AB 1727 California Assembly · 2025-2026 Regular Session

Crimes: theft of DNA.

Summary

Existing law, the Genetic Information Privacy Act, requires a direct-to-consumer genetic testing company, as defined, to provide a consumer with certain information regarding the company's policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data, and to obtain a consumer's express consent for collection, use, or disclosure of the consumer's genetic data, as specified. Existing law assesses a civil penalty not to exceed $1,000 for a negligent violation of these provisions, and a civil penalty between $1,000 and $10,000, inclusive, for a willful violation of these provisions. This bill would require all local law enforcement agencies in the state to report to the Attorney General starting July 1, 2027, and annually thereafter, the number of reports filed in the past year on the theft of deoxyribonucleic acid (DNA) and the current status of those cases. The bill would require the Attorney General to, on or before January 1, 2028, report to the Legislature, and post on its internet website, the number of police reports filed on the theft of DNA and the current status of those cases. By increasing duties on local law enforcement, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Bill status in committee 1 of 4 stages cleared

Introduction

Feb 2026

Committee Review

Floor Vote

Governor

Introduced Feb 5, 2026 Last action May 14, 2026

Maddy AI version diff · 3 comparisons

What changed between versions

04/23/26 - Amended Assembly → AB1727 · 1 edit

MINOR

No substantive policy changes occurred between these two versions. The diff reflects a change in document presentation format, from a printed legislative document layout (with line numbers and page headers) to a web page rendering of the same bill text. All statutory provisions remain identical.

TECHNICAL

The document was reformatted from a printed legislative document (with line numbers, page headers like '97' and 'AB 1727 -2-') into a web page layout with navigation elements, search boxes, and different typographic structure. No statutory language was added, removed, or altered.

03/19/26 - Amended Assembly → 04/23/26 - Amended Assembly · 3 edits · Apr 23, 2026

MINOR

AB 1727 was dramatically scaled back between these versions. The March version created a multi-tiered criminal offense structure (Penal Code Section 367) with first-degree felony, second-degree felony, and third-degree misdemeanor penalties for various unauthorized DNA-related acts. The April version removes all of that and replaces it with a simple reporting requirement (new Penal Code Section 11107.4) obligating local law enforcement to report DNA theft cases to the Attorney General annually starting July 2027, with the AG reporting to the Legislature by January 2028. The only criminal penalty retained is the misdemeanor for willfully selling or transferring genetic data without express consent, which sits in the Civil Code amendment.

Scope change

The bill shifted from creating a broad criminal framework covering multiple types of unauthorized DNA use (collection, testing, disclosure, transfer) with felony and misdemeanor penalties, to a much narrower approach that retains only the misdemeanor for selling/transferring genetic data without consent and adds a data-collection reporting mechanism for law enforcement to track DNA theft cases statewide.

SCOPE

The entire Penal Code Section 367 was deleted. This section had created three levels of 'unlawful use of DNA' offenses: first degree (felony, up to 5 years in jail and $15,000 fine) for selling/transferring DNA without consent; second degree (felony, 16 months to 3 years and $7,500 fine) for submitting DNA for testing or disclosing genetic data without consent; and third degree (misdemeanor, up to 1 year and $6,000 fine) for collecting/retaining DNA with intent to analyze or accessing computer systems without authorization. It also included detailed definitions and exemptions for law enforcement, courts, HIPAA-covered entities, and institutions of higher education.

REQUIREMENT

New Penal Code Section 11107.4 requires all local law enforcement agencies to report to the Attorney General starting July 1, 2027, and annually thereafter, the number of police reports filed on theft of DNA and the current status of those cases. The Attorney General must then report to the Legislature and post on its website by January 1, 2028, and annually thereafter.

FISCAL

The state mandate reimbursement provision changed from 'no reimbursement is required' (because the act only created a new crime) to 'if the Commission on State Mandates determines that this act contains costs mandated by the state, reimbursement shall be made.' This acknowledges that the new reporting duties imposed on local law enforcement agencies may trigger state-mandated local program reimbursement obligations.

02/05/26 - Introduced → 03/19/26 - Amended Assembly · 6 edits · Mar 19, 2026

MODERATE

The amended version of AB 1727 expands the bill's scope beyond adding a new Penal Code section to also amend Civil Code Section 56.182, which governs penalties under the Genetic Information Privacy Act. The most significant addition is a new criminal misdemeanor for willfully selling or transferring genetic data without express consent, punishable by up to one year in county jail and a fine of up to $1,000. The amendment also specifies enforcement mechanisms, directs that recovered penalties be paid to the affected individual, and adds a provision making contract terms that limit legal remedies unenforceable.

SCOPE

The bill now amends Section 56.182 of the Civil Code in addition to adding Section 367 to the Penal Code, expanding its reach into the civil enforcement framework of the Genetic Information Privacy Act.

ENFORCEMENT

A new criminal misdemeanor is created for any person who willfully sells or transfers genetic data without express consent, punishable by up to one year in county jail, a fine not to exceed $1,000, or both. This sits alongside the existing civil penalties for negligent (up to $1,000) and willful ($1,000-$10,000) violations.

Enforcement is limited to the Attorney General, a district attorney, county counsel authorized by agreement with the DA, or a city attorney in cities over 750,000 population (or city and county). Private individuals may file complaints but cannot prosecute directly.

Each violation of the chapter is declared a separate and actionable violation, meaning multiple instances can be prosecuted individually rather than being treated as a single offense.

FISCAL

Court costs recovered are paid to the prosecuting party, and civil penalties recovered are paid directly to the individual whose genetic data was at issue, rather than to the state.

REQUIREMENT

A new anti-waiver provision states that any contract or agreement between a consumer and a covered person that delays or limits access to a legal remedy for a violation of the Genetic Information Privacy Act is unenforceable.

Floor votes

How they voted

No floor votes recorded yet.

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Amendments

May 14, 2026

Lower · Passed

In committee: Held under submission.

lower

May 13, 2026

Committee

In committee: Set, first hearing. Referred to APPR. suspense file.

lower

Apr 27, 2026

Committee

Re-referred to Com. on APPR.

lower

Apr 23, 2026

Lower · Passed

Read second time and amended.

lower

Apr 22, 2026

Introduced

From committee: Amend, and do pass as amended and re-refer to Com. on APPR. with recommendation: To Consent Calendar. (Ayes 15. Noes 0.) (April 21).

lower

Mar 31, 2026

Lower · Passed

In committee: Hearing postponed by committee.

lower

Mar 23, 2026

Committee

Re-referred to Com. on P. & C.P.

lower

Mar 19, 2026

Lower · Passed

Read second time and amended.

lower

Mar 18, 2026

Introduced

From committee: Amend, and do pass as amended and re-refer to Com. on P. & C.P. (Ayes 9. Noes 0.) (March 17).

lower

Mar 10, 2026

Lower · Passed

In committee: Set, first hearing. Hearing canceled at the request of author.

lower

Feb 23, 2026

Committee

Referred to Coms. on PUB. S. and P. & C.P.

lower

Feb 6, 2026

Lower · Passed

From printer. May be heard in committee March 8.

lower

1 primary · 0 co-sponsors