Pupil and parental communication: extracurricular activities: addictive feeds.

The entire Civil Code Section 1798.99.86.5 was deleted. This section would have required the California Privacy Protection Agency to obtain a list of all state and local elected officials by March 1, 2026, required the Judicial Council to provide a list of all California judges, uploaded those lists to the accessible deletion mechanism, required entities to process deletions within 5 days beginning August 1, 2026, kept the lists confidential from public records disclosure, and allowed elected officials, judges, the Attorney General, county counsel, or city attorneys to bring enforcement actions including declaratory relief, injunctive relief, attorney's fees, actual damages, and punitive damages for willful violations.

The bill title no longer references 'personal information' or the Civil Code. It now only references the Education Code provisions relating to local educational agencies.

A new paragraph (a)(2) was added to Section 49058 (extracurricular activities) encouraging local educational agencies to inform pupils and their parents or guardians about the rights described in the section via a pupil handbook or similar document made generally available.

A new paragraph (a)(2) was added to Section 51103 (parental communication) encouraging local educational agencies to inform pupils and their parents or guardians about the rights described in the section via a pupil handbook or similar document made generally available.

The fiscal committee determination changed from 'yes' to 'no,' reflecting that the removed data broker provisions would have imposed ongoing costs on the California Privacy Protection Agency and other entities, while the remaining education code provisions do not create a state-mandated local program with fiscal impact.

The entire Title 23 'Protected Individuals' (Sections 3273.75 through 3273.80) was deleted from the Civil Code. This removed: definitions of protected individual, personal information, publish, and sell; the right to request businesses delete or stop selling personal information within 72 hours; the right to request governmental entities remove published personal information within 72 hours; a prohibition on businesses knowingly selling personal information when it poses an imminent and serious threat (with a $5,000 civil penalty); and enforcement actions available to protected individuals, the Attorney General, county counsel, or city attorneys.

New Education Code Article 10 (Section 49058) prohibits local educational agencies (school districts, county offices of education, charter schools) from excluding a pupil from any extracurricular activity, including sports and clubs, due to the pupil not having or using addictive feeds, effective the 2027-28 school year.

New Education Code Section 51103 prohibits local educational agencies from using addictive feeds as the only means of contacting pupils or their parents or guardians, effective the 2027-28 school year.

New definition of 'addictive feed' covering websites, online services, applications, or portions thereof where multiple pieces of user-generated media are recommended, selected, or prioritized for display based on information associated with the user or device. Seven exceptions are listed, including: non-persistent information, search terms, privacy/accessibility settings, user-requested specific media (not auto-played), direct private communications, preexisting sequences from the same source (not auto-played), and compliance with state or federal law.

The state-mandated local program designation changed from 'yes' to 'no,' meaning the bill no longer triggers reimbursement obligations to local agencies under the Government Code. This is consistent with the removal of Title 23 provisions that had imposed duties on governmental entities (local agencies).

The bill's title was changed from adding 'Title 23 (commencing with Section 3273.75) to Part 4 of Division 3' to simply adding 'Section 1798.99.86.5 to the Civil Code,' reflecting the removal of the broader Title 23 structure.

New Section 1798.99.86.5 added to the Civil Code requiring the CPPA to obtain a list of all state and local elected officials by March 1, 2026 and the Judicial Council to provide a list of all California judges. These lists serve as automatic deletion requests under the existing data broker accessible deletion mechanism (Section 1798.99.86). Officials and judges can opt out of the lists.

The prohibition on businesses was narrowed from covering both 'publishing and selling' of protected individuals' personal information to only 'selling.' The threat-based civil penalty provision (up to $5,000) now applies only to selling, not publishing.

Beginning August 1, 2026, any entity receiving a notification that a deletion is required must complete it within five days, creating a much faster compliance deadline than the existing 45-day data broker cycle.

References to 'person' throughout the bill were changed to 'business,' narrowing who can be held liable. Previously any person could be subject to deletion requests and penalties; now only businesses are covered under the request and penalty provisions.

Section 3273.76 was simplified: the detailed request criteria (written request, certified mail or email, adequate identification of publication) were removed for business deletion requests. The section now simply requires a business to delete personal information within 72 hours of receiving a request.

New enforcement provision in Section 1798.99.86.5 allows an elected official or judge on the list, the Attorney General, a county counsel, or a city attorney to bring an action for violations, seeking declaratory relief, injunctive relief, attorney's fees, actual damages, and punitive damages for willful refusal.

New Section 2 adds legislative findings required by Article I, Section 3 of the California Constitution, demonstrating that limiting public access to the official lists is necessary to protect the confidential and private information of elected officials and judges.

The state-mandated local program designation changed from 'no' to 'yes,' meaning the bill now imposes costs on local agencies that may require state reimbursement under the Commission on State Mandates process.

The misdemeanor criminal penalty for knowingly publishing or selling a protected individual's personal information was removed. Only a civil penalty of up to $5,000 (brought by the Attorney General) remains.

The civil action provision (now Section 3273.80) was expanded to cover violations of both the business/person deletion request section and the new governmental entity section, and punitive damages can now be awarded against either a business or a governmental entity for willful refusal.

A new Section 3273.77 requires the California Privacy Protection Agency to obtain lists of all state and local elected officials and judges (including contact information) by March 1, 2026, and to proactively submit deletion requests to registered data brokers on behalf of those individuals.

A new Section 3273.78 allows a protected individual or their authorized representative to request that a governmental entity refrain from publishing or remove the individual's personal information, with a 72-hour removal requirement. This imposes duties on local agencies.

The term 'person' was replaced with 'business' in the prohibition on publishing or selling personal information, narrowing who is subject to that specific provision. However, 'governmental entity' is separately covered under the new Section 3273.78.

The definition of 'personal information' was expanded to include a specific list: residential address, personal email, personal phone number, driver's license number, passport number, geolocation data, license plate or vehicle identifier, birth/marital/divorce records, names of family members, school or daycare, place of worship, and place of employment.

New definitions added for 'business' (aligned with CCPA terminology), 'data broker' (cross-referencing Section 1798.99.80), and 'governmental entity' (state or local agency including law enforcement and investigative entities).

A new exclusion from 'personal information' was added: information that is required by law to be made publicly available by a governmental entity.

The reimbursement provision changed from a blanket 'no reimbursement required' (based on the old crime-creation exception) to a conditional provision: if the Commission on State Mandates determines the act contains state-mandated costs, reimbursement shall be made under Government Code Section 17500 et seq. The bill is now designated as imposing a state-mandated local program.

All amendments to Section 56.10 of the Civil Code (Confidentiality of Medical Information Act) were removed. This included: restrictions on complying with foreign subpoenas absent a California state court order under the Interstate and International Depositions and Discovery Act; expanded search warrant exceptions requiring that out-of-state warrants not interfere with California reproductive rights law; and new prohibitions on intentionally selling medical information or using it for marketing.

The bill's stated purpose was narrowed from amending both the CMIA and adding Title 23 to solely adding Title 23 (Protected Individuals) to the Civil Code.

The state-mandated local program designation changed from 'yes' to 'no' in the fiscal note, reflecting that with the CMIA provisions removed, fewer new enforcement costs are imposed on local agencies.

Minor formatting corrections: 'e-mail' was changed to 'email' in two places in Section 3273.76, and the penalty language in Section 3273.77(b) was slightly reworded to read 'shall be subject to a civil penalty not exceeding five thousand dollars ($5,000), or both ($5,000) in an action brought only by the Attorney General' for clarity.

Adds new Title 23 (Sections 3273.75-3273.78) to Part 4 of Division 3 of the Civil Code, creating a 'Protected Individuals' framework that did not exist in the Assembly version

Narrows Section 56.10(b)(1)(A) court order exception: previously allowed disclosure when compelled by a California state court order OR a court order from another state based on that state's law (so long as it does not interfere with California law); now only allows disclosure for orders issued by a California state court, including those issued pursuant to Section 2029.300 relating to foreign subpoenas

Changes Section 56.10(b)(9) from 'when otherwise specifically required by California law' to 'when otherwise specifically required by law,' removing the limitation to California law only

Defines 'protected individual' as current or former elected state representatives (as determined by the Secretary of State), appointed court officers or magistrates, and their spouses, children, or dependents residing in the same household

Creates a right for protected individuals (or the California Privacy Protection Agency on their behalf) to request that any person or governmental entity refrain from publishing or selling their personal information, or remove it from existing publications within 72 hours of receipt of the request

Makes it a misdemeanor (plus civil penalty up to $5,000) for a person to knowingly publish or sell a protected individual's personal information when they know or reasonably should know it poses an imminent and serious threat and results in assault, harassment, trespass, or malicious destruction of property

Allows protected individuals, the Attorney General, county counsel, or city attorney to bring civil actions for declaratory relief, injunctive relief, attorney's fees, actual damages, and punitive damages (for willful refusal) against those who fail to comply with removal requests

Defines 'personal information' (incorporating CCPA definition but including publicly available information, with exceptions for information disclosed with informed consent or relevant to news/commentary on matters of public concern), 'publish' (making publicly available on an internet website or social media platform), and 'sell' (selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information to a third party for monetary or other valuable consideration)

New sub-paragraph (b)(1)(B) prohibits a provider of health care, health care service plan, or contractor from complying with a court order that constitutes a foreign subpoena unless a California court has issued an order pursuant to Section 2029.300 of the Code of Civil Procedure (the Interstate and International Depositions and Discovery Act).

Sub-paragraph (b)(1) is restructured into (A) and (B). Sub-paragraph (A) now explicitly includes court orders issued by a California state court pursuant to Section 2029.300 relating to foreign subpoenas as a basis for compelled disclosure.

The search warrant provision in sub-paragraph (b)(6) now adds that execution of the warrant must not constitute a violation of Penal Code Section 13778.2, which prohibits certain enforcement actions related to lawful abortions. This means out-of-state search warrants targeting abortion-related medical records are blocked.

Subdivision (d) is narrowed: the prohibition changes from 'intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services' to only 'intentionally selling medical information or using medical information for marketing.' The exception for express patient authorization is also deleted from this subdivision.

Subdivision (e) similarly removes the patient authorization exception, aligning with the change in subdivision (d).