every day, this data is scraped, bought, and sold by data brokers to third parties. Beyond violating our privacy, this repurposing of our personal data undermines our security.^[20]

As it pertains to this bill, elected officials in debating privacy in both the state and federal governments 50 years ago clearly foresaw the future facing the country if people’s privacy was not aggressively protected. Since that time, Californians’ privacy rights have been slowly chipped away until they have largely disappeared. One could argue it is unlikely that the voters in 2020 when voting on the CPRA contemplated or understood that people’s most sensitive personal information could be shared to hundreds of companies within seconds and could change hands and be coupled with other personal information by thousands of companies in order to create detailed profiles that include every aspect of a person’s life.^[21]

Given these considerations, one could reasonably argue that this bill returns the meaning of publicly available to one that is commonly understood is consistent with and furthers the purpose and intent of the CPRA, which is to protect California consumers’ constitutional right to privacy. A question for this Committee is whether acts such as posting a picture of a visit to one’s country of birth or a comment about their relationship means that information is no longer sensitive or theirs to control but rather is fair game to be scraped and monetized.

Opposition cites to provisions assuring the public’s right to access information from the government: “The people have the right of access to information concerning the conduct of the people’s business, and therefore, the meetings of public bodies, and the writings of public officials and agencies shall be open to public scrutiny.”^[22] But nothing about this right guarantees the ability to monetize personal information.

Additionally, opposition cites Sorrell v. IMS Health Inc,^[23] for the proposition that “the creation and dissemination of information is speech for First Amendment purposes.” That is undoubtedly so. But Sorrell involved a statute that prohibited the sale of doctors’ prescription-buying preferences to pharmaceutical manufacturers for marketing purposes while allowing the same information to be sold to other users, such as “educational communications,” thereby favoring academic research over marketing. The Supreme Court held that the statute impermissibly imposed both content-based and viewpoint-based discrimination and subjected it to the highest level of scrutiny.^[24] This bill’s changes, by contrast, are neither content- nor viewpoint-based. Thus, that case appears to have little applicability to this bill.

ARGUMENTS IN SUPPORT: Oakland Privacy writes in support:

Due to the ubiquity of the information state and an advertising ecosystem that has shifted into detailed dossiers for hyper-targeted individualized marketing, the universe of publicly available information is immense. It includes many government records, including professional licensures, property records, court records, census data, voting rolls, public records and public meeting minutes, as well as private records including published articles, media interviews, academic conferences and journals, and of course online blogs and social media posts.

Under SB 435, two significant changes would be made to the definition of publicly available information.

Firstly, the phrase “reasonable basis to believe” would be removed from the second bullet point which discusses how a business deals with personal information that is lawfully made available or is in widely distributed media. The default for a business not treating personal information as personal information should be knowledge that it is lawfully available, not beliefs, suppositions or assumptions. If a business lacks knowledge of whether personal information has lawfully been made public, they should not engage in guessing games. They should treat the personal information as personal information, unless and until they have concrete knowledge that the information is public or has been distributed in widely available media. This is a clearer and less ambiguous standard and one that puts safety first.

The second change is the removal of a bullet point about information made available by the consumer if the consumer has not restricted the distribution of the information. This change is responsive to the current realities, where information is widely scraped from digital platforms and it is, at best, unclear what if anything, a consumer can do to prevent that scraping. The clause was written as if privacy control mechanisms were crystal clear and fully transparent to consumers who can clearly indicate exactly what they intend. But our reality, especially online and in the wooly world of social media, is nowhere near that cut and dried. A privacy law intended to be protective of our personal information can not be effective if it places a formidable gauntlet in front of a user/consumer that they must cross in order to receive the protections of the law. And we know that users/consumers that are the most vulnerable are often the ones that are poorly positioned to navigate confusing privacy controls and distribution limits successfully, including young people, the elderly and limited English fluency populations. Reducing the get out of jail free card for what is fundamentally just carelessness and the lack of tech savvy makes us all safer.

These changes meet the standard for amending CPRA by being more privacy-protective than the original language, preserve necessary carve outs for public records and the exercise of journalism, and are responsive to the challenges of the modern day. >

Privacy Rights Clearinghouse also argues in support:

Under current law, the CCPA defines “personal information” as anything that identifies, relates to, describes, or is reasonably capable of being linked to a consumer or household. Depending on how personal information is made available and distributed, and with whom it is shared, those protections are eased and the information is treated as publicly available. Current statute gives businesses significant discretion to interpret any information published online as publicly available. As a result, data brokers can legally access and sell information about where you live, shop, work, study, and travel, along with the status of your reproductive health, marriage, and citizenship, and much more.

When paired with AI tools, this data can build a comprehensive profile of a person’s life, allowing agencies to identify, surveil, and track undocumented immigrants and people protesting the federal government with precision. Additionally, this loophole allows governmental agencies to bypass the Fourth Amendment and increasingly surveil Californians.

SB 435 addresses the loophole in the definition of “publicly available information” by removing language that allows this data to be treated as anything less than sensitive and private by data brokers and corporations. SB 435 does not impact First Amendment protections for information that is truly publicly available; instead, it removes the ability for businesses to overclassify information as publicly available.

ARGUMENTS IN OPPOSITION: In opposition to the bill, [a coalition of business associations] argue:

Ultimately, despite undergoing recent amendments, SB 435 raises largely the same fundamental policy and constitutional concerns presented by last year's version of the bill—concerns that this committee previously considered and rejected.

Even as amended, SB 435 still disrupts careful balance between privacy and the free flow of information

Under the CCPA, “publicly available” includes any of the following: (I) information that is lawfully made available from government records; (II) information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; and (III) information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (See Civil Code Sec. 1798.140(v)(2)(B).) The definition reflects a recognition in existing law that there are ways for consumers and website operators to restrict access to data via audience controls or similar mechanisms, ensuring that the information would not be considered publicly available. Similarly, there are considerations that go into deciding whether records, or portions of government records should be made publicly available for purposes of the California Public Records Act. (See Gov. Code Sec. 7920.000 et seq.). SB 435 would ignore the careful balance struck in the CCPA between consumer privacy and the free flow of information.

The CCPA excluded information that was made publicly available, as defined, from the definition of “PI” both for public policy and constitutionality purposes. A consumer’s privacy interest diminishes in information that is lawfully rendered publicly available in government records, mass media, or otherwise made available to the public by the consumer, including where the consumer makes the information available to other people without placing any restrictions on the audience. Conversely, once information has lawfully entered the public sphere, the public’s interest in receiving, accessing, and using that information increases. Again, as noted above, recognizing that there are mechanisms by which a consumer could have ensured that information did not enter the public sphere, once that information does enter that space, Article 1, Section 3 of the California Constitution, California Public Records Act, and the First Amendment of the U.S. Constitution protect the public’s access to public information.

Fifty-five years after the Supreme Court expressly recognized the “right to receive information and ideas”, it is troubling to see proposals continue to challenge these same foundational principles. It is worth noting that the public’s right to receive lawfully available information does not depend on whether that information is generic or specific, fiction or non-fiction, personal or impersonal, political or apolitical, conservative or liberal, on a particular topic or topics, or of one viewpoint or another. Once information has been lawfully made public, it can — and must — remain available to Californians, including businesses, subject to established limits.

Of course, that is not to say that the Public Records Act, or even the First Amendment or Article 1, Section 3 of the U.S. and California constitutions are without limit—no constitutional or statutory right is, as rights often compete against one another. Indeed, all three of these laws incorporate some version of a balancing test. Likewise, the CCPA’s “publicly available” exemption already provides guardrails.

For example, for a record to be “lawfully made available through government records” prong of the “publicly available” exemption, sensitive identifiers will have to have been redacted to protect privacy before release. That is because the Public Records Act in fact demands that privacy interests in public records be weighted against the public interests in the disclosure of those same records under a balancing test that is used to determine whether or not an agency should withhold (or redact) records. This is in addition to a multitude of specific exemptions provided under the act. (Gov. Code Sec. 7927.500.)

Similarly, the second prong of the CCPA’s “publicly available” exemption reflects a practical and well-calibrated balance, recognizing that businesses are not always in a position to determine with complete certainty how information came to be publicly available or investigate the circumstances surrounding every public disclosure years after the fact. Accordingly, the statute does not mandate perfect knowledge. Instead, it requires that the business have a reasonable belief that the information was lawfully made available to the public. SB 435 overrides these tested and balanced frameworks, replacing the CCPA's objective reasonable-belief standard with a de facto strict-liability regime based on facts outside a business's knowledge or control at the time it collects, uses, or disseminates information.

Now, information that a business reasonable believes was lawfully disclosed could later be deemed “nonpublic” if it is discovered that the information originated from a record that was improperly released or insufficiently redacted, even where the business had no reason to know of the defect. The bill thus transforms a workable, objective standard into one that depends on facts outside a business's knowledge or control.

Similarly, by deleting the third prong of the publicly available exemption, SB 435 eliminates protection for information that enters the public sphere through third parties to whom the consumer voluntarily disclosed the information without audience restrictions. This includes information publicly shared or republished by others after a consumer chose not to limit its dissemination could be treated as PI notwithstanding its longstanding public availability. For example, information provided by an individual to a professional association for inclusion in a public member directory or to an event organizer for inclusion in a publicly available speaker list could lose its status as “publicly available” despite the individual’s decision not to restrict further dissemination. In doing so, the bill disregards the very distinction the CCPA draws between information intentionally made available to the public and information that consumers choose to keep private.

Nothing in SB 435 explains why this longstanding framework should be discarded, particularly where existing law already incorporates multiple safeguards to protect privacy interests before information enters the public sphere. Nonetheless, these changes upend the voter-approved balancing of interests reflected in Proposition 24, when they not only affirmed but broadened the CCPA’s definition of what is considered “publicly available,” and therefore exempt from the CCPA , and threaten the substantial societal benefits of protecting access to publicly available information. And the ramifications of doing so would be significant for our members not merely in terms of infringing upon their rights, but from a business and compliance standpoint.

Even as amended, SB 435 still significantly disrupts existing CCPA compliance frameworks

While the bill proposes a seemingly simple change, it would directly and significantly impact our associations and members, who have spent years and significant amounts of resources designing and building their compliance processes to accurately and effectively distinguish between “publicly available” information and “PI” (which includes “sensitive PI”) under the CCPA, for the purposes of restricting the sale or sharing of information, as well as limiting the use and disclosure of sensitive PI, and to effectuate other rights afforded by the CCPA. By upsetting this careful balance between privacy and publicly available information, the bill would undermine companies’ ability to comply with the CCPA and fulfill consumer rights.

Ultimately, however well-intentioned and compelling it may be in light of recent events, the State may not infringe upon these rights to protect a generalized interest in consumer privacy and such broad-brush restrictions on the collection and dissemination of publicly available information do not appear to be narrowly tailored to further compelling governmental interests as the bill is currently drafted. As a result, the bill seems unlikely to survive strict scrutiny if so challenged.

Lastly, we note that SB 435 also threatens to decrease privacy protections for consumers by forcing businesses to go through any publicly available information they possess and figure out whether it may contain arguably re-classified “personal information.” This means having to identify or otherwise link publicly available information to specific consumers, which runs contrary to the CCPA and privacy principles. To make this determination, businesses would have to figure out whom each data point belongs to and then assess whether the data point reveals something sensitive about them. In other words, a business would be put in the position of identifying or linking the data points to particular individuals, at the same that that Section 1798.145(j)(1) expressly states that nothing in the CCPA shall be construed to require businesses to “reidentify or otherwise link information that, in the ordinary course of business, is not maintained in a manner that would be considered personal information”. At best this causes confusion; at worst it creates a conflict.

The opposition notes that their arguments against the prior version of SB 435 remain unchanged in this version of SB 435. For an analysis of those arguments please see the 6-23-2025 analysis of this bill, beginning on page 11.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for a Better Community (UNREG)
Alliance for Boys and Men of Color
Alliance for Children's Rights
Asian Americans Advancing Justice Southern California
California State Pta
California Teachers Association
Children's Advocacy Institute
Consumer Reports
Consumer Watchdog
Courage California
Oakland Privacy
Privacy Rights Clearinghouse
Secure Justice
Seiu California
Unidosus
University of California Student Association

Opposition

Association of National Advertisers
California Chamber of Commerce
Computer & Communications Industry Association
Consumer Data Industry Association
Cspra
Insights Association
Software Information Industry Association
State Privacy and Security Coalition, INC.
Techca
Technet

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Citron, Danielle Keats, A More Perfect Privacy, 104 Boston University Law Review, 1073–1086 (2024). ↑

2. Ibid. ↑

3. Ibid. ↑

4. California Proposition 11 (1972), “Constitutional Right to Privacy Amendment.” ↑

5. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

6. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

7. Solove, Daniel J. Privacy in Authoritarian Times: Surveillance Capitalism and Government Surveillance, George Washington University Law School (Jan. 19, 2025). https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5103271. ↑

8. Ibid. ↑

9. Ibid. ↑

10. Civ. Code § 1798.140(v). See EXISTING LAW #7(a) for definition. ↑

11. Civ. Code § 1798.140(ae). See EXISTING LAW #7(b) for definition. ↑

12. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74 ↑

13. Solove, Daniel J. Privacy in Authoritarian Times: Surveillance Capitalism and Government Surveillance, George Washington University Law School (Jan. 19, 2025). https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5103271. ↑

14. Ibid. ↑

15. Civ. Code § 1798.140(v)(2)(B). ↑

16. Solove (2025) ↑

17. Ibid. ↑

18. Hern, Alex. “Grindr fined £8.6m in Norway over sharing personal information,” The Guardian (Jan. 26, 2021) https://www.theguardian.com/technology/2021/jan/26/grindr-fined-norway-sharing-personal-information. ↑

19. “Grindr shared information about users’ HIV status with third parties.” The Guardian (Apr. 3, 2018) https://www.theguardian.com/technology/2018/apr/03/grindr-shared-information-about-users-hiv-status-with-third-parties. ↑

20. Powell, Catherine. “Data is the New Gold, But May Threaten Democracy and Dignity,” Council on Foreign Relations (Jan. 5, 2023) https://www.cfr.org/blog/data-new-gold-may-threaten-democracy-and-dignity-0. ↑

21. For more information on how information is sold and shared, see Don Marti, et al. “Who Shares Your Information with Facebook? Sampling the Surveillance Economy 2023,” Consumer Reports (Jan. 2024) https://advocacy.consumerreports.org/research/report-who-shares-your-information-with-facebook/ ↑

22. Cal. Const. Art. 1, § 3. ↑

23. (2011) 564 U.S. 552, 570. ↑

24. Id., p. 565. ↑

Date of Hearing: July 16, 2025

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 435

Author:(Wahab) – As Amended Ver:June 23, 2025

SENATE VOTE: N/A

PROPOSED AMENDMENTS

SUBJECT: California Consumer Privacy Act of 2018: sensitive personal information

SYNOPSIS

The Legislature enacted the California Consumer Privacy Act (CCPA) in 2018 and the voters amended it by an initiative measure, the California Privacy Rights Act (CPRA), in 2020. The CPRA introduced the concept of “sensitive information” – such as social security numbers, credit card numbers, geolocation, sexual orientation, immigration status, and certain health information – and granted consumers the right to restrict the use of such information on a business-by-business basis and, like personal information, provided that consumers may “opt out” of the sharing and sale of such information. Since the passage of the CPRA, 17 states have passed privacy laws with stronger protections, including one that prohibits sharing of sensitive information entirely and 16 that require consumers to “opt in” to the sharing and sale of personal information – thereby making the privacy of the most intimate personal information the default in those states.

A broad exception to the definitions of “personal information” and “sensitive information,” expanded by the CPRA, appears to weaken California’s privacy protections. That exception is for “publicly available information,” defined as information that (1) is made lawfully available from government records, (2) a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or (3) is made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

Arguing that this exception gives businesses nearly unfettered license to monetize sensitive information of vulnerable communities, including immigrants, LGBTQ+ individuals, and children, the author recently amended this bill in its entirety to eliminate the publicly-available exception to “sensitive information,” in order to ensure that the limited protections accompanying this status, should a consumer opt to exercise them, are more consistently observed by businesses.

This bill is supported by the Alliance for Children’s Rights, Asian Americans Advancing Justice Southern California, and Courage California. It is opposed by the Chamber of Commerce, TechNet, TechCA, and the Computer and Communications Industry Association. The Committee has recommended one technical amendment discussed in Comment #7.

THIS BILL:

1. Deletes the exemption for public information from the definition of “sensitive personal information.”

EXISTING LAW:

1. Provides, pursuant to the U.S. Constitution, that “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched and the persons or things to be seized.” (U.S. Const., Fourth Amend; see also Cal. Const. art. 1, § 13.)
2. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these is the fundamental right to privacy. (Cal. Const. art. I, § 1.)
3. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
4. Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
5. Prohibits a business from selling or sharing the personal information of a child that is 16 years of age or younger, if the business has actual knowledge of the child’s age, unless the child, or the child’s parent or guardian in the case of children less than 13 years old has affirmatively authorized the sharing of selling of the personal information. (Civ. Code § 1798.120(c).)
6. Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Civ. Code § 1798.12.)
   5. The right to direct a business that collects sensitive personal information about the consumer to limit its use of that information to specified necessary uses. (Civ. Code § 1798.121.)
   6. The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
7. Prohibits a business from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. (Civ. Code § 1798.120 (c).)
8. States that both personal information and sensitive personal information that is “publicly available” is not considered personal or sensitive. (Civ. Code § 1798.140,)
9. Defines the following terms under the CCPA:
   1. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
      1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
      2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
      3. Biometric information.
      4. Internet activity information, including browsing history and search history.
      5. Geolocation data.
      6. Audio, electronic, visual, thermal, olfactory, or similar information.
      7. Professional or employment-related information. (Civ. Code § 1798.140(v).)
   2. “Publicly available” means any of the following:
      1. Information that is lawfully made available from federal, state, or local government records.
      2. Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
      3. Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Civ. Code § 1798.140(v)(2)(B).)
   3. “Sensitive personal information” means:
      1. Personal information that reveals:
         1. A consumer’s social security, driver’s license, state identification card, or passport number.
         2. A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
         3. A consumer’s precise geolocation.
         4. A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
         5. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
         6. A consumer’s genetic data.
         7. A consumer’s neural data.
            1. “Neural data” means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.
         8. The processing of biometric information for the purpose of uniquely identifying a consumer.
         9. Personal information collected and analyzed concerning a consumer’s health.
         10. Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. (Civ. Code § 1798.140(ae).)
10. States that “personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. (Civ. Code § 1798.140(v)(2)(A).)
11. States that “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (Civ. Code § 1798.140(v)(2)(B).)
12. Requires a business to provide clear and conspicuous links on its homepage allowing consumers to opt-out of the sale or sharing of their personal information and use or disclosure of their sensitive personal information. (Civ. Code § 1798.135(a).)
13. Establishes the California Privacy Protection Agency (Privacy Agency), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
14. Establishes the Data Broker Registration Law (DBRL). (Civ. Code §§ 1798.99.80-1798.99.88.)
15. Defines a “data broker” as a business that knowingly collects and sells the personal information of a consumer to a third party that the business does not have a direct relationship with. (Civ. Code § 1798.99.80.)
16. Requires data brokers to register annually with the California Privacy Protection Agency (CPPA) and provide specified information. (Civ. Code § 1798.99.82.)
17. Requires the CPPA, by January 1, 2026, to develop an accessible deletion mechanism that allows a consumer to request that every registered data broker delete any personal information held by the broker. (Civ. Code § 1798.99.86.)

COMMENTS:

1) Author’s statement. According to the author:

As California becomes more dependent on technology, the companies we share our sensitive personal information with have an obligation to ensure it is safeguarded at all times.

Currently, the California Consumer Privacy Act (CPPA) allows data brokers and corporations to sell & share sensitive personal information they consider publicly available. Federal legislation such as the Children's Online Privacy Protection Act fails to prohibit data brokers from selling data belonging to children. As a result, data brokers can legally sell sensitive personal information to government agencies, bypassing legal processes and procedures to request this information. This is especially alarming as governmental agencies are increasingly surveilling and targeting Californians, especially undocumented immigrants and children.

Senate Bill 435 addresses the loophole in the CCPA by changing the definition of “sensitive personal information” that allows it to be considered “publicly available”. This single change increases the privacy and security of consumers and prevents data brokers and corporations from selling or sharing sensitive personal information.

2) Historical perspective. To fully understand how completely people in California and throughout the country have ceded the right to live their lives in private, free from both government and private surveillance, privacy experts reflect on the concerns raised by federal and state lawmakers 50 years ago when debating the creation of the FBI’s National Crime Information Center’s computerized data collection system (NCIC). This database that was so controversial at the time allowed local, state, and federal law enforcement agencies to share personal data related to suspected criminal activities. Congress held “days and days” of hearings over two years. Members warned of the “threat of the dictatorship of dossiers.”^[1]

During the debates, Senator Barry Goldwater of Arizona lamented, “Where will it end? . . . Will we permit all computerized systems to interlink nationwide so that every detail of our personal lives can be assembled instantly for use by a single bureaucrat or institution?”^[2] Senator Charles H. Percy of Illinois in foreshadowing of what would come to pass in the 21st century warned:

I hope that we never see the day when a bureaucrat in Washington or Chicago or Los Angeles can use his organization’s computer facilities to assemble a complete dossier of all known information about an individual. But, I fear that is the trend. . . . Federal agencies have become omnivorous fact collectors—gathering, combining, using, and trading information about persons without regard for his or her rights of privacy. Simultaneously, numerous private institutions have also amassed huge files . . . of unprotected information on millions of Americans.^[3]

During the same period when Congress was expressing concern about the erosion of individuals’ privacy protections, the people of California used the initiative process to add “privacy” to the list of “inalienable rights” in the state constitution in 1972.^[4] Proponents noted the initiative was specifically designed to preserve Californians’ private lives and fundamental rights in the face of technological advances. They argued: “The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . .”^[5]

As Oakland Privacy has so eloquently detailed in their support letter for another privacy bill:

In 1972, in the wake of revelations about the abuses of J. Edgar Hoover’s FBI and the Cointelpro program, Californians, by a 62.9% yes vote, added the right to privacy to California’s state constitution via Prop 11. ACA 51, introduced by assembly member Ken Cory added privacy to the list of the inalienable rights of the people of the state and replaced the word “men” with the word “people” in the state constitution.

Cory explained:

In the face of a cybernetics revolution and the increasingly pervasive amount of information being compiled, it would be highly desirable that our constitution state in clear terms that each person has a fundamental right to privacy… The constitutional amendment would create a positive, inalienable right to privacy and “put the State and private firms on notice that the people have this fundamental right and it can only be abridged when the public concern is an overriding concern.

Cory battled opposition from private industry, the Department of Motor Vehicles and law enforcement, but was eventually able to corral support from 2/3 of both houses of the Legislature. Prop 11 went on the November 1972 ballot with an argument in support from State Senate Majority Leader George Moscone:

“The proliferation of government snooping and data collecting is threatening to destroy our traditional freedoms. Government agencies seem to be competing to compile the most extensive sets of dossiers of American citizens. Computerization of records makes it possible to create ‘cradle-to-grave’ profiles of every American. At present there are no effective restraints on the information activities of government and business. This amendment creates a legal and enforceable right of privacy for every Californian.”

“The right of privacy is the right to be left alone. It is a fundamental and compelling interest. It protects our homes, our families, our thoughts, our emotions, our expressions, our personalities, our freedom of communion and our freedom to associate with the people we choose. It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes or to embarrass us. Fundamental to our privacy is the ability to control circulation of personal information. This is essential to social relationships and personal freedom. The proliferation of government and business records over which we have no control limits our ability to control our personal lives” [Citations omitted.]

Arguably, the present is even more of a dictatorship of dossiers than the 92nd and 93rd Congresses and the voters of California envisioned, with not only governments, our own and others, being able to monitor individual’s private lives, but virtually every private business or individual with enough resources and technological savvy having access to those dossiers as well. University of Virginia Law Professor, Danielle Citron, warned in an interview with The Guardian in 2022, “We don’t viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us.”^[6]

Professor Citron continues to raise alarms about the on-going decimation of the right to privacy:

In the United States, the quantity of personal data collected, used, shared, sold, and stored has grown to the point of international embarrassment. NCIC is one node in the criminal justice and intelligence “information sharing environment.” Private- and public-sector databases reveal the most intimate details of people’s lives, including their thoughts, searches, browsing habits, bodies, health, sexual orientation, gender, sexual activities, and close relationships. The quantity and quality of personal data being amassed has exceeded all warning; the distinction between public and private collection efforts has vanished; the privacy that people want, expect, and deserve has been, and continues to be, under assault.^[7] [Citations omitted.]

Catherine Powell, adjunct senior fellow for women and foreign policy at the Council on Foreign Relations, pointed out in 2023 in a blog post for the Council:

If you’ve engaged with any form of technology recently—whether through a smartphone, social media, a fitness tracker, even a seemingly innocuous game like Candy Crush—you have accumulated a substantial amount of intimate privacy data. Intimate data ranges from your location, to when you fall asleep, to even more closely guarded information like your menstrual cycle or sexual partners. And every day, this data is scraped, bought, and sold by data brokers to third parties. Beyond violating our privacy, this repurposing of our personal data undermines our security.^[8]

3) California Consumer Privacy Act. In 2018, the Legislature enacted the CCPA (AB 375; Chau, Chap. 55, Stats. 2018), which gave consumers certain rights regarding their personal information,^[9] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age. In addition, the CCPA defined “publicly available” as “information that is lawfully made available from federal, state, or local government records, if any conditions associated with such information. This definition excluded biometric information collected by a business about a consumer without the consumer’s knowledge. Additionally, under the CCPA passed in 2018, information was not “publicly available” if that data is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained.”

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which both established additional privacy rights for Californians and arguably weakened other privacy rights. Chief among these additional rights was the right of a consumer to limit a business’s use of sensitive personal information.^[10] However, the CPRA also expanded the exemption for “publicly available” information to include, in addition to lawfully available information from government records, the following:

1. Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
2. Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

The CPRA also removed the provision stating that “publicly available” no longer applies to data that is being used for a purpose that is not compatible with the purpose for which the data is maintained and made available.

In addition, the exemption for publicly available personal information was also applied to a new category – sensitive personal information. While these changes to the publicly-available exemption, theoretically, were designed to exempt information that a person posts on a social media platform, proponents of the bill argue that a company could claim that it believed someone’s sensitive information was made available to the general public or that the person disclosed the information to a second party and had not requested that the sharing be restricted.

One of the most important components of Proposition 24 was establishing that the CCPA, as amended, was a floor and not a ceiling for privacy protection. Essentially, to protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy.^[11]

5) Challenges with California’s privacy laws. The proponents of the 1972 ballot measure noted the initiative was specifically designed to preserve Californians’ private lives and fundamental rights in the face of technological advances. They argued: “The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . .”^[12]

Fifty years later, with the voters’ passage of the CPRA, California had the most comprehensive laws in the country when it came to protecting consumers’ rights to privacy. Since the passage of the CPRA, however, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to “opt in” to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[13] In the states that have come after California, privacy is the default while in California, the ability of businesses to share and profit from the selling of personal information, including sensitive information, is the default.

The CCPA relies on consumers actively exercising their rights to “opt out” of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

Overall, one could also argue that the State’s current privacy laws, including laws protecting Californians from government surveillance and protections against unreasonable searches and seizures without an appropriate court order, fall short of the protections envisioned by the Legislature and the voters in 1972. The proponents argued for a much more stringent level of protection – the right to be left alone. The authors of that proposition promised that adding a right to privacy would ensure the protection of “our homes, our families, thoughts, our emotions, our expressions, our personalities, our freedom of communion, and our freedom to associate with the people we choose.”^[14] In 2025, a person would be hard-pressed to find that level of privacy in their homes, much less in public spaces the moment they step outside.

6) Analysis. As it pertains to this bill, elected officials in debating privacy in both the state and federal governments 50 years ago clearly foresaw the future facing the country if people’s privacy was not aggressively protected. Unfortunately, one could argue it is unlikely that the voters in 2020 contemplated or understood that people’s most sensitive personal information could be shared to hundreds of companies within seconds and could change hands and be coupled with other personal information by thousands of companies in order to create detailed profiles that include every aspect of a person’s life.^[15]

In addition, it is unlikely that many voters who voted in favor of the CPRA understood that the initiative changed the definition of “publicly available” in a way that potentially created a loophole where companies could argue that the consumer did not expressly restrict the information to only being shared with a specific audience. As a result of that failure, they made the sensitive information publicly available and therefore cannot prohibit a business from using, sharing, or selling data. Fortunately, as noted above, the proponents of the CPRA and the voters understood that the Legislature may need to strengthen the CPRA in order to continue to protect Californians’ right to privacy.

The intent of this bill is to more consistently protect sensitive information by, at a minimum, ensuring that even if sensitive personal information appears to be publicly available, it still remains sensitive information and is subject to the provisions in the CCPA that allow consumers to opt out of the use of that information. That approach would arguably be an important step toward improving people’s privacy.

The opponents, however, argue that eliminating the publicly-available exemption potentially violates the First Amendment. It should be noted at the outset that it appears the issue was not significant enough to warrant a referral to the Judiciary Committee, which has jurisdiction over bills with clear First Amendment implications. Furthermore, the restrictions at stake are rather modest: status as “sensitive information” under the CCPA enables consumers, on a business-by-business basis, to opt out of the sharing of such information and/or to restrict the scope of its use. And, as a general matter, First Amendment protections in the commercial context are less stringent.^[16]

Opposition cites to provisions assuring the public’s right to access information from the government.^[17] This bill does not appear to implicate that right, which does not speak to a business’s right to monetize information obtained from government records. Opposition also cites to cases affirming “the right to receive information and ideas”^[18] and “the creation and dissemination of information is speech for First Amendment purposes.”^[19] It is not clear why these general statements show a specific violation arising from a bill enabling a consumer to request that a business not sell sensitive information, such as their immigration status or sexual orientation, even if the information has, technically, been made publicly available under the broad wording of the exemption. Indeed, biometric information already is not subject to the publicly-available exemption, and there does not appear to be a case holding this exclusion violates the First Amendment. Finally, the opposition argues:

Lastly, we also note that SB 435 also threatens to decrease privacy protections for consumers by forcing businesses to go through any publicly available information they possess and figure out whether it may contain arguably sensitive personal information. This means having to identify or otherwise link publicly available information to specific consumers, which runs contrary to the CCPA and privacy principles. To make this determination, businesses would have to figure out whom each data point belongs to and then assess whether the data point reveals something sensitive about them. In other words, a business would be put in the position of identifying or linking the data points to particular individuals, at the same that that Section 1798.145(j)(1) expressly states that nothing in the CCPA shall be construed to require businesses to “reidentify or otherwise link information that, in the ordinary course of business, is not maintained in a manner that would be considered personal information. At best this causes confusion; at worst it creates a conflict.

Nothing in this bill, however, changes the provisions in the CCPA that exempt businesses from their obligations under the act if they are collecting, using, retaining, selling, sharing, or disclosing consumers’ personal information that is deidentified or aggregate consumer information.^[20] Further, nothing in this bill changes the fact that consumers are still required to opt out of the use of their sensitive information. So assuming a business gets a request from a consumer asking to opt out of the use, sale, and sharing of their sensitive information, the information would not count as such if it has already been deidentified or aggregated. Given those protections, it is unclear how requiring that publicly available sensitive information still be treated as sensitive information would require the reidentification of deidentified consumer information.

Given these considerations, one could reasonably argue that this bill, which protects a person’s most sensitive personal information, whether or not it is publicly available, is consistent with and furthers the purpose and intent of the CPRA, which is to protect California consumers’ constitutional right to privacy. A question for this Committee is whether acts such as posting a picture of a visit to one’s the country birth or a comment about their relationship means that information is no longer sensitive or theirs to control, but rather is fair game to be scraped and monetized.

7) Amendments. The author has agreed to the following clarifying amendment:

Civ. Code § 1798. 140(v)(2)(B)(ii) “Publicly available” does not mean include either of the following:

(I) Sensitive personal information.

(II) Biometric information collected by a business about a consumer without the consumer’s knowledge.

ARGUMENTS IN SUPPORT: Courage California, writes in support:

Under current law, the CCPA states sensitive personal information that is “publicly available” is not considered sensitive personal information or personal information. Consequentially, data brokers and corporations can legally sell or share sensitive personal information—including information on children.

Additionally, this loophole allows governmental agencies to bypass the 4th amendment and increasingly surveil Californians, especially undocumented immigrants.

SB 435 will address the loophole in the definition of “sensitive personal information” by removing language that allows this data to be treated as anything less than sensitive & private.

Also arguing in support of the bill, Asian Americans Advancing Justice Southern California writes:

This bill is essential to protect the digital privacy and physical safety of California’s AAPI immigrant communities, especially those who are undocumented or are survivors of abuse and exploitation. With over one in seven Asian immigrants in California estimated to be undocumented, privacy is a matter of livelihood and safety. Under the current framework, gaps in how sensitive information is defined put individuals at risk of having sensitive information such as their immigration status, ethnicity, genetic data shared without meaningful safeguards. Such exposure can lead to devastating outcomes like detention, family separation, or exploitation by malicious actors.

This bill also holds significance for AAPI survivors of domestic violence, human trafficking, and sexual assault. Cultural stigma, language barriers, and immigration-related fears often prevent survivors from seeking help. Weak privacy protections further isolate them by increasing the risk that personal data could be accessed by abusers or inadvertently shared with immigration enforcement. Updating the CCPA to reflect these risks provides a more inclusive, trauma-informed privacy framework that respects the dignity and safety needs of some of California’s most marginalized populations.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for Children's Rights
Asian Americans Advancing Justice Southern California
Courage California
Oakland Privacy
Secure Justice
Seiu California
Unidosus

Oppose

Association of National Advertisers
California Chamber of Commerce
Computer and Communications Industry Association
Consumer Data Industry Association
Cspra
Insights Association
Software Information Industry Association
State Privacy and Security Coalition, INC.
Techca
Technet

Analysis Prepared by: Julie Salley & Josh Tosney / P. & C.P. / (916) 319-2200

1. Citron, Danielle Keats, A More Perfect Privacy, 104 Boston University Law Review, 1073–1086 (2024). ↑

2. Ibid. ↑

3. Ibid. ↑

4. California Proposition 11 (1972), “Constitutional Right to Privacy Amendment.” ↑

5. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

6. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) available at https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

7. Citron, 2024. ↑

8. Powell, Catherine. “Data is the New Gold, But May Threaten Democracy and Dignity,” Council on Foreign Relations (Jan. 5, 2023) https://www.cfr.org/blog/data-new-gold-may-threaten-democracy-and-dignity-0. ↑

9. Civ. Code § 1798.140(v). See EXISTING LAW #9(a) for definition. ↑

10. Civ. Code § 1798.140(ae). See EXISTING LAW #9(b) for definition. ↑

11. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74 ↑

12. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

13. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf. ↑

14. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props.. ↑

15. For more information on how information is sold and shared, see Don Marti, et al. “Who Shares Your Information with Facebook? Sampling the Surveillance Economy 2023,” Consumer Reports (Jan. 2024) https://advocacy.consumerreports.org/research/report-who-shares-your-information-with-facebook/ ↑

16. See Central Hudson v. Public Svn. Comm’n (1980) 447 U.S. 557, 562 ↑

17. Cal. Const. Art. 1, § 3 states: “The people have the right of access to information concerning the conduct of the people’s business, and therefore, the meetings of public bodies, and the writings of public officials and agencies shall be open to public scrutiny.” ↑

18. Stanley v. Georgia (1969) 394 U.S. 557 ↑

19. Sorrell v. IMS Health Inc. (2011) 564 U.S. 552, 570. ↑

20. Civil Code § 1798.145 (a)(1)(F). ↑

 THIRD READING  

Bill No: SB 435

Author: Wahab (D), et al.

Amended: 4/23/25

Vote: 21

SENATE HUMAN SERVICES COMMITTEE: 5-0, 4/21/25

AYES: Arreguín, Ochoa Bogh, Becker, Limón, Pérez

SENATE APPROPRIATIONS COMMITTEE: 6-0, 5/23/25

AYES: Caballero, Seyarto, Cabaldon, Grayson, Richardson, Wahab

NO VOTE RECORDED: Dahle

SUBJECT: Residential care facilities for the elderly: emergency backup power source

SOURCE: Author

DIGEST:

This bill requires, on and after January 1, 2028, a residential care facility for the elderly (RCFE) licensed for 16 or more residents to have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage. This bill requires an RCFE to follow emergency and disaster preparedness measures, as specified, depending on the chosen type of alternative power source.

ANALYSIS:

Existing law:

1. Requires a person, firm, partnership, association, corporation, or state or local public agency to have a current valid license to operate, establish, manage, conduct, or maintain an RCFE. (Health and Safety Code (HSC) 1569.10)
2. Requires the State Department of Social Services (CDSS) to inspect and license RCFEs. (HSC 1569.11)
3. Requires an RCFE to have an emergency and disaster plan that must include, but not be limited to, the following:
   1. Evacuation procedures, including identification of an assembly point or points that must be included in the facility sketch.
   2. Plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure.
   3. Procedures that address, but are not limited to, all of the following:
      1. Provision of emergency power that could include identification of suppliers of backup generators.
      2. Responding to an individual resident’s needs if the emergency call buttons are inoperable.
      3. Storage and preservation of medications, including the storage of medications that require refrigeration.
      4. The operation of assistive medical devices that need electric power for their operation, including, but not limited to, oxygen equipment and wheelchairs. (HSC 1569.695(a))
4. Requires a facility to review the plan annually and make updates as necessary, including changes in floor plans and the population served. (HSC 1569.695(d))
5. Requires an RCFE to make the plan available upon request to residents onsite, any responsible party for a resident, the local long-term care ombudsman, and local emergency responders. Requires an applicant seeking a license for a new facility to submit the emergency and disaster plan with the initial licensed application. Requires the CDSS Community Care Licensing Division to confirm, during annual licensing visits, that the emergency and disaster plan is on file at the facility and includes required content. (HSC 1569.695(g-i))

This bill:

1. Requires, on and after January 1, 2028, an RCFE licensed for 16 or more residents to have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage.
   1. Requires a facility that elects to use a generator as its alternative source of power to use a permanently affixed generator that can operate 24 hours per day. Requires the facility to maintain sufficient fuel onsite to maintain generator operation for no less than 72 hours or make arrangements for fuel delivery for an emergency event. If fuel is to be delivered during an emergency event, requires the facility to ensure that fuel will be available with no delays.
   2. Requires a facility that uses batteries or a combination of batteries in tandem with a renewable electrical generation facility as its alternative source of power to have sufficient storage or generation capacity to maintain operation for no fewer than 72 hours. Requires that facility to make arrangements for delivery of a generator and fuel in the event power is not restored within 48 hours and the generation capacity of the renewable electrical generation facility is unable to provide sufficient power to comply with state requirements for RCFEs.
2. Defines the following terms for purposes of this section:
   1. “Alternative source of power” means a source of electricity that is not received through an electric utility but is generated or stored onsite, which may include, but is not limited to, emergency generators using fuel, large capacity batteries, renewable electrical generation facilities, and renewable energy microgrids.
   2. “Resident health and safety” includes, but is not limited to, maintaining a safe temperature for residents, maintaining availability of life-saving equipment, and maintaining availability of oxygen-generating devices.
3. Beginning January 1, 2028, for RCFEs licensed for 16 or more residents, requires an RCFE’s emergency and disaster plan to include identification of the alternative source of power a facility has elected to use. For a permanently installed generator, requires the plan to include its location and a description of how it will be used.

Background

Purpose of this Bill. According to the author, “Wildfires, heatwaves and power shutoffs are increasingly routine in our state. Recent fire disasters have included victims who were completely powerless to help themselves during those emergencies. Across the state, patients and residents in hospitals, nursing homes and long-term care facilities depend on electric power for acute medical care and continued well-being. Seniors, the disabled and individuals with chronic health conditions rely on this power. As our state’s population continues to age, and as long as we continue to experience wildfires, record heatwaves and unexpected power outages, we must protect the health and safety of RCFE residents during emergencies. California prides itself on compassionate policy for vulnerable populations. SB 435 will correct an obvious oversight and avoid future tragedies for seniors who rely on us for their care and safety.”

Residential Care Facilities for the Elderly (RCFE). RCFEs provide housing, housekeeping, supervision, 24-hour staffing, and personal care assistance with activities of daily living, such as hygiene, dressing, eating, and walking, to individuals ages 60 and older. This level of care and supervision is for people who are unable to live by themselves but who do not need 24-hour nursing care. RCFEs are considered non-medical facilities and are not required to have nurses, certified nursing assistances, or doctors on staff, but typically bring licensed health care practitioners into the facility to provide care as necessary. As of June 2024, there were 7,578 licensed RCFEs with a capacity to serve 176,959 residents. RCFEs can range from small homes serving fewer than six residents to larger facilities that can house over 100 residents in communities.

AB 3098. AB 3098 (Friedman, Chapter 348, Statutes of 2018) was passed subsequent to the 2017 Tubbs Fire. The Tubbs Fire is among the most destructive and deadliest wildfires in California history, resulting in 22 confirmed civilian fatalities, thousands of destroyed structures, and hundreds of damaged structures. AB 3098 required an RCFE’s emergency and disaster plan to include additional elements, including, but not limited to, the following:

• Plans for the facility to be self-reliant, including during a short-term power failure.
• At least two appropriate shelter locations that can house facility residents during an evacuation, with one outside of the immediate area.
• A description of how a backup generator or portable generator will be used, if applicable.
• Procedures for storage of medications that require refrigeration.
• Procedures for confirming the location of each resident during an emergency response.

Additionally, AB 3098 required RCFEs to provide training on the emergency and disaster response plan to each staff upon hire and annually thereafter, to conduct drills at least quarterly for each shift and for quarterly drills to cover various emergency scenarios, and to review the plan annually and make updates as necessary, among other requirements. AB 3098 encouraged an RCFE to have its emergency and disaster plan reviewed by local emergency authorities.

Alternative Source of Power Requirement for Skilled Nursing Facilities. Residents at skilled nursing facilities have greater medical needs than residents at RCFEs. This difference in level of care also determines what health care devices may be used in each facility. For example, an RCFE resident may use an oxygen concentrator, but not a ventilator or respirator.

AB 2511 (Irwin, Chapter 788, Statutes of 2022) required a skilled nursing facility to have an alternative source of power to protect resident health and safety for no fewer than 96 hours during any type of power outage starting January 1, 2024. AB 2511 defined “alternative source of power” to mean a source of electricity that is generated or stored onsite rather than received through an electric utility, which may include emergency generators using fuel, large capacity batteries, and renewable electrical generation facilities. SB 1511 (Committee on Health, Chapter 492, Statutes of 2024) postponed this requirement for skilled nursing facilities to January 1, 2026. The 2025–26 May Revision, announced on May 14^th, includes a proposal to suspend this requirement for skilled nursing facilities.

Comments

The median age of individuals killed in the 2025 Los Angeles wildfires was 77, and at least one-third had mobility impairments. The recent fires have highlighted the need to improve disaster and emergency response and evacuation plans for the elderly and individuals with disabilities.

While sheltering in place may not be appropriate in all situations, sheltering in place may be necessary for a period of time prior to evacuation. Access to a reliable and accessible alternative power source onsite during a power shutoff, emergency, or disaster could benefit facility staff and residents while sheltering in place or during an evacuation.

[NOTE: See the Senate Human Services Committee analysis for detailed background of this bill.]

Related/Prior Legislation

SB 582 of the current legislative session (Stern) establishes licensing policies during federal or state declared emergencies or disasters for facilities licensed by CDSS, California Department of Public Health, and California Department of Health Care Services. SB 582 is pending on the Senate Floor.

SB 352 of the current legislative session (Reyes) requires, in specified circumstances, that area agencies on aging and independent living centers be prioritized for state assistance when a state of emergency is proclaimed. SB 352 requires Aging and Disability Resource Connection programs to provide disaster and emergency preparedness training designed to help older adults and people with disabilities prepare for emergencies. SB 352 is pending on the Senate Floor.

SB 1511 (Committee on Health, Chapter 492, Statutes of 2024), among other changes, postponed the date for skilled nursing facilities to be required to have an alternative source of power for no less than 96 hours from January 1, 2024, to January 1, 2026.

AB 2511 (Irwin, Chapter 788, Statutes of 2022) required skilled nursing facilities to have an alternative source of power to protect resident health and safety for no less than 96 hours during any type of power outage. AB 2511 required skilled nursing facilities to comply with this requirement by January 1, 2024.

AB 3098 (Friedman, Chapter 348, Statutes of 2018) updated the updated the required content for an RCFE’s emergency and disaster plan and required CDSS to confirm that the plan is on file and includes the required content. Among other things, AB 3098 required an RCFE to have a plan for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including a short-term power failure, in addition to the existing requirement to plan for a long-term power failure.

AB 749 (Wolk, Chapter 477, Statutes of 2008), among other things, required an RCFE to have an emergency plan that includes a plan for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a long-term power failure.

AB 2101 (Wolk) of 2008 would have required CDSS to develop a training curriculum for RCFE staff on emergency preparedness and the facility’s emergency plan. AB 2101 was held on the Assembly Appropriations Committee suspense file.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee, “CDSS estimates need for an additional 42 positions for state operations due to increased workload related to licensing activities, resulting in General Fund costs of $8,092,000 in 2025-26 and $7,900,000 in 2026-27 and ongoing thereafter.”

SUPPORT: (Verified 5/23/25)

California Alliance for Retired Americans (Sponsor)

AARP
Alzheimer's Association
California Advocates for Nursing Home Reform
California Continuing Care Residents Association

California Fire Chiefs Association
California Long Term Care Ombudsman Association
California Retired Teachers Association

Consumer Attorneys of California
Essential Caregivers Coalition
Justice in Aging
Retired Public Employees Association

OPPOSITION: (Verified 5/23/25)

Leadingage California

ARGUMENTS IN SUPPORT:

According to California Alliance for Retired Americans, “Power outages that commonly accompany disasters can be a grave threat to many assisted living facility residents. Research shows that power outage has been directly associated with adverse outcomes among nursing home residents, which may be explained by interruption to electricity-dependent healthcare and custodial services and residents’ diminished capacity to tolerate temperature fluctuations. Inadequate standby power resiliency may also indirectly increase the risk of adverse outcomes by influencing the likelihood of a potentially avoidable evacuation. If skilled nursing facilities (SNFs) can afford alternative sources of power for 96 hours during any type of power outage, then assisted living facilities can afford alternative sources of power for 72 hours. A recent study found the average SNF profit margin was 8.84 percent, while the American Seniors Housing Association reports that assisted living facilities have a median profit of 20 percent.”

ARGUMENTS IN OPPOSITION:

According to Leading Age, “SB 435 will have significant cost impacts on RCFEs, and in some cases will lead to the closure of RCFEs, which will lead to a reduction in access to these vital services for older adults. In many cases, this increased cost will be borne by the residents, further impacting affordability of assisted living. For facilities in urban areas, the installation of a large scale backup power sources may be unfeasible, causing that facility to face closure. The requirements included in this bill are mirrored after the requirement for skilled nursing facilities, which is causing many to upgrade their generators at a cost of $500,000 to $1.5 million per facility. Due to this demand, there is a delay of up to 1.5 to 2 years, in production and availability of generators of this magnitude. We believe increased emergency preparedness and response efforts could better address evacuation needs during an emergency. LeadingAge California is concerned that this bill significantly hinders progress toward increasing the state’s supply of long-term services and supports.”

Prepared by: Diana Dominguez / HUMAN S. / (916) 651-1524

5/26/25 13:19:30

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

SB 435 (Wahab) - Residential care facilities for the elderly: emergency backup power source

Bill Summary:

SB 435 would require a residential care facility for the elderly (RCFE) licensed for 16 or more residents to have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage.

Fiscal Impact:

The California Department of Social Services (CDSS) estimates need for an additional 42 positions for state operations due to increased workload related to licensing activities, resulting in General Fund costs of $8,092,000 in 2025-26 and $7,900,000 in 2026-27 and ongoing thereafter.

Background:

RCFEs are responsible for providing housing, housekeeping, supervision, 24-hour staffing, and personal care assistance with activities of daily living, such as hygiene, dressing, eating, and walking, to individuals ages 60 and older. California’s network of RCFEs ranges from small homes serving fewer than six residents to larger RCFEs that can house over 100 residents in communities across the state. This level of care and supervision is for people who are unable to live by themselves but who do not need 24-hour nursing care. RCFEs are considered non-medical facilities and are not required to have nurses or doctors on staff, but typically bring licensed health care practitioners into the facility to provide care as necessary. Some RCFEs include memory care units for seniors with dementia. The CDSS licenses and regulates RCFEs.

Current law requires RCFEs to have an emergency and disaster plan that must include, but not be limited to, all of the following:

• Evacuation procedures.
• Plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. If the facility plans to shelter in place and one or more utilities, including water, sewer, gas, or electricity, is not available, the facility must have a plan and supplies available to provide alternative resources during an outage.
• Transportation needs and evacuation procedures to ensure that the facility can communicate with emergency response personnel or can access the information necessary in order to check the emergency routes to be used at the time of an evacuation and relocation necessitated by a disaster. If the transportation plan includes the use of a vehicle owned or operated by the facility, the keys to the vehicle must be available to staff on all shifts.
• Contact information, as specified.
• At least two appropriate shelter locations that can house facility residents during an evacuation.
• The location of utility shut-off valves and instructions for use.
• Procedures that address various issues, including procedures for the provision of emergency power that could include identification of suppliers of backup generators. If a permanently installed generator is used, the plan must include its location and a description of how it will be used. If a portable generator is used, the manufacturer’s operating instructions must be followed.

Proposed Law:

Specific provisions of the bill would:

• Require an RCFE licensed for 16 or more residents to have an alternative source of power, as defined, to protect resident health and safety for no fewer than 72 hours during any type of power outage.
• Require that an RCFE that elects to use a generator as its alternative source of power must use a permanently affixed generator that can operate 24 hours a day; must maintain sufficient fuel onsite to maintain generator operation for no less than 72 hours or make arrangements for fuel delivery for an emergency event; and if fuel is to be delivered during an emergency event, the facility must ensure that fuel will be available with no delays.
• Require that an RCFE that uses batteries or a combination of batteries in tandem with a renewable electrical generation facility as its alternative source of power must have sufficient storage or generation capacity to maintain operation for no fewer than 72 hours; and require the RCFE to make arrangements for delivery of a generator and fuel in the event power is not restored within 48 hours and the generation capacity of the renewable electrical generation facility is unable to provide sufficient power to comply with state requirements for RCFEs.
• Require the RCFE emergency and disaster plan to also include, for facilities licensed for 16 or more residents, identification of the alternative source of power a facility has elected to use pursuant to the above provisions; and require, for a permanently installed generator, that the plan must include its location and a description of how it will be used.

-- END --

SENATE COMMITTEE ON HUMAN SERVICES

Senator Arreguín, Chair

2025 - 2026 Regular

Subject: Residential care facilities for the elderly: emergency backup power source

SUMMARY

This bill would require, on and after January 1, 2027, a residential care facility for the elderly (RCFE) licensed for 16 or more residents to have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage. This bill would require an RCFE to follow emergency and disaster preparedness measures, as specified, depending on the chosen type of alternative power source.

ABSTRACT

Existing Law:

1. Establishes the California RCFE Act. (Health and Safety Code [HSC] 1569 et seq.)
2. Defines RCFE as a housing arrangement chosen voluntarily by persons 60 years of age or over, or their authorized representative, where varying levels and intensities of care and supervision, protective supervision, or personal care are provided, based upon their varying needs, as determined, in order to be admitted or remain in the facility. Allows persons under 60 years of age with compatible needs to be admitted or retained if a licensee determines that person is compatible, as defined. (HSC 1569.2)
3. Requires a person, firm, partnership, association, corporation, or state or local public agency to have a current valid license to operate, establish, manage, conduct, or maintain an RCFE. (HSC 1569.10)
4. Requires the State Department of Social Services (CDSS) to inspect and license RCFEs. (HSC 1569.11)
5. Requires an RCFE to have an emergency and disaster plan that must include, but not be limited to, the following:
   1. Evacuation procedures, including identification of an assembly point or points that must be included in the facility sketch.
   2. Plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. If the facility plans to shelter in place and one or more utilities, including water, sewer, gas, or electricity, is not available, the facility must have a plan and supplies available to provide alternative resources during an outage.
   3. Transportation needs and evacuation procedures to ensure that the facility can communicate with emergency response personnel or can access the information necessary in order to check the emergency routes to be used at the time of an evacuation and relocation necessitated by a disaster. If the transportation plan includes the use of a vehicle owned or operated by the facility, the keys to the vehicle must be available to staff on all shifts.
   4. A contact information list of all of the following:
      1. Emergency response personnel.
      2. The Community Care Licensing Division within CDSS.
      3. The local long-term care ombudsman.
      4. Transportation providers.
   5. At least two appropriate shelter locations that can house facility residents during an evacuation. One of the locations must be outside of the immediate area.
   6. The location of utility shut-off valves and instructions for use.
   7. Procedures that address, but are not limited to, all of the following:
      1. Provision of emergency power that could include identification of suppliers of backup generators. If a permanently installed generator is used, the plan must include its location and a description of how it will be used. If a portable generator is used, the manufacturer’s operating instructions must be followed.
      2. Responding to an individual resident’s needs if the emergency call buttons are inoperable.
      3. Process for communicating with residents, families, hospice providers, and others, as appropriate, that might include landline telephones, cellular telephones, or walkie-talkies. A backup process must also be established. Residents and their responsible parties must be informed of the process for communicating during an emergency.
      4. Assistance with, and administration of, medications.
      5. Storage and preservation of medications, including the storage of medications that require refrigeration.
      6. The operation of assistive medical devices that need electric power for their operation, including, but not limited to, oxygen equipment and wheelchairs.
      7. A process for identifying residents with special needs, such as hospice, and a plan for meeting those needs.
      8. Procedures for confirming the location of each resident during an emergency response. (HSC 1569.695(a))
6. Requires an RCFE to provide training on the plan to each staff member upon hire and annually thereafter. Requires the training to include staff responsibilities during an emergency or disaster. (HSC 1569.695(b))
7. Requires a facility to conduct a drill at least quarterly for each shift. Requires the type of emergency covered in a drill to vary from quarter to quarter, taking into account different emergency scenarios. Specifies an actual evacuation of residents is not required during a drill, and specifies that a facility may provide an opportunity for residents to participate in a drill, but that a facility shall not require any resident participation. Requires documentation of the drills to include the date, type of emergency covered by the drill, and the names of staff participating in the drill. (HSC 1569.695(c))
8. Requires a facility to review the plan annually and make updates as necessary, including changes in floor plans and the population served. Requires the licensee or administrator to sign and date documentation to indicate that the plan has been reviewed and updated as necessary. (HSC 1569.695(d))
9. Requires an RCFE to have all of the following information readily available to facility staff during an emergency:
   1. A resident roster with the date of birth for each resident.
   2. An appraisal of resident needs and services plan for each resident.
   3. A resident medication list for residents with centrally stored medications.
   4. Contact information for the responsible party and physician for each resident. (HSC 1569.695(e))
10. Requires an RCFE to have both of the following in place:
    1. An evacuation chair at each stairwell, on or before July 1, 2019.
    2. A set of keys available to facility staff on each shift for use during an evacuation that provides access to all of the following:
       1. All occupied resident units.
       2. All facility vehicles.
       3. All facility exit doors.
       4. All facility cabinets and cupboards or files that contain elements of the emergency and disaster plan, including, but not limited to, food supplies and protective shelter supplies. (HSC 1569.695(f))
11. Requires an RCFE to make the plan available upon request to residents onsite, any responsible party for a resident, the local long-term care ombudsman, and local emergency responders. Requires resident and employee information to be kept confidential. (HSC 1569.695(g))
12. Requires an applicant seeking a license for a new facility to submit the emergency and disaster plan with the initial licensed application. (HSC 1569.695(h))
13. Requires the CDSS Community Care Licensing Division to confirm, during annual licensing visits, that the emergency and disaster plan is on file at the facility and includes required content. (HSC 1569.695(i))
14. States that an RCFE is encouraged to have the emergency and disaster plan reviewed by local emergency authorities. (HSC 1569.695(j))
15. Specifies nothing in this section shall create a new or additional requirement for CDSS to evaluate the emergency and disaster plan. (HSC 1569.695(k))
16. Requires each RCFE to have a disaster and mass casualty plan of action. Requires this plan to be in writing and readily available. Requires the plan to be subject to review by CDSS and for emergency exiting plans and telephone numbers to be posted. Requires the disaster and mass casualty plan to include all of the following:
    1. Designation of administrative authority and staff assignments.
    2. Plan for evacuation including:
       1. Fire safety plan.
       2. Means of exiting.
       3. The assembly of residents to a predetermined evacuation site.
       4. Transportation arrangements.
       5. Relocation sites which are equipped to provide safe temporary accommodations for residents.
       6. Supervision of residents during evacuation or relocation and contact after relocation to assure that relocation has been completed as planned.
    3. Provision for notifying a resident’s hospice agency, if any, in the event of evacuation and/or relocation. (22 CCR 87212)
17. Requires an RCFE, in order to accept or retain a person who is bedridden, to ensure the facility’s Emergency and Disaster Plan addresses fire safety precautions specific to evacuation of residents who are bedridden in the event of an emergency or disaster. (22 CCR 87606(f)(1)(A))

This Bill:

1. Requires, on and after January 1, 2027, an RCFE licensed for 16 or more residents to have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage.
   1. Requires a facility that elects to use a generator as its alternative source of power to use a permanently affixed generator that can operate 24 hours per day. Requires the facility to maintain sufficient fuel onsite to maintain generator operation for no less than 72 hours or make arrangements for fuel delivery for an emergency event. If fuel is to be delivered during an emergency event, requires the facility to ensure that fuel will be available with no delays.
   2. Requires a facility that uses batteries or a combination of batteries in tandem with a renewable electrical generation facility as its alternative source of power to have sufficient storage or generation capacity to maintain operation for no fewer than 72 hours. Requires that facility to make arrangements for delivery of a generator and fuel in the event power is not restored within 48 hours and the generation capacity of the renewable electrical generation facility is unable to provide sufficient power to comply with state requirements for RCFEs.
2. Defines the following terms for purposes of this section:
   1. “Alternative source of power” means a source of electricity that is not received through an electric utility but is generated or stored onsite, which may include, but is not limited to, emergency generators using fuel, large capacity batteries, and renewable electrical generation facilities.
   2. “Resident health and safety” includes, but is not limited to, maintaining a safe temperature for residents, maintaining availability of life-saving equipment, and maintaining availability of oxygen-generating devices.
3. Beginning January 1, 2027, for RCFEs licensed for 16 or more residents, requires an RCFE’s emergency and disaster plan to include identification of the alternative source of power a facility has elected to use. For a permanently installed generator, requires the plan to include its location and a description of how it will be used.
4. Specifies no reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution.

FISCAL IMPACT

This bill has not yet been analyzed by a fiscal committee.

BACKGROUND AND DISCUSSION

Purpose of the Bill:

According to the author, “Wildfires, heatwaves and power shutoffs are increasingly routine in our state. Besides the loss of life and infrastructure, recent fire disasters have included victims who were completely powerless to help themselves during those emergencies. Across the state, patients and residents in hospitals, nursing homes and long-term care facilities depend on electric power for acute medical care and continued well-being. Seniors, the disabled and individuals with chronic health conditions rely on this power in a number of ways: powered wheelchairs and ventilators, rechargeable cardiac devices and hearing aids, or systems that maintain controlled conditions that their health and safety depends upon. Every healthcare facility infrastructure itself is dependent on electricity for their operations, from lighting to security systems, elevators, food operations, electronic health records, essential medical equipment and more – the list is extensive. These requirements make it so that hospitals and skilled nursing facilities cannot suspend operations – without power, facilities put vulnerable populations in danger.

“AB 2511, which became law last year, requires skilled nursing facilities to have an alternative source of power for no fewer than 96 hours during any type of power outage. As our state’s population continues to age, we must correct the shortcoming that residential care facilities for the elderly (RCFEs) are not included as facilities requiring the same standards as SNFs. So as long as we continue to experience wildfires, record heatwaves and unexpected power outages, we must protect the health and safety of RCFE residents during those emergencies. The stories of our elderly and disabled rescued from smoked filled hallways and fires by their loved ones because power outages prevented them from using elevators to escape cannot become normalized. California prides itself on compassionate policy for vulnerable populations. SB 435 will correct an obvious oversight and avoid future tragedies for seniors who rely on us for their care and safety.”

Residential Care Facilities for the Elderly (RCFE)

Sometimes referred to as assisted living facilities, RCFEs are responsible for providing housing, housekeeping, supervision, 24-hour staffing, and personal care assistance with activities of daily living, such as hygiene, dressing, eating, and walking, to individuals ages 60 and older. California’s network of RCFEs ranges from small homes serving fewer than six residents to larger RCFEs that can house over 100 residents in communities across the state. This level of care and supervision is for people who are unable to live by themselves but who do not need 24-hour nursing care. RCFEs are considered non-medical facilities and are not required to have nurses, certified nursing assistances, or doctors on staff, but typically bring licensed health care practitioners into the facility to provide care as necessary. Some RCFEs include memory care units for seniors with dementia.

RCFEs are licensed and regulated by CDSS’s Community Care Licensing Division. The Community Care Licensing Division protects the health and safety of residents in RCFEs through its regulatory and enforcement programs. In addition to its licensing requirements, the Community Care Licensing Division conducts regular inspections of facilities to assess compliance with applicable laws and regulations. As of June 2024, there were 7,578 licensed RCFEs with a capacity to serve 176,959 residents.^[1] The majority of these facilities have six or fewer beds. This bill would apply to RCFEs licensed for 16 or more residents.

Tubbs Fire and AB 3098

The Tubbs Fire broke out in Sonoma and Napa Counties in October 2017. The Tubbs Fire is among the most destructive and deadliest wildfires in California history, resulting in 22 confirmed civilian fatalities, thousands of destroyed structures, and hundreds of damaged structures.^[2],[3] Villa Capri and Varenna, two RCFEs owned and operated by Oakmont Senior Living, faced licensing revocation and legal action following alleged actions during the Tubbs Fire. A 2018 CDSS complaint investigation report^[4] found, among other things, that Villa Capri staff left more than 20 elderly and infirm residents during the fire without supervision, and that three residents at Varenna who were asleep were never evacuated. The report concluded with requests for the facilities’ licenses to be revoked and for two licensees be prohibited for life from becoming a licensee. In a Stipulation and Waiver and Order^[5], Oakmont Senior Living agreed to admit to actions taken by staff on October 8-9, 2017 as a result of the Tubbs Fire. The Stipulation offered Villa Capri and Varenna a two-year probationary period and required the facilities to submit updated emergency disaster plans instead of having the facilities’ licenses revoked.

A legal complaint filed in Sonoma County Superior Court alleged that Villa Capri and Varenna failed to adequately plan for and train staff on emergency evacuations and preparedness; failed to timely and adequately notify residents of the need for an emergency evacuation; and, during the fire, many residents were left without care or support and with no means to evacuate themselves.^[6] In 2020, the California Attorney General and Sonoma County District Attorney’s Office entered into a civil settlement and injunction with the owners and operators of Villa Capri and Varenna. The judgment required the owners and operators of the two RCFEs to pay $500,000 in civil penalties and investigation costs and included stiff injunctive terms requiring enhanced disaster and evacuation plans and training, and the appointment of an independent monitor to ensure compliance for a period of five years.^[7],[8]

A 2020 article^[9] by CalMatters reported that family members of residents at Villa Capri personally evacuated residents in smoky, dark conditions, in part due to the power being out. According to the family members, there were few staff remaining in the building, none of whom were aware of a facility evacuation plan. The article reports that while Villa Capri did have an emergency plan, one worker was not aware of it, and three other workers had never participated in a fire drill. One family member featured in the article shared that his mother died a few months later and was still traumatized by the fire at the time of her death.

AB 3098 (Friedman, Chapter 348, Statutes of 2018) was passed subsequent to the Tubbs Fire. The bill required an RCFE’s emergency and disaster plan to include additional elements, including, but not limited to, the following:

• Identification of an assembly point included in the facility sketch.
• Plans for the facility to be self-reliant, including during a short-term power failure.
• A list with contact information for emergency response personnel, the CDSS Community Care Licensing Division, local long-term care ombudsman, and transportation providers.
• At least two appropriate shelter locations that can house facility residents during an evacuation, with one outside of the immediate area.
• The location of utility shut-off valves and instructions for use.
• A description of how a backup generator or portable generator will be used, if applicable.
• A backup process for communicating with residents, families, hospice providers, and others.
• Procedures for storage of medications that require refrigeration.
• Procedures for confirming the location of each resident during an emergency response.

Additionally, AB 3098 required RCFEs to provide training on the emergency and disaster response plan to each staff upon hire and annually thereafter, to conduct drills at least quarterly for each shift and for quarterly drills to cover various emergency scenarios, and to review the plan annually and make updates as necessary, among other requirements. AB 3098 encouraged an RCFE to have its emergency and disaster plan reviewed by local emergency authorities.

This bill would require an RCFE licensed for 16 or more residents to, starting January 1, 2027, have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage. Assisted living facilities suggest that the current requirement for RCFEs to have a plan to be self-reliant for a period of 72 hours already allows an RCFE to utilize a backup power source of its choice. California Alliance for Retired Americans, sponsor of this bill, asserts that the requirements of AB 3098 are not prescriptive enough, and that RCFEs should align to alternative power source requirements for skilled nursing facilities.

Alternative Source of Power Requirement for Skilled Nursing Facilities

Residents at skilled nursing facilities have greater medical needs than residents at RCFEs. Skilled nursing facilities are medical facilities that are licensed and overseen by the Department of Public Health. According to the California Department of Aging, “The typical resident is a person who is chronically ill or recuperating from an illness or surgery and needs regular nursing care and other health related services. […] These facilities provide a protective environment with medical and social services for individuals whose care needs cannot be met at home or in a residential care setting.”^[10] This difference in level of care also determines what health care devices may be used in each facility. For example, an RCFE resident may use an oxygen concentrator, but not a ventilator or respirator.^[11] Facilities in opposition to this bill suggest that, because RCFE residents may not require as high a degree of electricity-powered medical equipment, providing an alternative source of power for the entire RCFE is unnecessary. Supporters of this bill argue that lighting, heating, and cooling throughout the RCFE, as well as refrigeration of medications, may be needed by residents during cases of emergency or disaster.

AB 2511 (Irwin, Chapter 788, Statutes of 2022) required a skilled nursing facility to have an alternative source of power to protect resident health and safety for no fewer than 96 hours during any type of power outage starting January 1, 2024. The bill defined “alternative source of power” to mean a source of electricity that is generated or stored onsite rather than received through an electric utility, which may include emergency generators using fuel, large capacity batteries, and renewable electrical generation facilities. SB 1511 (Committee on Health, Chapter 492, Statutes of 2024) postponed this requirement for skilled nursing facilities to January 1, 2026.

This bill would require an RCFE licensed for 16 or more residents to have an alternative source of power available for no fewer than 72 hours by January 1, 2027. Facilities in opposition suggest that this timeline may not be feasible, given the two-year extension that was granted to skilled nursing facilities.

This bill would define “alternative source of power” to mean a source of electricity that is generated or stored onsite rather than received through an electric utility, which may include emergency generators using fuel, large capacity batteries, and renewable electrical generation facilities—the same definition used in statute for skilled nursing facilities. According to facilities opposed to this bill, there are few batteries capable of powering a facility for 72 hours, making fuel-powered generators the only viable option under this bill, which the facilities state are already in high demand due to the requirement for skilled nursing facilities to have an alternative power source. The facilities in opposition also indicate that fuel-powered generators can cost between $250,000 and $2.5 million.

Related/Prior Legislation:

SB 582 (Stern) would establish licensing policies during federal or state declared emergencies or disasters for facilities licensed by CDSS, California Department of Public Health, and California Department of Health Care Services. This bill would authorize a facility that is made nonoperational due to its destruction, significant damage, or through a prolonged closure during and as a result of an emergency or disaster to obtain a disaster suspension of its active license. This bill would require coordination with relevant state departments, local licensing oversight agencies, and the medical health operational area coordinator, as specified. SB 582 is scheduled to be heard by this committee on April 21^st, 2025.

SB 352 (Reyes) would require, in specified circumstances, that area agencies on aging and independent living centers be prioritized for state assistance when a state of emergency is proclaimed. SB 352 would require Aging and Disability Resource Connection programs to provide disaster and emergency preparedness training designed to help older adults and people with disabilities prepare for emergencies. SB 352 will be heard in Senate Governmental Organization on April 22^nd, 2025.

SB 1511 (Committee on Health, Chapter 492, Statutes of 2024), a health trailer bill, among other changes, postponed the date for skilled nursing facilities to be required to have an alternative source of power for no less than 96 hours from January 1, 2024, to January 1, 2026.

AB 2511 (Irwin, Chapter 788, Statutes of 2022) required skilled nursing facilities to have an alternative source of power to protect resident health and safety for no less than 96 hours during any type of power outage. AB 2511 required skilled nursing facilities to comply with this requirement by January 1, 2024.

AB 3098 (Friedman, Chapter 348, Statutes of 2018) updated the updated the required content for an RCFE’s emergency and disaster plan and required CDSS to confirm that the plan is on file and includes the required content. Among other things, AB 3098 required an RCFE to have a plan for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including a short-term power failure, in addition to the existing requirement to plan for a long-term power failure.

AB 749 (Wolk, Chapter 477, Statutes of 2008), among other things, required an RCFE to have an emergency plan that includes a plan for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a long-term power failure.

AB 2101 (Wolk, 2008) would have required CDSS to develop a training curriculum for RCFE staff on emergency preparedness and the facility’s emergency plan. AB 2101 was held on the Assembly Appropriations Committee suspense file.

COMMENTS

The median age of individuals killed in the 2025 Los Angeles wildfires was 77, and at least one-third had mobility impairments. The recent fires have highlighted the need to improve disaster and emergency response and evacuation plans for the elderly and individuals with disabilities.

This bill seeks to require RCFEs licensed for 16 or more residents to have an alternative power source for 72 hours during any type of power outage for the purpose of protecting resident health and safety. Existing law requires an RCFE to be self-reliant for a period of 72 hours immediately following any emergency or disaster, including both short- and long-term power failure. Opponents of this bill argue that an RCFE must already plan for power outages under current law, which could include a plan to have a generator delivered, if necessary.

This bill has raised a discussion among stakeholders of whether sheltering in place or evacuating is the appropriate plan during an emergency or disaster. While sheltering in place may not be appropriate in all situations, sheltering in place may be necessary for a period of time prior to evacuation. Access to a reliable and accessible alternative power source onsite during a power shutoff, emergency, or disaster could benefit facility staff and residents while sheltering in place or during an evacuation.

Proposed Amendments: Should the bill pass out of Committee, the author has proposed the attached amendments. The amendments delay implementation of the requirement for an RCFE licensed for 16 or more residents to have an alternative source of power by one year to January 1, 2028, and add renewable energy microgrids as an example of an allowable alternative source of power. According to the bill sponsor, microgrids are a more affordable option than fuel-powered generators, and also take up less space.

SUPPORT/OPPOSITION

Arguments in Support:

According to California Alliance for Retired Americans, “Power outages that commonly accompany disasters like wildfires and earthquakes can be a grave threat to many assisted living facility residents. Recent research from Yale shows that power outage has been directly associated with adverse outcomes among nursing home residents, which may be explained by interruption to electricity-dependent healthcare and custodial services, as well as residents’ diminished capacity to tolerate ambient temperature fluctuations. Inadequate standby power resiliency may also indirectly increase the risk of adverse outcomes by influencing the likelihood of a potentially avoidable evacuation. SB 435 would require assisted living facilities to adopt a modified version of harm reduction policies that California established under AB 2511 (2022) for skilled nursing facilities (SNFs). If skilled nursing facilities can afford alternative sources of power for 96 hours during any type of power outage, then assisted living facilities can afford alternative sources of power for 72 hours. Assisted living facility profit margins are much larger than those of SNFs. A recent study found the average SNF profit margin was 8.84 percent. The assisted living industries own trade organization, the American Seniors Housing Association, reports that assisted living facilities have a median profit of 20 percent.”

Arguments in Opposition:

According to Leading Age, “SB 435 will have significant cost impacts on RCFEs, and in some cases will lead to the closure of RCFEs, which will lead to a reduction in access to these vital services for older adults. Particularly, as the state is grappling with how to address the growing older adult population. In addition, in many cases, this increased cost will be borne by the residents, further impacting affordability of assisted living. For facilities in urban areas, the installation of a large scale back up power sources may be unfeasible, causing that facility to face closure. The requirements included in this bill are mirrored after the requirement for skilled nursing facilities, which is causing many to upgrade their generators at a cost of $2 billion statewide, and between $500,000 to $1.5 million per facility. Due to this demand, there is a delay of up to 1.5 to 2 years, in production and availability of generators of this magnitude. We believe increased emergency preparedness and response efforts could better address evacuation needs during an emergency. LeadingAge California has long been a champion for the creation of a comprehensive long-term care emergency response system that could significantly enhance the efficiency and effectiveness of evacuations, surge capacity management, and resource distribution during both localized and large-scale disasters. LeadingAge California is concerned that this bill significantly hinders that progress toward increasing the state’s supply of long-term services and supports.”

POSITIONS

Support:

AARP
Alzheimer's Association
California Advocates for Nursing Home Reform
California Alliance for Retired Americans
California Continuing Care Residents Association (CALCRA)
California Long Term Care Ombudsman Association (CLTCOA)
California Retired Teachers Association
Essential Caregivers Coalition
Justice in Aging
Retired Public Employees Association

Oppose:

Leadingage California

AMENDMENTS

SECTION 1. Section 1569.694 is added to the Health and Safety Code, to read:

1569.694. (a) On and after January 1, 2027, 2028, a residential care facility for the elderly licensed for 16 or more residents shall have an alternative source of power to protect resident health and safety for no fewer than 72 hours during any type of power outage.

(b) (1) A facility that elects to use a generator as its alternative source of power shall use a permanently affixed generator that can operate 24 hours a day. A facility that uses a generator shall maintain sufficient fuel onsite to maintain generator operation for no less than 72 hours or make arrangements for fuel delivery for an emergency event. If fuel is to be delivered during an emergency event, the facility shall ensure that fuel will be available with no delays.

(2) A facility that uses batteries or a combination of batteries in tandem with a renewable electrical generation facility as its alternative source of power shall have sufficient storage or generation capacity to maintain operation for no fewer than 72 hours. A facility shall also make arrangements for delivery of a generator and fuel in the event power is not restored within 48 hours and the generation capacity of the renewable electrical generation facility is unable to provide sufficient power to comply with state requirements for residential care facilities for the elderly.

(c) For purposes of this section, the following definitions shall apply:

(1) “Alternative source of power” means a source of electricity that is not received through an electric utility but is generated or stored onsite, which may include, but is not limited to, emergency generators using fuel, large capacity batteries, and renewable electrical generation facilities. facilities, and renewable energy microgrids.

(2) “Resident health and safety” includes, but is not limited to, maintaining a safe temperature for residents, maintaining availability of life-saving equipment, and maintaining availability of oxygen-generating devices.

SEC. 2. Section 1569.695 of the Health and Safety Code is amended to read:

1569.695. (a) In addition to any other requirement of this chapter, a residential care facility for the elderly shall have an emergency and disaster plan that shall include, but not be limited to, all of the following:

(1) Evacuation procedures, including identification of an assembly point or points that shall be included in the facility sketch.

(2) Plans for the facility to be self-reliant for a period of not less than 72 hours immediately following any emergency or disaster, including, but not limited to, a short-term or long-term power failure. If the facility plans to shelter in place and one or more utilities, including water, sewer, gas, or electricity, is not available, the facility shall have a plan and supplies available to provide alternative resources during an outage.

(3) Transportation needs and evacuation procedures to ensure that the facility can communicate with emergency response personnel or can access the information necessary in order to check the emergency routes to be used at the time of an evacuation and relocation necessitated by a disaster. If the transportation plan includes the use of a vehicle owned or operated by the facility, the keys to the vehicle shall be available to staff on all shifts.

(4) A contact information list of all of the following:

(A) Emergency response personnel.

(B) The Community Care Licensing Division within the State Department of Social Services.

(C) The local long-term care ombudsman.

(D) Transportation providers.

(5) At least two appropriate shelter locations that can house facility residents during an evacuation. One of the locations shall be outside of the immediate area.

(6) The location of utility shut-off valves and instructions for use.

(7) Procedures that address, but are not limited to, all of the following:

(A) (i) Provision of emergency power that could include identification of suppliers of backup generators. If a permanently installed generator is used, the plan shall include its location and a description of how it will be used. If a portable generator is used, the manufacturer’s operating instructions shall be followed.

(ii) Beginning January 1, 2027, 2028, for facilities licensed for 16 or more residents, the plan shall include identification of the alternative source of power a facility has elected to use pursuant to Section 1569.694. For a permanently installed generator described under Section 1569.694, the plan shall include its location and a description of how it will be used.

(B) Responding to an individual resident’s needs if the emergency call buttons are inoperable.

(C) Process for communicating with residents, families, hospice providers, and others, as appropriate, that might include landline telephones, cellular telephones, or walkie-talkies. A backup process shall also be established. Residents and their responsible parties shall be informed of the process for communicating during an emergency.

(D) Assistance with, and administration of, medications.

(E) Storage and preservation of medications, including the storage of medications that require refrigeration.

(F) The operation of assistive medical devices that need electric power for their operation, including, but not limited to, oxygen equipment and wheelchairs.

(G) A process for identifying residents with special needs, such as hospice, and a plan for meeting those needs.

(H) Procedures for confirming the location of each resident during an emergency response.

(b) A facility shall provide training on the plan to each staff member upon hire and annually thereafter. The training shall include staff responsibilities during an emergency or disaster.

(c) A facility shall conduct a drill at least quarterly for each shift. The type of emergency covered in a drill shall vary from quarter to quarter, taking into account different emergency scenarios. An actual evacuation of residents is not required during a drill. While a facility may provide an opportunity for residents to participate in a drill, it shall not require any resident participation. Documentation of the drills shall include the date, the type of emergency covered by the drill, and the names of staff participating in the drill.

(d) A facility shall review the plan annually and make updates as necessary, including changes in floor plans and the population served. The licensee or administrator shall sign and date documentation to indicate that the plan has been reviewed and updated as necessary.

(e) A facility shall have all of the following information readily available to facility staff during an emergency:

(1) A resident roster with the date of birth for each resident.

(2) An appraisal of resident needs and services plan for each resident.

(3) A resident medication list for residents with centrally stored medications.

(4) Contact information for the responsible party and physician for each resident.

(f) A facility shall have both of the following in place:

(1) An evacuation chair at each stairwell, on or before July 1, 2019.

(2) A set of keys available to facility staff on each shift for use during an evacuation that provides access to all of the following:

(A) All occupied resident units.

(B) All facility vehicles.

(C) All facility exit doors.

(D) All facility cabinets and cupboards or files that contain elements of the emergency and disaster plan, including, but not limited to, food supplies and protective shelter supplies.

(g) A facility shall make the plan available upon request to residents onsite, any responsible party for a resident, the local long-term care ombudsman, and local emergency responders. Resident and employee information shall be kept confidential.

(h) An applicant seeking a license for a new facility shall submit the emergency and disaster plan with the initial license application required under Section 1569.15.

(i) The department’s Community Care Licensing Division shall confirm, during annual licensing visits, that the emergency and disaster plan is on file at the facility and includes required content.

(j) A facility is encouraged to have the emergency and disaster plan reviewed by local emergency authorities.

(k) Nothing in this section shall create a new or additional requirement for the department to evaluate the emergency and disaster plan.

SEC. 3. No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.

-- END --

1. https://www.cdss.ca.gov/Portals/9/CCLD/CCLD%20Facility%20and%20Capacity%20Data%202017-24.pdf?ver=2024-09-19-093650-383 ↑

2. https://34c031f8-c9fd-4018-8c5a-4159cdff6b0d-cdn-endpoint.azureedge.net/-/media/calfire-website/our-impact/fire-statistics/top20_destruction.pdf?rev=adaea8332a014a7ebf11dc6fdb3f8e98&hash=EA9A8C492BD9FBAA0FB67C2FEA3FF52E ↑

3. https://34c031f8-c9fd-4018-8c5a-4159cdff6b0d-cdn-endpoint.azureedge.net/-/media/calfire-website/our-impact/fire-statistics/top20_deadliest.pdf?rev=227b6e4a007f4df5be4414a12c033184&hash=3864EB332926BB6DC73C84B32A568726 ↑

4. https://embed.documentcloud.org/documents/7016766-CDSS-Accusation-Oakmont/ ↑

5. https://embed.documentcloud.org/documents/7016765-CDSS-Settlement-Oakmont/ ↑

6. https://da.sonomacounty.ca.gov/varenna-and-villa-capri-settle-law-enforcement-action ↑

7. https://da.sonomacounty.ca.gov/varenna-and-villa-capri-settle-law-enforcement-action ↑

8. https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-establishment-division-medi-cal-fraud-and ↑

9. https://calmatters.org/projects/nursing-homes-not-ready-wildfire/ ↑

10. https://aging.ca.gov/Care_Options/Skilled_Nursing_Facilities/ ↑

11. 22 CCR 87891 ↑