AB 1337 California Assembly · 2025-2026 Regular Session

Information Practices Act of 1977.

Summary

Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. Existing law exempts from the provisions of the act counties, cities, any city and county, school districts, municipal corporations, districts, political subdivisions, and other local public agencies, as specified. This bill would, beginning January 1, 2028, recast those provisions to, among other things, remove that exemption for local agencies, and would revise and expand the definition of "personal information." The bill would make other technical, nonsubstantive, and conforming changes. Because the bill would expand the duties of local officials, this bill would impose a state-mandated local program. Existing law requires an agency to provide on or with any form used to collect personal information from individuals an initial notice that includes specified information, followed by a periodic notice of not more than one-year intervals, as provided. This bill would make changes to that notice requirement, including requiring periodic notice at least once every three years. Existing law requires an agency to establish rules of conduct for persons involved in the design, development, operation, disclosure, or maintenance of records containing personal information and instruct those persons with respect to specified rules relevant to the act. This bill would provide that the above-described rules of conduct shall be subject to any limitations or conditions set forth in any applicable collective bargaining agreement, and would prohibit an agency from using records containing personal information for any purpose or purposes other than the purpose or purposes for which that personal information was collected, except as required or authorized by state or local law. Existing law prohibits an agency from disclosing any personal information in a manner that would link the information disclosed to the individual to whom it pertains, except under specified circumstances. This bill would revise the circumstances that may allow the disclosure of personal information in a manner that could link the information disclosed to the individual to whom it pertains, including by authorizing disclosure for specified purposes related to real property, social safety net programs, and medical information, and would make conforming changes. Existing law makes an intentional violation of any provision of the act, or of any rules or regulations adopted under the act, by an officer or employee of any agency a cause for discipline, including termination of employment. This bill would also make a negligent violation of the act a cause for discipline. Existing law provides that the intentional disclosure of medical, psychiatric, or psychological information in violation of the disclosure provisions of the act, that is not otherwise permitted by law, is punishable as a misdemeanor if the wrongful disclosure results in economic loss or personal injury to the individual to whom the information pertains. This bill would remove the requirement that the wrongful disclosure result in economic loss or personal injury. Because the bill would expand the scope of an existing crime by deleting this condition, the bill would impose a state-mandated local program. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason. With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Bill status passed 3 of 5 stages cleared

Introduction

Feb 2025

Committee Review

Jun 2026

Assembly Passage

Jun 2025

Senate Passage

Governor

Introduced Feb 21, 2025 Last action Jun 25, 2026

Maddy AI version diff · 4 comparisons

What changed between versions

04/08/25 - Amended Assembly → 05/23/25 - Amended Assembly · 5 edits · May 23, 2025

MODERATE

AB 1337 was amended to broaden the definition of 'personal information' by removing redundant qualifying language, expand the circumstances under which agencies may disclose personal information to the federal government (from only when 'required' by law to when 'required or authorized'), and incorporate the expanded Section 1798.3 definition into the breach notification provisions. These changes make it easier for state agencies to share data with federal authorities and widen the range of data types that trigger mandatory breach notification.

DEFINITION

The definition of 'personal information' in Section 1798.3 was simplified by removing the phrase 'that is maintained by an agency that identifies or describes an individual,' leaving only 'any information that identifies, relates to, describes, or is capable of being associated with, a particular individual.' This removes a potentially limiting qualifier and makes the definition cleaner.

SCOPE

Section 1798.24(f) was changed from permitting disclosure to a branch of the federal government only when 'required by state or federal law' to when 'required authorized by state or federal law.' This adds 'authorized' as an additional legal basis, meaning agencies can now share personal information with the federal government whenever federal or state law authorizes (not just requires) such disclosure.

REQUIREMENT

A new item was added to the breach notification section (Section 1798.26, subdivision (g)) that cross-references the full definition of 'personal information' from Section 1798.3. This means all data types covered by the expanded definition - including neural data, genetic data, biometric information, precise geolocation, and audio/visual/thermal data - now trigger breach notification obligations, not just the previously enumerated categories.

TECHNICAL

Section 1798.24(q) was clarified to fix confusing duplicate language about legislative staff access. The old text read 'the Member's Member of the Legislature's staff if authorized in writing by the Member, Member of the Legislature' and was corrected to 'the Member of the Legislature's staff if authorized in writing by the Member of the Legislature.'

Minor typo correction: 'video tapes' changed to 'videotapes' in the list of physical formats for personal information.

05/23/25 - Amended Assembly → 06/01/26 - Amended Senate · 8 edits · Jun 1, 2026

MODERATE

The Senate amendment to AB 1337 introduces a January 1, 2028 effective date for most of its changes, creating a transitional period where existing law continues to apply. It adds a local agency exemption that expires in 2028 (meaning local agencies will be covered by the expanded privacy rules starting that date), relaxes the periodic notice requirement from annual to every three years, and expands the definition of personal information and disclosure exceptions.

Scope change

The bill's scope expands to include local agencies starting January 1, 2028 (previously exempt), broadens the definition of personal information with a new catch-all category, adds new disclosure exceptions for real property, social safety net, and medical purposes, and relaxes the notice frequency requirement from annual to triennial.

TIMELINE

A January 1, 2028 effective date is added for the recast provisions. Existing sections are amended with sunset clauses (repealed January 1, 2028) and new parallel sections are added that become operative on that date, creating a transition period.

SCOPE

Local agencies are exempted from the definition of 'agency' in the transitional section but are NOT exempted in the new section operative January 1, 2028. This means local agencies will be subject to the expanded privacy requirements starting in 2028.

The purpose limitation on use of personal information is expanded from 'except as required by federal law, or as authorized or required by state law' to 'except as required or authorized by state or local law,' adding local law as a permissible basis for secondary use.

New disclosure exceptions are authorized for specified purposes related to real property, social safety net programs, and medical information.

DEFINITION

The definition of 'personal information' is expanded to include a broader catch-all: any information maintained by an agency that identifies or describes an individual, including name, social security number, physical description, home address, home telephone number, education, financial matters, and medical or employment history. It also explicitly includes statements made by or attributed to the individual.

New definitions are added for 'system of records' (records pertaining to individuals retrieved by name or identifying number) and 'governmental entity' (any branch of federal or local government). The definition of 'record' is expanded to include identification by photograph, finger or voice print, or assigned number or symbol.

REQUIREMENT

The periodic notice requirement for agencies collecting personal information is relaxed from 'not more than one-year intervals' to 'at least once every three years' in the new section operative January 1, 2028.

Rules of conduct for persons handling personal information are now subject to limitations or conditions in applicable collective bargaining agreements, replacing the Assembly version's requirement that rules be consistent with the State Administrative Manual and State Information Management Manual.

02/21/25 - Introduced → 04/08/25 - Amended Assembly · 9 edits · Apr 8, 2025

MAJOR

The amended version of AB 1337 substantially expands the definition of 'personal information' to include biometric data, genetic data, neural data, precise geolocation, online identifiers, health information, sexual orientation, and other sensitive categories. It also removes the exemption for local agencies, bringing them fully under the Information Practices Act, and adds new definitions for 'precise geolocation data' and 'neural data.' These changes significantly broaden both the types of data protected and the range of government entities subject to the law.

DEFINITION

The definition of 'personal information' is completely restructured from a simple list into 13 enumerated categories (A through M), adding online identifiers, IP addresses, vehicle registration info, contents of communications, protected classification characteristics, racial/ethnic origin, immigration status, religious beliefs, political affiliations, union membership, biometric information, genetic data, precise geolocation, sensory data (audio, thermal, olfactory), insurance policy numbers, neural data, health information, and gender/sex life/sexual orientation.

A new subdivision (a)(2) specifies that personal information may exist in physical formats (paper, vinyl records, video tapes), digital formats (text, image, audio, video files), and abstract digital formats including compressed or encrypted files, metadata, and AI systems capable of outputting personal information.

New definition of 'precise geolocation data' as data derived from a device used to locate an individual within a geographic area equal to or less than a circle with a radius of 1,850 feet.

New definition of 'neural data' as information generated by measuring the activity of an individual's central or peripheral nervous system that is not inferred from nonneural information.

The definition of 'system of records' is removed entirely from the bill.

The definition of 'record' is simplified from requiring an identifying particular (name, photograph, fingerprint, number or symbol) to simply 'any file or grouping of personal information that is maintained by an agency.'

The definition of 'governmental entity' is removed; all references throughout the bill are replaced with 'branch of the federal government,' narrowing the scope of covered entities for certain disclosure provisions.

SCOPE

The exemption for local agencies (previously exclusion (4) in the definition of 'agency') is removed, meaning local agencies are now fully subject to the Information Practices Act requirements.

The sentence 'Local government functions mandated by the state are not deemed agency functions within the meaning of this section' is removed from Section 1798.19, further extending the act's reach to local government operations.

Floor votes · Assembly Jun 3, 2025

How they voted

63–0

Passed · 15 other

Total votes 78

Jun 3, 2025

D Democratic59

56 Yea 3

94% Yea

R Republican19

7 Yea 12

36% Yea

Vote distribution

All Yea All Nay Mixed No data

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Amendments

Jun 25, 2026

Upper · Passed

In committee: Set, final hearing. Hearing canceled at the request of author.

upper

Jun 19, 2026

Upper · Passed

In committee: Hearing postponed by committee.

upper

Jun 12, 2026

Upper · Passed

In committee: Set, second hearing. Hearing canceled at the request of author.

upper

Jun 1, 2026

Introduced

From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on P., D.T., & C.P.

upper

Jun 1, 2026

Upper · Passed

In committee: Set, first hearing. Hearing canceled at the request of author.

upper

May 6, 2026

Committee

Re-referred to Com. on P., D.T., & C.P.

upper

Apr 27, 2026

Committee

Re-referred to Com. on RLS.

upper

Jul 15, 2025

Upper · Passed

In committee: Set, first hearing. Failed passage. Reconsideration granted.

upper

Jun 11, 2025

Committee

Referred to Com. on JUD.

upper

Jun 3, 2025

Assembly · Passed

Assembly Vote: pass (63-0-15)

assembly

Jun 2, 2025

Lower · Passed

Read third time. Passed. Ordered to the Senate. (Ayes 64. Noes 0. Page 1921.)

lower

May 23, 2025

Lower · Passed

Read second time and amended. Ordered returned to second reading.

lower

May 23, 2025

Introduced

From committee: Amend, and do pass as amended. (Ayes 11. Noes 1.) (May 23).

lower

Apr 30, 2025

Committee

In committee: Set, first hearing. Referred to suspense file.

lower

Apr 9, 2025

Committee

Re-referred to Com. on APPR.

lower

Apr 8, 2025

Lower · Passed

Read second time and amended.

lower

Apr 7, 2025

Introduced

From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 12. Noes 0.) (April 1).

lower

Mar 17, 2025

Committee

Referred to Com. on P. & C.P.

lower

Feb 22, 2025

Lower · Passed

From printer. May be heard in committee March 24.

lower

Feb 21, 2025

Introduced

Introduced. To print.

lower

1 primary · 0 co-sponsors