Existing law requires, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed, among other things, connected vehicle location access. For these purposes, existing law defines connected vehicle service to mean any capability, including through a software application that is designed to be operated on a mobile device, to remotely obtain data from, or send commands to, a vehicle, and connected vehicle location access to mean a type of connected vehicle service that allows a person, who is outside of a vehicle, to view or track the location of the vehicle, as specified. If a vehicle includes connected vehicle location access, existing law requires a covered provider, as defined, to provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. Existing law delays the operation of this requirement depending on whether the vehicle was manufactured prior to, or on or after, January 1, 2028. Unless otherwise provided, a violation of the Vehicle Code constitutes an infraction.

This bill would, instead, limit the provisions above to specified vehicles with connected vehicle access. The bill would apply the requirement for a vehicle with connected vehicle service to indicate to a person inside the vehicle if connected vehicle location access is enabled to all vehicles beginning with the 2031 model year. The bill would make this requirement operative beginning with the 2031 model year, for 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible, and on or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

By establishing a new duty on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

This bill would declare that it is to take effect immediately as an urgency statute.

Existing law requires, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed, among other things, connected vehicle location access. For these purposes, existing law defines connected vehicle service to mean any capability, including through a software application that is designed to be operated on a mobile device, to remotely obtain data from, or send commands to, a vehicle, and connected vehicle location access to mean a type of connected vehicle service that allows a person, who is outside of a vehicle, to view or track the location of the vehicle, as specified. If a vehicle includes connected vehicle location access, existing law requires a covered provider, as defined, to provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. Existing law delays the operation of this requirement depending on whether the vehicle was manufactured prior to, or on or after, January 1, 2028. Unless otherwise provided, a violation of the Vehicle Code constitutes an infraction.

This bill would, instead, limit the provisions above to specified vehicles with connected vehicle access. The bill would apply the requirement for a vehicle with connected vehicle service to indicate to a person inside the vehicle if connected vehicle location access is enabled to all vehicles beginning with the 2031 model year. The bill would make this requirement operative beginning with the 2031 model year, for 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible, and on or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

By establishing a new duty on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

This bill would declare that it is to take effect immediately as an urgency statute.

Existing law requires, beginning on January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person who is inside the vehicle when a person who is outside the vehicle has accessed, among other things, connected vehicle location access. For these purposes, existing law defines connected vehicle service to mean any capability, including through a software application that is designed to be operated on a mobile device, to remotely obtain data from, or send commands to, a vehicle, and connected vehicle location access to mean a type of connected vehicle service that allows a person, who is outside of a vehicle, to view or track the location of the vehicle, as specified. If a vehicle includes connected vehicle location access, existing law requires a covered provider, as defined, to provide a mechanism that can be used by a driver who is inside a vehicle to immediately disable connected vehicle location access. Existing law delays the operation of this requirement depending on whether the vehicle was manufactured prior to, or on or after, January 1, 2028. Unless otherwise provided, a violation of the Vehicle Code constitutes an infraction.

This bill would, instead, limit the provisions above to specified vehicles with connected vehicle access. The bill would apply the requirement for a vehicle with connected vehicle service to indicate to a person inside the vehicle if connected vehicle location access is enabled to all vehicles beginning with the 2031 model year. The bill would make this requirement operative beginning with the 2031 model year, for 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible, and on or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

By establishing a new duty on vehicle manufacturers, this bill would expand the general crime applicable to provisions under the Vehicle Code, thereby imposing a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law law, until January 1, 2029, requires the Department of Technology to annually submit to certain legislative committees a report regarding a specified required comprehensive inventory of all high-risk automated decision systems that have been, or are being, used, developed, or procured by a state agency. Existing law defines high-risk automated decision system to mean an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

This bill would except from the definition of high-risk automated decision system an automated decision system developed and used exclusively for purposes of verifying a persons eligibility for social services benefits and programs that meets certain criteria, including that the automated decision system output is used in a determinative manner only if the output affirms benefit eligibility, and outputs from the automated decision system that indicate that an applicant is not eligible are disregarded pending review by a human analyst. extend that reporting requirement until January 1, 2032.

The Charter Schools Act of 1992 authorizes the establishment, operation, and governance of charter schools, as provided. Existing law prohibits the governing board of a school district from denying a petition for the establishment of a charter school unless it makes one or more enumerated findings, including, among others, that the charter petition does not contain reasonably comprehensive descriptions of the manner in which annual, independent financial audits shall be conducted, as provided.

This bill would state the intent of the Legislature to enact subsequent legislation relating to the Multi-Agency Charter School Audits Task Force recommendations.

 UNFINISHED BUSINESS  

Bill No: SB 719

Author: Cabaldon (D), et al.

Chaptered: 6/30/26

Vote: 27 - Urgency

SENATE JUDICIARY COMMITTEE: 13-0, 1/13/26

AYES: Umberg, Niello, Allen, Ashby, Caballero, Durazo, Laird, Reyes, Stern, Valladares, Wahab, Weber Pierson, Wiener

SENATE GOVERNMENTAL ORG. COMMITTEE: 14-0, 1/13/26

AYES: Padilla, Valladares, Archuleta, Ashby, Blakespear, Cervantes, Dahle, Jones, Ochoa Bogh, Richardson, Rubio, Smallwood-Cuevas, Wahab, Weber Pierson

NO VOTE RECORDED: Hurtado

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

SENATE FLOOR: 39-0, 1/26/26

AYES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Gonzalez

ASSEMBLY FLOOR: 67-0, 6/29/26 - See last page for vote

SUBJECT: Access to connected vehicle service

SOURCE: Author

DIGEST:

This bill amends the Connected Vehicle Service law to rework various provisions, slightly narrow the scope, and delay the operative date of specified sections of the law, tying them to technical feasibility.

Assembly Amendments

of 6/22/26 gut and amend the previous contents of this bill and place an urgency clause in this bill.

ANALYSIS:

Existing law:

1. Defines “vehicle” as a device by which any person or property may be propelled, moved, or drawn upon a highway, excepting a device moved exclusively by human power or used exclusively upon stationary rails or tracks. (Vehicle (Veh.) Code § 670.)
2. Defines the following:
   1. “Account holder” means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
   2. “Connected vehicle location access” is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
   3. “Connected vehicle service” means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
   4. “Connected vehicle service account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
   5. “Connected vehicle service request” means a request by a driver to terminate a person’s access to connected vehicle service.
   6. “Covered provider” means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. (Veh. Code § 28200.)
3. Requires, beginning January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access. (Veh. Code § 28202.)
4. Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner. (Veh. Code § 28240.)
5. Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality. (Veh. Code § 28206.)
6. Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account to disable the location access. (Veh. Code § 28242.)
7. Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process. (Veh. Code § 28242.)
8. Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01. (Veh. Code § 20206(c).)
9. Required auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account. (Veh. Code § 28206.)
10. Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service. (Veh. Code § 28224.)
11. Requires the manufacturer to terminate the service within two business days of receiving the request. (Veh. Code § 28224.)

This bill:

1. Modifies the definition of “connected vehicle service” to mean a software application that is designed to be operated on a mobile device provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain the location of the vehicle or send data from, or send commands to, a vehicle.
2. Defines “requestor” to mean any person submitting a connected vehicle service request who has the vehicle identification number and proof of legal possession.
3. Adds a new definition of “vehicle” that limits it to motor vehicles having a manufacturer’s maximum gross vehicle weight rating under 6,001 pounds, with connected vehicle service.
4. Removes the operative dates from the bill, and instead provides deadlines based on model year and technological feasibility.
5. Amends the above law to provide that a vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle if connected vehicle location access is enabled.
6. Makes other clarifying and technical amendments.
7. Includes an urgency clause.

Comments

Domestic violence can take many forms, but generally involves a pattern of behaviors by an abuser to gain and maintain power and control. This can involve emotional abuse, intimidation, economic abuse, coercion and threats, and physical or sexual violence. Abusers can assert control over economic resources, children, and modes of transportation. Escaping domestic violence is often harrowing and beset by fear of being caught or found by the abuser.

With the near ubiquitous nature of connected devices and attendant tracking mechanisms, a new tool for abusers to maintain power and control has caused alarm among survivors and advocates. Research and reporting finds that abusers are increasingly using connected devices in vehicles to harass and terrify their victims even after they have managed to escape.

SB 1394 (Min, Chapter 655, Statutes of 2024) was passed into law to address these concerns and to provide a tool for survivors to regain control of their lives by regaining control of their vehicles. Importantly, the law provides for clear warnings to those inside vehicles when someone outside the vehicle has accessed either (1) connected vehicle service or (2) connected vehicle location access. This serves the obvious purpose of allowing a driver, potentially a survivor of some form of abuse, to know when someone outside the vehicle is trying to remotely obtain some form of data about the vehicle. This provision is set to come into effect on January 1, 2028.

This bill now provides that such a vehicle must indicate to a person inside the vehicle when connected vehicle location access is enabled. The bill provides that this protection will apply starting with vehicles with a model year of 2031.

Definitions. Some definitions have also been adjusted or added. “Connected vehicle service” is currently defined as any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device. This bill slightly narrows this definition including by now encompassing software applications that are designed to be operated on a mobile device rather than any capability that may be accomplished through such a mobile application.

Currently, “vehicle” is defined broadly for purposes of the Vehicle Code as a device by which any person or property may be propelled, moved, or drawn upon a highway, excepting a device moved exclusively by human power or used exclusively upon stationary rails or tracks. This bill redefines “vehicle” for purposes of this law to mean a motor vehicle having a manufacturer’s maximum gross vehicle weight rating (GVWR) under 6,001 pounds, with connected vehicle service. While this will still include most passenger vehicles, a number of SUVs, for instance, especially electric models, like Rivians, may be excluded from the law.

Delayed operative dates. In addition to the changes noted above, the bill removes the existing deadlines from the law and establishes a new model-year based metric. SB 1394 provided specific operative dates for the various sections of the law. For instance, Article 2 of the law is already in effect. That part of the law requires a process to be established for a driver to request to terminate a person’s access to connected vehicle service.

Article 3 of the bill requires covered providers to provide a mechanism for a driver inside a vehicle to immediately disable connected vehicle location access that meets certain requirements. This article comes into effect on January 1, 2028, for vehicles manufactured after that date, that have connected vehicle location access. For vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required, the operative date is July 1, 2026.

This bill provides new deadlines, as follows:

• Beginning with the 2031 model year, all vehicles with connected vehicle location access.
• For 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible.
• On or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

As indicated below, opposition has raised strong concerns with the “technological feasibility” element being inserted.

According to the author:

In 2024, the legislature passed SB 1394, an important domestic violence protection that provided survivors with two safeguards against the misuse of connected vehicle features. First, it created a website that allows victims to remove an abuser's remote access to their vehicle, a protection that is now in effect. Second, it required an in-car notification alerting drivers when their vehicle is being tracked, along with the power to shut that access off.

The in-vehicle shutoff requirement is set to take effect on July 1, 2026. Given the multi-year vehicle design and manufacturing cycle, that deadline is not feasible. Without the delayed implementation, California would prohibit the sale of most new and used vehicles that don't meet these standards, disrupting consumers, dealers, and the broader market.

SB 719 does not remove any victim safety requirements of the law. It clarifies technical definitions, adjusts the law's implementation dates to better align with the multi-year design and manufacturing process for vehicles, and is consistent with similar laws in other states.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

SUPPORT: (Verified 6/28/26)

Alliance for Automotive Innovation

California New Car Dealers Association

CarMax

Carvana

OPPOSITION: (Verified 6/28/26)

Consumer Federation of California

Consumers for Auto Reliability and Safety (CARS)

ARGUMENTS IN SUPPORT: The industry coalition writes:

This measure provides important clarifications and implementation updates to SB 1394 (Min, 2024) which addressed vehicle safety features intended to prevent the misuse of connected vehicle services and location data by perpetrators of domestic abuse.

This measure aligns the requirements of SB 1394 with a timeline that reflects the reality of vehicle design and manufacturing. The measure does not remove any victim safety requirements currently in law. It simply clarifies technical aspects and adjusts the law’s implementation dates to better fit the multi-year vehicle development process.

Modern vehicles increasingly offer connected features that improve driver convenience and safety. These features can include vehicle location services, remote vehicle controls, and vehicle-connected cellphone applications. These technologies generally provide substantial consumer benefits, including theft prevention and increased control over vehicle functions.

ARGUMENTS IN OPPOSITION: Consumers for Auto Reliability and Safety writes:

This bill will allow auto manufacturers to continue putting victims of domestic violence in danger by delaying the implementation of safety technology that would prevent abusers from tracking victims through connected vehicle services. This is simple technology that should not take seven years to implement, and should be implemented as required under existing law -- on July 1, 2026.

The auto industry should not be preventing consumers from having the ability to control who can access and use their own personal data. This is a privacy issue that creates a very real threat to consumer safety and, in the case of domestic violence (DV) survivors, could lead to a life-or-death situation.

SB 719 is problematic and dangerous because it not only seeks to delay the auto industry’s obligation of protecting DV victims by another five years, but this bill also allows industry to unilaterally determine if the technology in question is “technologically infeasible.” This is a power that should not solely lie with the auto industry. Industry has the capability to notify drivers if their location is being accessed and this bill allows them to further evade accountability to consumers and their social responsibility of protecting victims of domestic violence.

ASSEMBLY FLOOR: 67-0 6/29/26

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bauer-Kahan, Bennett, Berman, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Davies, DeMaio, Dixon, Ellis, Flora, Fong, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Johnson, Krell, Lowenthal, Macedo, McKinnor, Nguyen, Pacheco, Papan, Patel, Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Sanchez, Schultz, Sharp-Collins, Solache, Soria, Ta, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO VOTE RECORDED: Bains, Boerner, Connolly, Elhawary, Gabriel, Kalra, Lackey, Lee, Muratsuchi, Ortega, Schiavo, Stefani

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548

7/7/26 11:55:28

**** END ****

 UNFINISHED BUSINESS  

Bill No: SB 719

Author: Cabaldon (D), et al.

Amended: 6/22/26

Vote: 27 - Urgency

SENATE JUDICIARY COMMITTEE: 13-0, 1/13/26

AYES: Umberg, Niello, Allen, Ashby, Caballero, Durazo, Laird, Reyes, Stern, Valladares, Wahab, Weber Pierson, Wiener

SENATE GOVERNMENTAL ORG. COMMITTEE: 14-0, 1/13/26

AYES: Padilla, Valladares, Archuleta, Ashby, Blakespear, Cervantes, Dahle, Jones, Ochoa Bogh, Richardson, Rubio, Smallwood-Cuevas, Wahab, Weber Pierson

NO VOTE RECORDED: Hurtado

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

SENATE FLOOR: 39-0, 1/26/26

AYES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Gonzalez

ASSEMBLY FLOOR: 6/29/26 – Roll call not available.

SUBJECT: Access to connected vehicle service

SOURCE: Author

DIGEST:

This bill amends the Connected Vehicle Service law to rework various provisions, slightly narrow the scope, and delay the operative date of specified sections of the law, tying them to technical feasibility.

Assembly Amendments

of 6/22/26 gut and amend the previous contents of this bill and place an urgency clause in this bill.

ANALYSIS:

Existing law:

1. Defines “vehicle” as a device by which any person or property may be propelled, moved, or drawn upon a highway, excepting a device moved exclusively by human power or used exclusively upon stationary rails or tracks. (Vehicle (Veh.) Code § 670.)
2. Defines the following:
   1. “Account holder” means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
   2. “Connected vehicle location access” is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
   3. “Connected vehicle service” means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
   4. “Connected vehicle service account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
   5. “Connected vehicle service request” means a request by a driver to terminate a person’s access to connected vehicle service.
   6. “Covered provider” means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. (Veh. Code § 28200.)
3. Requires, beginning January 1, 2028, a vehicle with connected vehicle service to clearly indicate to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access. (Veh. Code § 28202.)
4. Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner. (Veh. Code § 28240.)
5. Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality. (Veh. Code § 28206.)
6. Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account to disable the location access. (Veh. Code § 28242.)
7. Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process. (Veh. Code § 28242.)
8. Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01. (Veh. Code § 20206(c).)
9. Required auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account. (Veh. Code § 28206.)
10. Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service. (Veh. Code § 28224.)
11. Requires the manufacturer to terminate the service within two business days of receiving the request. (Veh. Code § 28224.)

This bill:

1. Modifies the definition of “connected vehicle service” to mean a software application that is designed to be operated on a mobile device provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain the location of the vehicle or send data from, or send commands to, a vehicle.
2. Defines “requestor” to mean any person submitting a connected vehicle service request who has the vehicle identification number and proof of legal possession.
3. Adds a new definition of “vehicle” that limits it to motor vehicles having a manufacturer’s maximum gross vehicle weight rating under 6,001 pounds, with connected vehicle service.
4. Removes the operative dates from the bill, and instead provides deadlines based on model year and technological feasibility.
5. Amends the above law to provide that a vehicle with connected vehicle service shall clearly indicate to a person who is inside the vehicle if connected vehicle location access is enabled.
6. Makes other clarifying and technical amendments.
7. Includes an urgency clause.

Comments

Domestic violence can take many forms, but generally involves a pattern of behaviors by an abuser to gain and maintain power and control. This can involve emotional abuse, intimidation, economic abuse, coercion and threats, and physical or sexual violence. Abusers can assert control over economic resources, children, and modes of transportation. Escaping domestic violence is often harrowing and beset by fear of being caught or found by the abuser.

With the near ubiquitous nature of connected devices and attendant tracking mechanisms, a new tool for abusers to maintain power and control has caused alarm among survivors and advocates. Research and reporting finds that abusers are increasingly using connected devices in vehicles to harass and terrify their victims even after they have managed to escape.

SB 1394 (Min, Chapter 655, Statutes of 2024) was passed into law to address these concerns and to provide a tool for survivors to regain control of their lives by regaining control of their vehicles. Importantly, the law provides for clear warnings to those inside vehicles when someone outside the vehicle has accessed either (1) connected vehicle service or (2) connected vehicle location access. This serves the obvious purpose of allowing a driver, potentially a survivor of some form of abuse, to know when someone outside the vehicle is trying to remotely obtain some form of data about the vehicle. This provision is set to come into effect on January 1, 2028.

This bill now provides that such a vehicle must indicate to a person inside the vehicle when connected vehicle location access is enabled. The bill provides that this protection will apply starting with vehicles with a model year of 2031.

Definitions. Some definitions have also been adjusted or added. “Connected vehicle service” is currently defined as any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device. This bill slightly narrows this definition including by now encompassing software applications that are designed to be operated on a mobile device rather than any capability that may be accomplished through such a mobile application.

Currently, “vehicle” is defined broadly for purposes of the Vehicle Code as a device by which any person or property may be propelled, moved, or drawn upon a highway, excepting a device moved exclusively by human power or used exclusively upon stationary rails or tracks. This bill redefines “vehicle” for purposes of this law to mean a motor vehicle having a manufacturer’s maximum gross vehicle weight rating (GVWR) under 6,001 pounds, with connected vehicle service. While this will still include most passenger vehicles, a number of SUVs, for instance, especially electric models, like Rivians, may be excluded from the law.

Delayed operative dates. In addition to the changes noted above, the bill removes the existing deadlines from the law and establishes a new model-year based metric. SB 1394 provided specific operative dates for the various sections of the law. For instance, Article 2 of the law is already in effect. That part of the law requires a process to be established for a driver to request to terminate a person’s access to connected vehicle service.

Article 3 of the bill requires covered providers to provide a mechanism for a driver inside a vehicle to immediately disable connected vehicle location access that meets certain requirements. This article comes into effect on January 1, 2028, for vehicles manufactured after that date, that have connected vehicle location access. For vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, and have the capability to receive software updates that provide for the functionality required, the operative date is July 1, 2026.

This bill provides new deadlines, as follows:

• Beginning with the 2031 model year, all vehicles with connected vehicle location access.
• For 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible.
• On or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

As indicated below, opposition has raised strong concerns with the “technological feasibility” element being inserted.

According to the author:

In 2024, the legislature passed SB 1394, an important domestic violence protection that provided survivors with two safeguards against the misuse of connected vehicle features. First, it created a website that allows victims to remove an abuser's remote access to their vehicle, a protection that is now in effect. Second, it required an in-car notification alerting drivers when their vehicle is being tracked, along with the power to shut that access off.

The in-vehicle shutoff requirement is set to take effect on July 1, 2026. Given the multi-year vehicle design and manufacturing cycle, that deadline is not feasible. Without the delayed implementation, California would prohibit the sale of most new and used vehicles that don't meet these standards, disrupting consumers, dealers, and the broader market.

SB 719 does not remove any victim safety requirements of the law. It clarifies technical definitions, adjusts the law's implementation dates to better align with the multi-year design and manufacturing process for vehicles, and is consistent with similar laws in other states.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

SUPPORT: (Verified 6/28/26)

Alliance for Automotive Innovation

California New Car Dealers Association

CarMax

Carvana

OPPOSITION: (Verified 6/28/26)

Consumer Federation of California

Consumers for Auto Reliability and Safety (CARS)

ARGUMENTS IN SUPPORT: The industry coalition writes:

This measure provides important clarifications and implementation updates to SB 1394 (Min, 2024) which addressed vehicle safety features intended to prevent the misuse of connected vehicle services and location data by perpetrators of domestic abuse.

This measure aligns the requirements of SB 1394 with a timeline that reflects the reality of vehicle design and manufacturing. The measure does not remove any victim safety requirements currently in law. It simply clarifies technical aspects and adjusts the law’s implementation dates to better fit the multi-year vehicle development process.

Modern vehicles increasingly offer connected features that improve driver convenience and safety. These features can include vehicle location services, remote vehicle controls, and vehicle-connected cellphone applications. These technologies generally provide substantial consumer benefits, including theft prevention and increased control over vehicle functions.

ARGUMENTS IN OPPOSITION: Consumers for Auto Reliability and Safety writes:

This bill will allow auto manufacturers to continue putting victims of domestic violence in danger by delaying the implementation of safety technology that would prevent abusers from tracking victims through connected vehicle services. This is simple technology that should not take seven years to implement, and should be implemented as required under existing law -- on July 1, 2026.

The auto industry should not be preventing consumers from having the ability to control who can access and use their own personal data. This is a privacy issue that creates a very real threat to consumer safety and, in the case of domestic violence (DV) survivors, could lead to a life-or-death situation.

SB 719 is problematic and dangerous because it not only seeks to delay the auto industry’s obligation of protecting DV victims by another five years, but this bill also allows industry to unilaterally determine if the technology in question is “technologically infeasible.” This is a power that should not solely lie with the auto industry. Industry has the capability to notify drivers if their location is being accessed and this bill allows them to further evade accountability to consumers and their social responsibility of protecting victims of domestic violence.

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548

6/29/26 15:10:07

**** END ****

SENATE THIRD READING

STR Bill Id:SB 719

Author:(Cabaldon)

As Amended Ver:June 22, 2026

2/3 vote. Urgency

SUMMARY

This bill provides clean-up to SB 1394 (Min), Chapter 655, Statutes of 2024 by extending and aligning current implementation deadlines for vehicle manufacturers who are required to modify automobiles that have a connected vehicle service.

Major Provisions

1. Modifies the definition of "connected vehicle service" to mean a software application that is designed to be operated on a mobile device.
2. Adds the following definitions:
   1. "Requestor" means any person submitting a connected vehicle service request who has the vehicle identification number and proof of legal possession.
   2. "Vehicle" means a motor vehicle having a manufacturer's maximum gross vehicle weight rating under 6,001 pounds, with connected vehicle service.
3. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to clearly indicate to a person inside the vehicle if connected vehicle location access is enabled.
4. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner.
5. Changes the current July 1, 2026, operative date for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, to be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality to the following:
   1. For 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible.
   2. On or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.
6. States that this act is an urgency statute in order to allow automobile manufacturers sufficient time to carefully and safely redesign and update automobiles to provide the technology required by SB 1394 (Min, Ashby, Weber-Pierson), Chapter 655, Statutes of 2024.

COMMENTS

In 2024, the Legislature passed, and the Governor signed SB 1394 (Min, Ashby, and Weber-Pierson; Ch. 655, Statutes of 2024). That bill required that automakers assist women fleeing violent men in their lives by providing them with a way to disconnect a vehicle's remote location services from inside of a car, thus stopping their perpetrator from tracking their movements and location.

That bill required a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car. This Committee found that the policies contained in SB 1394 were critical for the safety of women and would significantly improve their ability to escape an abuser.

While supportive of the bill, some automakers ran into challenges meeting the timeframes that were included. This bill adjusts the time frames in statute and aligns them with vehicle model years, rather than specific dates. The Alliance for Automotive Innovation, along with a coalition of car dealers, writing in support of the bill, describe the challenges in this way:

As automakers have worked to implement the law, it has become clear that certain deadlines cannot be met. While automakers have already implemented the webpage-based termination requirement, the timelines associated with in-vehicle features do not align with the realities of vehicle production.

Vehicle development begins nearly a decade before a particular model hits the road. The process requires extensive engineering, testing, validation, and coordination across complex global supply chains. Each aspect of a vehicle is designed with the entire system in mind. Both hardware and software must function safely and reliably as an independent component and as part of a greater whole. As a result, vehicle systems cannot be redesigned and deployed on the timelines required by SB 1394.

For example, the requirement that vehicles include an in-vehicle mechanism to terminate location services takes effect on July 1, 2026. This date provides less than two years between final bill language going into print and the effective date for manufacturers to review, design, test, and deploy updates. These changes must seamlessly integrate into the extensive network of existing software and hardware without disrupting any capability currently relied upon by consumers. Without careful development, a rushed update could impair a host of functions including safety features, GPS, or Advanced Driver-Assistance Systems.

This time crunch is exacerbated by the application of some requirements to existing vehicles at the same time as new vehicles. Different makes, models, and trim levels have offered unique mixes of capabilities and have done so through different technologies. This range of technical considerations prevents developers from employing any one-size-fits-all solution. Producers are spread thin attempting to develop an extensive range of backwards looking software solutions all at once.

Opponents of the bill argue the following:

SB 719 is problematic and dangerous because it not only seeks to delay the auto industry's obligation of protecting [Domestic violence] DV victims by another five years, but this bill also allows industry to unilaterally determine if the technology in question is "technologically infeasible." This is a power that should not solely lie with the auto industry. Industry has the capability to notify drivers if their location is being accessed and this bill allows them to further evade accountability to consumers and their social responsibility of protecting victims of domestic violence.

It appears that the opposition misunderstands the impact of the bill. The delay in implementation is not a five-year delay. As it pertains to the current July 1, 2026 deadline for cars that are capable of being updated remotely, that deadline will be extended one year to July 1, 2027.

For new cars, the current January 1, 2028, deadline is being aligned with the 2031 model year release, rather than with a calendar date. New model year cars are generally released in the late Summer/early Fall of the prior year. As a result, this change will delay the implementation date by approximately 18 months. However, the bill also adds a new deadline by requiring that 2028, 2029, and 2030 models be updated as soon as practicable after the vehicle is sold unless that is technologically infeasible. Given the fact that model 2028 cars will begin being sold in mid to late 2027, the net effect of this change is to bring the deadline forward rather than extending the deadline.

In addition, current law required auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account. That process has been implemented so women experiencing abuse at the hands of their current or former male partners are able to have the connected vehicle service severed so that they can use the car to escape from their abuser. Therefore, the assertion that "DV victims will have to wait another five years for protection" is inaccurate. SB 1394 ensured that women fleeing their abusers would have that ability within six months after enactment of the bill.

According to the Author

In 2024, SB 1394 made an important commitment to survivors of domestic abuse by providing victims with the power to disable the connected vehicle features that perpetrators use to track and harass them. However, the short timeline did not give automobile manufacturers enough time to make these changes within the multi-year vehicle design and manufacturing process.

SB 719 does not remove any victim safety requirements of the law. It clarifies technical aspects, adjusts the law's implementation dates to better align with the multi-year design and manufacturing process for vehicles, and is consistent with similar laws in other states.

Arguments in Support

See comments from support above.

Arguments in Opposition

See comments from opposition above.

FISCAL COMMENTS

No significant state costs. The bill's requirements apply to private vehicle manufacturers and entities acting on their behalf, and the bill creates no new state program, agency duty, or appropriation.

VOTES

SENATE FLOOR: 39-0-1

YES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Caballero, Cervantes, Choi, Cortese, Dahle, Durazo, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Rubio, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

ABS, ABST OR NV: Gonzalez

ASM PRIVACY AND CONSUMER PROTECTION: 15-0-0

YES: Bauer-Kahan, Macedo, Bryan, DeMaio, Hoover, Irwin, Lowenthal, McKinnor, Ortega, Patterson, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-0

YES: Wicks, Hoover, Aguiar-Curry, Calderon, Caloza, Dixon, Fong, Mark González, Krell, Pacheco, Pellerin, Sharp-Collins, Solache, Ta, Tangipa

UPDATED

VERSION: June 22, 2026

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0003214

Date of Hearing: June 24, 2026

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

SBPCA Bill Id:SB 719

Author:(Cabaldon) – As Amended Ver:June 22, 2026

Urgency: Yes State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill revises the implementation deadlines and definitions of the connected-vehicle-service requirements enacted by SB 1394 (Min), Chapter 655, Statutes of 2024, which require vehicle manufacturers to let a driver detect and disable outside access to a vehicle’s location services.

Specifically, this bill:

1. Replaces the January 1, 2028 operative date for the in-vehicle indication and disable-mechanism requirements with the 2031 model year, and sets interim requirements tied to the 2027 through 2030 model years for updating earlier vehicles where technologically feasible.
2. Revises definitions, including narrowing “connected vehicle service,” adding “requestor,” and defining “vehicle” as a motor vehicle with a manufacturer’s maximum gross vehicle weight rating under 6,001 pounds.
3. Takes effect immediately as an urgency statute.

FISCAL EFFECT:

No significant state costs. The bill’s requirements apply to private vehicle manufacturers and entities acting on their behalf, and the bill creates no new state program, agency duty, or appropriation.

COMMENTS:

1. Purpose. According to the author, SB 1394 (Min), Chapter 655, Statutes of 2024, made an important commitment to survivors of domestic abuse by giving victims the power to disable the connected-vehicle features that perpetrators use to track and harass them, but the original timeline did not give manufacturers enough time to make the changes within the multi-year vehicle design and manufacturing process. The author states that SB 719 removes no victim-safety requirements and instead clarifies technical aspects and aligns the implementation dates with the vehicle design and production cycle.
2. Background. SB 1394 (Min) requires a vehicle manufacturer that includes connected vehicle services to notify a driver when someone outside the vehicle accesses the vehicle’s connected service or location access, and, for newer vehicles, to include an in-vehicle mechanism allowing a driver to disable location access. The manufacturers, while supportive, reported that certain deadlines — particularly the July 1, 2026 requirement to add an in-vehicle termination mechanism to existing vehicles — could not be met within the multi-year engineering, testing, and validation cycle for vehicle systems. This bill responds by shifting the in-vehicle requirements to the 2031 model year and setting feasibility-conditioned interim deadlines for earlier model years, while preserving the interim requirement that manufacturers provide a process to sever the connection between a vehicle and remote applications and honor that request within two business days.

Analysis Prepared by: Shiran Zohar / APPR. / (916) 319-2081

Date of Hearing: June 16, 2026

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 719

Author:(Cabaldon) – As Amended Ver:June 10, 2026

PROPOSED AMENDMENT

SENATE VOTE: N/A

SUBJECT: Access to connected vehicle service.

SYNOPSIS

In 2024, the Legislature passed, and the Governor signed SB 1394 (Min, Ashby, and Weber-Pierson; Ch. 655, Stats 2024). That bill required that automakers assist women fleeing violent men in their lives by providing them with a way to disconnect a vehicle’s remote location services from inside of a car, thus stopping their perpetrator from tracking their movements and location.

That bill required a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car. This Committee found that the policies contained in SB 1394 were critical for the safety of women and would significantly improve their ability to escape an abuser.

While supportive of the bill, some automakers ran into challenges meeting the timeframes that were included. This bill adjusts the time frames in statute and aligns them with vehicle model years, rather than specific dates.

This bill was gutted and amended in this Committee. In light of an upcoming July 1, 2026, deadline for automakers, the Committee amendments add an urgency clause.

EXISTING LAW:

1. Defines the following:
   1. “Account holder” means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
   2. “Connected vehicle location access” is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
   3. “Connected vehicle service” means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
   4. “Connected vehicle service account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
   5. “Connected vehicle service request” means a request by a driver to terminate a person’s access to connected vehicle service.
   6. “Covered provider” means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. (Veh. Code § 28200.)
2. Requires, beginning January 1, 2028, that a vehicle with connected vehicle service clearly indicates to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access. (Veh. Code § 28202.)
3. Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner. (Veh. Code § 28240.)
4. Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality. (Veh. Code § 28206.)
5. Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account to disable the location access. (Veh. Code § 28242.)
6. Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process. (Veh. Code § 28242.)
7. Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01. (Veh. Code § 20206(c).)
8. Required auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account. (Veh. Code § 28206.)
9. Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service. (Veh. Code § 28224.)
10. Requires the manufacturer to terminate the service within two business days of receiving the request. (Veh. Code § 28224.)

THIS BILL:

1. Modifies the definition of “connected vehicle service” to mean a software application that is designed to be operated on a mobile device.
2. Adds the following definitions:
   1. “Requestor” means any person submitting a connected vehicle service request who has the vehicle identification number and proof of legal possession.
   2. “Vehicle” means a motor vehicle having a manufacturer’s maximum gross vehicle weight rating under 6,001 pounds, with connected vehicle service.
3. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to clearly indicate to a person inside the vehicle if connected vehicle location access is enabled.
4. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner.
5. Changes the current July 1, 2026, operative date for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, to be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality to the following:
   1. For 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible.
   2. On or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

COMMENTS:

1. Author’s statement. According to the author:

In 2024, SB 1394 made an important commitment to survivors of domestic abuse by providing victims with the power to disable the connected vehicle features that perpetrators use to track and harass them. However, the short timeline did not give automobile manufacturers enough time to make these changes within the multi-year vehicle design and manufacturing process.

SB 719 does not remove any victim safety requirements of the law. It clarifies technical aspects, adjusts the law's implementation dates to better align with the multi-year design and manufacturing process for vehicles, and is consistent with similar laws in other states.

2) The need for this bill. In 2024, the Legislature passed, and the Governor signed SB 1394 (Min, Ashby, and Weber-Pierson; Ch. 655, Stats 2024). That bill required that automakers assist women fleeing violent men in their lives by providing them with a way to disconnect a vehicle’s remote location services from inside of a car, thus stopping their perpetrator from tracking them through the car.

As outlined in EXISTING LAW, that bill required a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car.

While supportive of the bill, some automakers ran into challenges meeting the time frames that were included. The Alliance for Automotive Innovation, along with a coalition of car dealers, describe the challenges in this way:

As automakers have worked to implement the law, it has become clear that certain deadlines cannot be met. While automakers have already implemented the webpage-based termination requirement, the timelines associated with in-vehicle features do not align with the realities of vehicle production.

Vehicle development begins nearly a decade before a particular model hits the road. The process requires extensive engineering, testing, validation, and coordination across complex global supply chains. Each aspect of a vehicle is designed with the entire system in mind. Both hardware and software must function safely and reliably as an independent component and as part of a greater whole. As a result, vehicle systems cannot be redesigned and deployed on the timelines required by SB 1394.

For example, the requirement that vehicles include an in-vehicle mechanism to terminate location services takes effect on July 1, 2026. This date provides less than two years between final bill language going into print and the effective date for manufacturers to review, design, test, and deploy updates. These changes must seamlessly integrate into the extensive network of existing software and hardware without disrupting any capability currently relied upon by consumers. Without careful development, a rushed update could impair a host of functions including safety features, GPS, or Advanced Driver-Assistance Systems.

This time crunch is exacerbated by the application of some requirements to existing vehicles at the same time as new vehicles. Different makes, models, and trim levels have offered unique mixes of capabilities and have done so through different technologies. This range of technical considerations prevents developers from employing any one-size-fits-all solution. Producers are spread thin attempting to develop an extensive range of backwards looking software solutions all at once.

3) What this bill would do. This bill makes the following changes to current law:

1. Extends and aligns the deadlines for implementation with the model year of vehicles impact rather than a specific date by changing January 1, 2028, to the 2031 model year for all new vehicles. In addition, it adjusts the requirements for cars prior to the 2031 model to align with the 2027, 2028, 2029, and 2030 model years.
2. Increases the exemptions for rental cars to include commercial vehicles by limiting the bill to vehicles under 6,0001 pounds.
3. Makes several other technical changes to the terminology currently in statute.

4) Analysis. As the Committee discussed in detail in its analysis of SB 1394, nationally more than one-third of women will experience rape, physical violence, and/or stalking by an intimate partner in their lifetime and nearly 8 million women experience one or more of these abuses by a current or former partner each year. The most dangerous place for a woman is not out in public; it is in her home. In addition, the most dangerous people for women are not strangers, they are the men she knows and has relationships with. Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave.

The Committee found that the policies contained in SB 1394 were critical for the safety of women and would significantly improve their ability to escape an abuser. This bill preserves those important protections. While it delays implementation for the in-car capabilities, it preserves the interim requirement that manufacturers provide a means for women fleeing abusers to request that the connection between the car and the remote applications be severed and requires the manufacturers to honor that request within two-days.

5) Amendments. Due to the upcoming July 1, 2026 deadline in statute, the Committee amendments add an urgency clause.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for Automotive Innovation
California New Car Dealers Association
Carmax
Carvana

Opposition

None on file.

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

Date of Hearing: June 16, 2026

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 719

Author:(Cabaldon) – As Amended Ver:June 10, 2026

PROPOSED AMENDMENT

SENATE VOTE: N/A

SUBJECT: Access to connected vehicle service.

SYNOPSIS

In 2024, the Legislature passed, and the Governor signed SB 1394 (Min, Ashby, and Weber-Pierson; Ch. 655, Stats 2024). That bill required that automakers assist women fleeing violent men in their lives by providing them with a way to disconnect a vehicle’s remote location services from inside of a car, thus stopping their perpetrator from tracking their movements and location.

That bill required a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car. This Committee found that the policies contained in SB 1394 were critical for the safety of women and would significantly improve their ability to escape an abuser.

While supportive of the bill, some automakers ran into challenges meeting the timeframes that were included. This bill adjusts the time frames in statute and aligns them with vehicle model years, rather than specific dates.

This bill was gutted and amended in this Committee. In light of an upcoming July 1, 2026, deadline for automakers, the Committee amendments add an urgency clause.

EXISTING LAW:

1. Defines the following:
   1. “Account holder” means a person who is a party to or a user of services provided under a contract for connected vehicle service with a covered provider, and includes, but is not limited to, a subscriber, customer, or registered user.
   2. “Connected vehicle location access” is a type of connected vehicle service that allows a person who is outside of a vehicle, excluding a covered provider or vehicle cellular data provider, to view or track the location of the vehicle, including, but not limited to, a location determined by a Global Positioning System (GPS), whether through the internet, an app-based technology, or any other remote wireless connectivity technology.
   3. “Connected vehicle service” means any capability provided by or on behalf of a vehicle manufacturer that enables a person, excluding a covered provider or vehicle cellular data provider, to remotely obtain data from, or send commands to, a vehicle, which may be accomplished through a software application that is designed to be operated on a mobile device.
   4. “Connected vehicle service account” means an account or other means by which a person enrolls in or obtains access to a connected vehicle service.
   5. “Connected vehicle service request” means a request by a driver to terminate a person’s access to connected vehicle service.
   6. “Covered provider” means a vehicle manufacturer or an entity acting on behalf of the vehicle manufacturer that provides connected vehicle service. (Veh. Code § 28200.)
2. Requires, beginning January 1, 2028, that a vehicle with connected vehicle service clearly indicates to a person inside the vehicle that someone outside the vehicle has accessed the connected vehicle service or the connected vehicle location access. (Veh. Code § 28202.)
3. Requires, beginning January 1, 2028, that new vehicles with connected vehicle location access include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner. (Veh. Code § 28240.)
4. Requires that on July 1, 2026, vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, must be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality. (Veh. Code § 28206.)
5. Allows manufacturers to require a driver to input a mobile phone number associated with the connected vehicle service account to disable the location access. (Veh. Code § 28242.)
6. Prohibits requiring any verification beyond the phone number in order to disable location access, including, but not limited to, the use of a two-factor authentication process. (Veh. Code § 28242.)
7. Exempts vehicles owned or operated by a rental company that is subject to the provisions in Civil Code Section 1393.01. (Veh. Code § 20206(c).)
8. Required auto manufacturers, by July 1, 2025, to develop a clear process for allowing drivers to submit a request to have any connected vehicle service connection account severed and to obtain a new connected vehicle service account. (Veh. Code § 28206.)
9. Requires a driver to submit documentation demonstrating that they have the authority to terminate a person's access to the connected vehicle service. (Veh. Code § 28224.)
10. Requires the manufacturer to terminate the service within two business days of receiving the request. (Veh. Code § 28224.)

THIS BILL:

1. Modifies the definition of “connected vehicle service” to mean a software application that is designed to be operated on a mobile device.
2. Adds the following definitions:
   1. “Requestor” means any person submitting a connected vehicle service request who has the vehicle identification number and proof of legal possession.
   2. “Vehicle” means a motor vehicle having a manufacturer’s maximum gross vehicle weight rating under 6,001 pounds, with connected vehicle service.
3. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to clearly indicate to a person inside the vehicle if connected vehicle location access is enabled.
4. Changes the current January 1, 2028, operative date to the 2031 model year for requiring all vehicles with a connected vehicle service to include a mechanism within the car that allows a driver to disable that access and only allows it to be re-enabled in the same manner.
5. Changes the current July 1, 2026, operative date for vehicles manufactured prior to January 1, 2028, that have connected vehicle location access, to be updated with the ability for a driver to disable that access if the vehicle has the capability to receive software updates that provide for that functionality to the following:
   1. For 2028, 2029, and 2030 model year vehicles, as soon as practicable after the vehicle is sold unless technologically infeasible.
   2. On or before July 1, 2027, for 2027 model year or older vehicles unless technologically infeasible.

COMMENTS:

1. Author’s statement. According to the author:

In 2024, SB 1394 made an important commitment to survivors of domestic abuse by providing victims with the power to disable the connected vehicle features that perpetrators use to track and harass them. However, the short timeline did not give automobile manufacturers enough time to make these changes within the multi-year vehicle design and manufacturing process.

SB 719 does not remove any victim safety requirements of the law. It clarifies technical aspects, adjusts the law's implementation dates to better align with the multi-year design and manufacturing process for vehicles, and is consistent with similar laws in other states.

2) The need for this bill. In 2024, the Legislature passed, and the Governor signed SB 1394 (Min, Ashby, and Weber-Pierson; Ch. 655, Stats 2024). That bill required that automakers assist women fleeing violent men in their lives by providing them with a way to disconnect a vehicle’s remote location services from inside of a car, thus stopping their perpetrator from tacking them through the car.

As outlined in EXISTING LAW, that bill required a vehicle manufacturer that includes connected vehicle services in its automobiles, beginning January 1, 2028, to notify a driver if a person outside the car accessed their connected vehicle service or connected vehicle location access. In addition, after January 1, 2028, a manufacturer will need to include a mechanism that allows a driver to disable the connected vehicle location access from inside the car.

While supportive of the bill, some automakers ran into challenges meeting the time frames that were included. The Alliance for Automotive Innovation, along with a coalition of car dealers, describe the challenges in this way:

As automakers have worked to implement the law, it has become clear that certain deadlines cannot be met. While automakers have already implemented the webpage-based termination requirement, the timelines associated with in-vehicle features do not align with the realities of vehicle production.

Vehicle development begins nearly a decade before a particular model hits the road. The process requires extensive engineering, testing, validation, and coordination across complex global supply chains. Each aspect of a vehicle is designed with the entire system in mind. Both hardware and software must function safely and reliably as an independent component and as part of a greater whole. As a result, vehicle systems cannot be redesigned and deployed on the timelines required by SB 1394.

For example, the requirement that vehicles include an in-vehicle mechanism to terminate location services takes effect on July 1, 2026. This date provides less than two years between final bill language going into print and the effective date for manufacturers to review, design, test, and deploy updates. These changes must seamlessly integrate into the extensive network of existing software and hardware without disrupting any capability currently relied upon by consumers. Without careful development, a rushed update could impair a host of functions including safety features, GPS, or Advanced Driver-Assistance Systems.

This time crunch is exacerbated by the application of some requirements to existing vehicles at the same time as new vehicles. Different makes, models, and trim levels have offered unique mixes of capabilities and have done so through different technologies. This range of technical considerations prevents developers from employing any one-size-fits-all solution. Producers are spread thin attempting to develop an extensive range of backwards looking software solutions all at once.

3) What this bill would do. This bill makes the following changes to current law:

1. Extends and aligns the deadlines for implementation with the model year of vehicles impact rather than a specific date by changing January 1, 2028, to the 2031 model year for all new vehicles. In addition, it adjusts the requirements for cars prior to the 2031 model to align with the 2027, 2028, 2029, and 2030 model years.
2. Increases the exemptions for rental cars to include commercial vehicles by limiting the bill to vehicles under 6,0001 pounds.
3. Makes several other technical changes to the terminology currently in statute.

4) Analysis. As the Committee discussed in detail in its analysis of SB 1394, nationally more than one-third of women will experience rape, physical violence, and/or stalking by an intimate partner in their lifetime and nearly 8 million women experience one or more of these abuses by a current or former partner each year. The most dangerous place for a woman is not out in public; it is in her home. In addition, the most dangerous people for women are not strangers, they are the men she knows and has relationships with. Adding to the risk, the most dangerous time for someone who is in a relationship with a violent abuser is when they decide to leave.

The Committee found that the policies contained in SB 1394 were critical for the safety of women and would significantly improve their ability to escape an abuser. This bill preserves those important protections. While it delays implementation for the in-car capabilities, it preserves the interim requirement that manufacturers provide a means for women fleeing abusers to request that the connection between the car and the remote applications be severed and requires the manufacturers to honor that request within two-days.

5) Amendments. Due to the upcoming July 1, 2026 deadline in statute, the Committee amendments add an urgency clause.

REGISTERED SUPPORT / OPPOSITION:

Support

Alliance for Automotive Innovation
California New Car Dealers Association
Carmax
Carvana

Opposition

None on file.

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

 THIRD READING  

Bill No: SB 719

Author: Cabaldon (D)

Amended: 1/6/26

Vote: 21

SENATE JUDICIARY COMMITTEE: 13-0, 1/13/26

AYES: Umberg, Niello, Allen, Ashby, Caballero, Durazo, Laird, Reyes, Stern, Valladares, Wahab, Weber Pierson, Wiener

SENATE GOVERNMENTAL ORG. COMMITTEE: 14-0, 1/13/26

AYES: Padilla, Valladares, Archuleta, Ashby, Blakespear, Cervantes, Dahle, Jones, Ochoa Bogh, Richardson, Rubio, Smallwood-Cuevas, Wahab, Weber Pierson

NO VOTE RECORDED: Hurtado

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

SUBJECT: Department of Technology: inventory: high-risk automated decision systems

SOURCE: Author

DIGEST:

This bill extends, until January 1, 2032, the requirement that the California Department of Technology (CDT) annually submit a report to the Legislature on the comprehensive inventory of all high-risk automated decision systems (ADS) that have been or are being used, developed, or procured by a state agency.

ANALYSIS:

Existing law:

1. Requires CDT, on or before September 1, 2024, to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any agency.
2. Defines a “high-risk ADS” to mean an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.
3. Requires CDT, on or before January 1, 2025, and annually thereafter, to submit a report of the comprehensive inventory described above to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization.

This bill extends, by three years from 2029 to 2032, the requirement that CDT submit a report to the Legislature, as specified, regarding the comprehensive inventory of all high-risk ADS that have been, or are being, used, developed, or procured by a state agency.

Background

Author Statement. According to the author’s office, “organizations such as the GovAI Coalition and the NewDEAL Forum AI Task Force are systematically documenting best practices from California's local agencies and peer jurisdictions nationwide. As evidence accumulates—both through implementation case studies demonstrating improved public service delivery and through emerging principles for responsible AI integration—pressure will mount for statewide deployment of these systems.

“A recent NewDEAL Forum report on AI in governance articulates this imperative clearly: governments at every level cannot remain passive observers fixated solely on regulation. State and local leaders must urgently model people-first AI governance to ensure the future of government serves the public good.

“According to the January 2025 report from CDT, ‘as required by GC 11546.45.5, CDT collected and reviewed data to assemble a high-risk algorithmic decision-making systems (ADS) inventory. Of the 198 of 204 State agencies providing responses, no high-risk ADS were reported.’

“Concurrently, the CDT is developing an innovative Project Delivery Lifecycle for systems procurement that emphasizes minimum viable products and iterative scaling—an approach that will accelerate the deployment of AI solutions to address critical processing bottlenecks. Given the imminent adoption of high-risk ADSs across state operations, the Legislature has a fundamental responsibility to maintain rigorous oversight. SB 719 refines previously established accountability mechanisms for high-risk.”

CDT’s High-Risk Automated Decision System Inventory. AB 302 (Ward, Chapter 800, Statutes of 2023) requires CDT, until January 1, 2029, to annually submit a report of the comprehensive inventory of high-risk ADS to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization. This comprehensive list includes all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by any state agency.

For the purposes of the inventory, statute defines “state agency” to mean any of the following: any state office, department, division, or bureau; the California State University; The Board of Parole Hearings; any board or other professional licensing and regulatory body under the administration or oversight of the California Department of Consumer Affairs. “State agency” does not include the University of California, the Legislature, the judicial branch, or any board, except as provided.

An “automated decision system” is defined to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision making and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.

A “high-risk” ADS means an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

Utilization of ADS. Since the 1950s computers have advanced from being able to do basic processing to having the capacity to undertake complex, ambiguous, and highly skilled tasks. These systems range from simple rule-based tools to complex artificial intelligence (AI), automating routine tasks while raising concerns about bias and transparency. Common applications include loan approvals, fraud detection, credit scoring, screening resumes, eligibility assessments for benefits, bail decisions in the justice system, resource allocation, dynamic pricing, and product recommendations. These systems have the potential to replace or support human decision-makers and rely heavily on data processing and analysis.

Of the 204 state agencies CDT canvased pursuant to AB 302 (Ward, Chapter 800, Statutes of 2023) 198 agencies provided responses. This represents a 97% response rate. CDT sent weekly email reminders to state agencies leading up to the August 30th reporting deadline. After the deadline expired, CDT sent one more email reminder to state agencies that had not yet provided a response. Notably, 140 of 140 executive departments, 19 of 22 constitutional departments, 22 of 24 CSUs, and 17 of 18 independents provided responses.

CDT did not receive responses from the following state agencies that it canvased: California State Summer School for the Arts; California State University, San Marcos; California State University, East Bay; Historical Records Advisory Board; California Secretary of State; and the Uniform Construction Cost Accounting Commission. For the state agencies that did not provide a response to the high-risk data collection request, CDT plans to make an executive level outreach to help ensure future compliance.

According to the initial January 2025 CDT comprehensive inventory report, no state agency reported use of high-risk ADS. Although state agencies did not report high-risk ADS, CDT notes that it works with its state agency customers on their ADS, regardless of their risk level. CDT provides consultation for ADS risk assessment, as defined by existing law.

Risks vary based on use cases for ADS, the services of the state agency using ADS, and the specific data privacy requirements of the state agency using ADS, among other factors. CDT relies on National Institute of Standards and Technology (NIST) risk management best practices and definitions to identify risk areas for ADS. These best practices are considered the government standard for risk mitigation.

The report notes that “ADS can offer a wide variety of benefits to state agencies” including workforce productivity gains, workload scalability and consistency, faster decision-making, data-driven insights, and predictive capabilities. CDT further identifies the following – non exhaustive – risks based on use cases for ADS: validity and reliability, safety, accountability and transparency, security and resiliency, explainability and interpretability, privacy, and fairness.

According to the January 2025 report, CDT is “fully committed to its mission to partner with state, local government, and educational entities to advance California’s technology and ensure secure, equitable, and reliable solutions through effective policy and oversight, statewide strategies, and innovative services. As such, CDT remains dedicated to ensuring the safe, ethical, and responsible implementation of technologies and as mandated by AB 302, will continue to provide reports to the Legislature and Administration on high-risk ADS systems annually until 2029.”

Related/Prior Legislation

SB 420 (Padilla, 2025) regulates the use of high-risk ADS including requirements on developers and deployers to perform impact assessments on their systems, establishes the right of individuals to know when an ADS has been used, details about the systems, and an opportunity to appeal ADS decisions, where technically feasible. (Pending in the Assembly Privacy and Consumer Protection Committee)

SB 468 (Becker, 2025) imposes a duty on a business that deploys a high-risk AI system, or high-risk ADS, that, process personal information to protect that information and requires such a deployer to maintain a comprehensive information security program that meets specified requirements. (Pending in the Senate Appropriations Committee)

AB 1018 (Bauer-Kahan, 2025) regulates the use of ADS and places obligations on developers and deployers of such systems designed or used to make or facilitate “consequential decisions,” as specified. (Pending on the Senate Inactive File)

SB 892 (Padilla, 2024) would have required CDT to develop and adopt regulations to create an ADS procurement standard, as specified, and prohibited a state agency from procuring ADS, entering into a contract for ADS, or any service that utilizes ADS, until CDT has adopted regulations creating an ADS procurement standard, as specified. (Vetoed by Governor Newsom)

SB 896 (Dodd, Chapter 928, Statutes of 2024) the Generative Artificial Intelligence (GenAI) Accountability Act, among other things, codifies the requirement that CDT report to the Governor as specified in Executive Order N-12-23; requires the Office of Emergency Services (OES) to perform a risk analysis of potential threats posed by the use of GenAI to California’s critical infrastructure, as specified; and requires a entity, that is utilizing GenAI to directly communicate with a person regarding government services and benefits, to ensure that those communications include a disclaimer, as specified, and information describing how the person may contact a human employee.

AB 2885 (Bauer-Kahan, Chapter 843, Statutes of 2024) established, among other things, a uniform definition for “artificial intelligence” in statute, as specified.

SCR 17 (Dodd, Res. Chapter 135, Statutes of 2023) commits the Legislature to examining and implementing the principles outlined in the Blueprint for an Artificial Intelligence Bill of Rights, published in October 2022, by the White House Office of Science and Technology Policy, as specified.

AB 302 (Ward, Chapter 800, Statutes of 2023) requires CDT to conduct an inventory of all high-risk ADS being used in state agencies by September 1, 2024, and requires CDT to report to the Legislature on that inventory January 1 of each year until 2029.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 1/20/26)

None received

OPPOSITION: (Verified 1/20/26)

None received

Prepared by: Brian Duke / G.O. / (916) 651-1530

1/21/26 16:05:27

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2025-2026 Regular Session

Bill No: SB 719 (Author:Cabaldon)

Version: January 6, 2026

Hearing Date: January 13, 2026

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Department of Technology: inventory: high-risk automated decision systems

DIGEST

This bill extends the requirement for the California Department of Technology (CDT) to conduct annual inventories of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agencies and to submit a report of the comprehensive inventories to the Legislature. These requirements become inoperative on January 1, 2032.

EXECUTIVE SUMMARY

ADS, especially those powered by AI, are being increasingly deployed in a multitude of contexts, including employment, housing, education, and health care. Major transparency and fairness concerns have been raised about the use of ADS to make consequential decisions, essentially determinations with significant legal or other material effect on people’s lives.

Existing law required CDT to conduct a comprehensive inventory of all high-risk ADS in use, or proposed for use, by state agencies by September 1, 2024 and a report of the inventory was due to the Legislature by January 1, 2025. CDT submitted that report last year, finding zero instances where high-risk ADS were proposed for use, development, or procurement by, or were being used, developed, or procured by, any state agency. This bill now requires annual inventories and reporting on those inventories until 2032.

This bill is author sponsored. No timely support or opposition has been received by this Committee. This bill will be heard by the Senate Governmental Organization Committee the same day as this Committee, and as such the votes from that Committee are not available at the time this analysis is published.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Requires the California Department of Technology (CDT), on or before September 1, 2024, to conduct a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. It defines the relevant terms:
   1. “ADS” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.
   2. “High-risk automated decision system” means an ADS that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice. (Gov. Code § 11546.45.5.)
2. Requires CDT, on or before January 1, 2025, and annually thereafter, to submit a report of the comprehensive inventory described above to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization, as specified. The requirement for submitting a report becomes inoperative on January 1, 2029. (Gov. Code § 11546.45.5(d).)

This bill requires CDT to conduct annual inventories and to submit reports of those inventories to the Legislature until January 1, 2032.

COMMENTS

1. Considerations for development and deployment of ADS

With recent dramatic advances in the capabilities of AI systems, the need for regulatory frameworks for accountability and responsible development and deployment have become ever more urgent. This is especially true with respect to AI-powered ADS that are used to make, or assist in making, decisions that have a legal or other significant effect.

ADS introduce several concerning issues when deployed across various sectors. Bias and discrimination represent perhaps the most significant problem, as AI systems frequently reflect and amplify historical biases present in their training data. This can lead to unfair outcomes based on protected characteristics like race, gender, and socioeconomic status, particularly in sensitive domains such as hiring, lending, housing allocation, and criminal justice.

The lack of transparency in many AI systems compounds these concerns. These technologies often function as “black boxes” where the rationale behind specific decisions remains obscure even to their developers. This opacity makes it exceptionally difficult for affected individuals to understand why they were denied government benefits, were passed over for a job opportunity, or received an unfavorable outcome. Such obscurity directly challenges meaningful accountability when harmful outcomes inevitably occur.

Accuracy and reliability issues also persist even in sophisticated AI systems. These technologies can make confident but incorrect predictions, with errors often disproportionately affecting already marginalized groups.

Accountability gaps emerge when determining responsibility for AI-caused harms. The complex relationship between developers, deployers, and users makes liability difficult to establish. Legal frameworks consistently lag behind rapidly advancing technological capabilities, creating environments where harms can occur without clear recourse.

To gain an understanding of how these ADS were being deployed by state agencies, AB 302 (Ward, Ch. 800, Stats. 2023) required CDT, in coordination with other interagency bodies, to conduct, on or before September 1, 2024, a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or were being used, developed, or procured by, state agencies. The goal was to simply provide transparency into state use of these systems before further regulating their use. The law requires the comprehensive inventory to include a description of, among other things, the categories of data and personal information the ADS uses to make its decisions. CDT was required, on or before January 1, 2025, and annually thereafter, to submit a report of the above-described comprehensive inventory to the Legislature.

CDT released its report last year. Despite the explosion of ADS deployment across the nation, CDT reported that zero agencies, of the over 200 agencies polled, were deploying or proposing to deploy high-risk ADS.

1. Continued transparency for state-deployed ADS

This bill requires CDT to conduct annual inventories and to submit reports on them to the Legislature until January 1, 2032. According to the author:

Organizations such as the GovAI Coalition and the NewDEAL Forum AI Task Force are systematically documenting best practices from California's local agencies and peer jurisdictions nationwide. As evidence accumulates—both through implementation case studies demonstrating improved public service delivery and through emerging principles for responsible AI integration—pressure will mount for statewide deployment of these systems.

A recent NewDEAL Forum report on AI in governance articulates this imperative clearly: governments at every level cannot remain passive observers fixated solely on regulation. State and local leaders must urgently model people-first AI governance to ensure the future of government serves the public good.

According to the January 2025 report from CDT, “as required by GC 11546.45.5, CDT collected and reviewed data to assemble a high-risk algorithmic decision-making systems (ADS) inventory. Of the 198 of 204 State agencies providing responses, no high-risk ADS were reported.”

Concurrently, the CDT is developing an innovative Project Delivery Lifecycle for systems procurement that emphasizes minimum viable products and iterative scaling—an approach that will accelerate the deployment of AI solutions to address critical processing bottlenecks. Given the imminent adoption of high-risk ADSs across state operations, the Legislature has a fundamental responsibility to maintain rigorous oversight. SB 719 refines previously established accountability mechanisms for high-risk ADS.

SUPPORT

None known

OPPOSITION

None known

RELATED LEGISLATION

Pending Legislation:

SB 420 (Padilla, 2025) regulates the use of high-risk ADS. This includes requirements on developers and deployers to perform impact assessments on their systems. This bill establishes the right of individuals to know when an ADS has been used, details about the systems, and an opportunity to appeal ADS decisions, where technically feasible. SB 420 is currently in the Assembly Privacy and Consumer Protection Committee.

SB 468 (Becker, 2025) imposes a duty on a business that deploys a high-risk artificial intelligence system, or high-risk ADS, that processes personal information to protect that information and requires such a deployer to maintain a comprehensive information security program that meets specified requirements. SB 468 is currently in the Senate Appropriations Committee.

AB 1018 (Bauer-Kahan, 2025) regulates the use of ADS. It places obligations on developers and deployers of such systems designed or used to make or facilitate “consequential decisions.” AB 1018 is currently on the Senate Floor.

Prior Legislation:

SB 7 (McNerney, 2025) would have regulated the use of ADS in the employment setting. Among other things, the bill would have required specified notice to affected employees and applicants and placed limitations and outright restrictions on ADS utilization in the employment context. The bill was vetoed by Governor Newsom, who stated in part:

I share the author's concern that in certain cases unregulated use of ADS by employers can be harmful to workers. However, rather than addressing the specific ways employers misuse this technology, the bill imposes unfocused notification requirements on any business using even the most innocuous tools. This proposed solution fails to directly address incidents of misuse.

SB 892 (Padilla, 2024) would have required CDT to develop and adopt regulations to create an ADS procurement standard, as specified, and prohibited a state agency from procuring ADS, entering into a contract for ADS, or any service that utilizes ADS, until CDT has adopted regulations creating an ADS procurement standard, as specified. SB 892 was vetoed by Governor Newsom, who stated in his veto message that aspects of the bill would disrupt ongoing work, “including existing information technology modernization efforts, which would lead to implementation delays and higher expenses for critical projects.”

AB 302 (Ward, Ch. 800, Stats. 2023) See Comment 1.

**************

SENATE COMMITTEE ON GOVERNMENTAL ORGANIZATION

Senator Stephen Padilla

Chair

2025 - 2026 Regular

Bill No: Hearing Date: 1/13/2026

SUBJECT:

DIGEST: This bill extends – until January 1, 2032 – the requirement that the California Department of Technology (CDT) annually submit a report to the Legislature on the comprehensive inventory of all high-risk automated decision systems (ADS) that have been or are being used, developed, or procured by a state agency.

ANALYSIS:

Existing law:

1. Establishes the CDT, within the Government Operations Agency (GovOps), and requires the Director of Technology (Director) to supervise the CDT and report directly to the Governor on issues relating to information technology.
2. Requires CDT, on or before September 1, 2024, to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any agency.
3. Defines a “high-risk ADS” to mean an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.
4. Defines “state agency” to mean any of the following:
   1. Any state office, department, division, or bureau.
   2. The California State University.
   3. The Board of Parole Hearings.
   4. Any board or other professional licensing and regulatory body under the administration or oversight of the Department of Consumer Affairs.
5. Provides that a “state agency” does not include the University of California, the Legislature, the judicial branch, or any board, except as provided above.
6. Requires CDT, on or before January 1, 2025, and annually thereafter, to submit a report of the comprehensive inventory described above to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization.
7. Provides that any report required or requested by law be submitted by a state or local agency to a committee of the Legislature or the Members of either house of the Legislature generally, to instead be submitted as a printed copy to the Secretary of the Senate, as an electronic copy to the Chief Clerk of the Assembly, and as an electronic or printed copy to the Legislative Counsel, as specified.

This bill extends, by three years from 2029 to 2032, the requirement that CDT submit a report to the Legislature, as specified, regarding the comprehensive inventory of all high-risk ADS that have been, or are being, used, developed, or procured by a state agency.

Background

Author Statement. According to the author’s office, “organizations such as the GovAI Coalition and the NewDEAL Forum AI Task Force are systematically documenting best practices from California's local agencies and peer jurisdictions nationwide. As evidence accumulates—both through implementation case studies demonstrating improved public service delivery and through emerging principles for responsible AI integration—pressure will mount for statewide deployment of these systems.

“A recent NewDEAL Forum report on AI in governance articulates this imperative clearly: governments at every level cannot remain passive observers fixated solely on regulation. State and local leaders must urgently model people-first AI governance to ensure the future of government serves the public good.

“According to the January 2025 report from CDT, ‘as required by GC 11546.45.5, CDT collected and reviewed data to assemble a high-risk algorithmic decision-making systems (ADS) inventory. Of the 198 of 204 State agencies providing responses, no high-risk ADS were reported.’

“Concurrently, the CDT is developing an innovative Project Delivery Lifecycle for systems procurement that emphasizes minimum viable products and iterative scaling—an approach that will accelerate the deployment of AI solutions to address critical processing bottlenecks. Given the imminent adoption of high-risk ADSs across state operations, the Legislature has a fundamental responsibility to maintain rigorous oversight. SB 719 refines previously established accountability mechanisms for high-risk.”

CDT’s High-Risk Automated Decision System Inventory. AB 302 (Ward, Chapter 800, Statutes of 2023) requires CDT, until January 1, 2029, to annually submit a report of the comprehensive inventory of high-risk ADS to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization. This comprehensive list includes all high-risk ADS that have been proposed for use, development, or procurement by, or are being used, developed, or procured by any state agency.

For the purposes of the inventory, statute defines “state agency” to mean any of the following: any state office, department, division, or bureau; the California State University; The Board of Parole Hearings; any board or other professional licensing and regulatory body under the administration or oversight of the California Department of Consumer Affairs. “State agency” does not include the University of California, the Legislature, the judicial branch, or any board, except as provided.

An “automated decision system” is defined to mean a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision making and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.

A “high-risk” ADS means an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

Utilization of ADS. Since the 1950s computers have advanced from being able to do basic processing to having the capacity to undertake complex, ambiguous, and highly skilled tasks. These systems range from simple rule-based tools to complex artificial intelligence (AI), automating routine tasks while raising concerns about bias and transparency. Common applications include loan approvals, fraud detection, credit scoring, screening resumes, eligibility assessments for benefits, bail decisions in the justice system, resource allocation, dynamic pricing, and product recommendations. These systems have the potential to replace or support human decision-makers and rely heavily on data processing and analysis.

Of the 204 state agencies CDT canvased pursuant to AB 302 (Ward, Chapter 800, Statutes of 2023) 198 agencies provided responses. This represents a 97% response rate. CDT sent weekly email reminders to state agencies leading up to the August 30th reporting deadline. After the deadline expired, CDT sent one more email reminder to state agencies that had not yet provided a response. Notably, 140 of 140 executive departments, 19 of 22 constitutional departments, 22 of 24 CSUs, and 17 of 18 independents provided responses.

CDT did not receive responses from the following state agencies that it canvased: California State Summer School for the Arts; California State University, San Marcos; California State University, East Bay; Historical Records Advisory Board; California Secretary of State; and the Uniform Construction Cost Accounting Commission. For the state agencies that did not provide a response to the high-risk data collection request, CDT plans to make an executive level outreach to help ensure future compliance.

According to the initial January 2025 CDT comprehensive inventory report, no state agency reported use of high-risk ADS. Although state agencies did not report high-risk ADS, CDT notes that it works with its state agency customers on their ADS, regardless of their risk level. CDT provides consultation for ADS risk assessment, as defined by existing law.

Risks vary based on use cases for ADS, the services of the state agency using ADS, and the specific data privacy requirements of the state agency using ADS, among other factors. CDT relies on National Institute of Standards and Technology (NIST) risk management best practices and definitions to identify risk areas for ADS. These best practices are considered the government standard for risk mitigation.

The report notes that “ADS can offer a wide variety of benefits to state agencies” including workforce productivity gains, workload scalability and consistency, faster decision-making, data-driven insights, and predictive capabilities. CDT further identifies the following – non exhaustive – risks based on use cases for ADS: validity and reliability, safety, accountability and transparency, security and resiliency, explainability and interpretability, privacy, and fairness.

According to the January 2025 report, CDT is “fully committed to its mission to partner with state, local government, and educational entities to advance California’s technology and ensure secure, equitable, and reliable solutions through effective policy and oversight, statewide strategies, and innovative services. As such, CDT remains dedicated to ensuring the safe, ethical, and responsible implementation of technologies and as mandated by AB 302, will continue to provide reports to the Legislature and Administration on high-risk ADS systems annually until 2029.”

Prior/Related Legislation

AB 1018 (Bauer-Kahan, 2025) regulates the use of ADS and places obligations on developers and deployers of such systems designed or used to make or facilitate “consequential decisions,” as specified. (Pending on the Senate Inactive File)

SB 892 (Padilla, 2024) would have required CDT to develop and adopt regulations to create an ADS procurement standard, as specified, and prohibited a state agency from procuring ADS, entering into a contract for ADS, or any service that utilizes ADS, until CDT has adopted regulations creating an ADS procurement standard, as specified. (Vetoed by Governor Newsom)

SB 896 (Dodd, Chapter 928, Statutes of 2024) the Generative Artificial Intelligence (GenAI) Accountability Act, among other things, codifies the requirement that CDT report to the Governor as specified in Executive Order N-12-23; requires the Office of Emergency Services (OES) to perform a risk analysis of potential threats posed by the use of GenAI to California’s critical infrastructure, as specified; and requires a entity, that is utilizing GenAI to directly communicate with a person regarding government services and benefits, to ensure that those communications include a disclaimer, as specified, and information describing how the person may contact a human employee.

AB 2885 (Bauer-Kahan, Chapter 843, Statutes of 2024) established, among other things, a uniform definition for “artificial intelligence” in statute, as specified.

AB 302 (Ward, Chapter 800, Statutes of 2023) requires CDT to conduct an inventory of all high-risk ADS being used in state agencies by September 1, 2024, and requires CDT to report to the Legislature on that inventory January 1 of each year until 2029.

FISCAL EFFECT: Appropriation: Fiscal Com.: Local:

SUPPORT:

None received

OPPOSITION:

None received

DUAL REFERRAL: Senate Governmental Organization Committee and Senate Judiciary Committee