AB 364 California Assembly · 2025-2026 Regular Session

Personal information: maintenance.

Summary

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. The CCPA requires a business that controls the collection of a consumer's personal information to, at or before the point of collection, inform a consumer of, among other things, the categories of personal information to be collected, the purposes for which the categories of personal information are collected or used, and whether that information is sold or shared. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. This bill would enact the Stop Foreign Governments from Accessing Californians' Sensitive Personal Information Act which would additionally require a business to disclose to a consumer if the business intends to maintain the consumer's personal information outside of the United States. The bill would prohibit a business from maintaining a consumer's personal information outside of the United States unless, among other things, the consumer explicitly consented to the business maintaining the consumer's personal information outside of the United States. The bill would also prohibit a business from maintaining personal information that is health care information, financial information, or geolocation data in the custody of a foreign government or a third party that is owned or controlled by a foreign government. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Issues: ✓ Technology

Bill status failed 1 of 4 stages cleared

Introduction

Feb 2025

Committee Review

Floor Vote

Governor

Introduced Feb 3, 2025 Last action Feb 2, 2026

Maddy AI version diff · 3 comparisons

What changed between versions

03/13/25 - Amended Assembly → 03/24/25 - Amended Assembly · 4 edits · Mar 24, 2025

MODERATE

AB 364 was amended to add a short title ('Stop Foreign Governments from Accessing Californians' Sensitive Personal Information Act'), remove all references to social media regulation from the bill's stated purpose and legislative intent, and renumber sections accordingly. The core privacy provisions requiring disclosure of offshore data maintenance and prohibiting foreign government custody of sensitive data remain substantively unchanged. The fiscal committee requirement was changed from 'no' to 'yes,' indicating the bill now requires a fiscal impact analysis.

SCOPE

A new Section 1 was added giving the bill the short title 'Stop Foreign Governments from Accessing Californians' Sensitive Personal Information Act.' This provides an official name for citation purposes.

All references to social media platforms were removed from the bill's stated purpose. The original described it as 'an act relating to social media platforms' and the digest referenced the Protecting Our Kids from Social Media Addiction Act. The legislative intent section about regulating 'social media, ecommerce, privacy, and information technology' was also deleted. The bill is now framed purely as a privacy/data protection measure.

TECHNICAL

Sections were renumbered: the amendment to Section 1798.100 moved from Section 1 to Section 2, the addition of Section 1798.122 moved from Section 2 to Section 3, and the legislative findings declaration moved from Section 3 to Section 4.

The fiscal committee requirement was changed from 'no' to 'yes,' meaning the bill now requires review by the Legislative Fiscal Council for a cost estimate before it can proceed.

02/03/25 - Introduced → 03/13/25 - Amended Assembly · 10 edits · Mar 13, 2025

MAJOR

AB 364 was transformed from a simple legislative intent statement into a substantive data privacy law. The amended version adds detailed requirements to the California Consumer Privacy Act (CCPA) governing how businesses must disclose, retain, and transfer personal information, and creates a new section that restricts cross-border data transfers and prohibits storing sensitive data with foreign governments. This is a significant expansion from a placeholder bill into enforceable privacy obligations.

Scope change

The bill went from having no legal effect (a pure statement of legislative intent) to imposing binding obligations on all businesses that collect personal information in California, with particular restrictions on cross-border data transfers and foreign government access to sensitive data categories.

REQUIREMENT

Businesses must now disclose to consumers if they intend to maintain the consumer's personal information outside of the United States, at or before the point of collection.

Businesses must inform consumers of the length of time they intend to retain each category of personal information (or criteria for determining that period) and may not retain data longer than reasonably necessary for the disclosed purpose.

Businesses are prohibited from collecting additional categories of personal information or using collected information for incompatible purposes without providing new notice to the consumer.

A new proportionality requirement mandates that a business's collection, use, retention, and sharing of personal information must be reasonably necessary and proportionate to the disclosed purpose.

New contract requirements mandate that businesses entering agreements with third parties, service providers, or contractors for selling or sharing personal information must include specific terms: limited purposes, compliance obligations, rights to monitor use, notification of inability to comply, and rights to stop and remediate unauthorized use.

Businesses must implement reasonable security procedures and practices appropriate to the nature of the personal information to protect it from unauthorized access, destruction, use, modification, or disclosure.

SCOPE

A new Section 1798.122 prohibits a business from maintaining consumer personal information outside the United States unless the consumer was informed of risks, explicitly consented, and the data is not health care information, financial information, or geolocation data.

An absolute prohibition bars any business from maintaining health care information, financial information, or geolocation data in the custody of a foreign government or a third party owned or controlled by a foreign government.

The bill's scope expanded dramatically from a non-binding statement of legislative intent to enforceable amendments to the Civil Code (Sections 1798.100 and new 1798.122) with specific obligations on businesses collecting personal information.

DEFINITION

The bill declares that its provisions further the purposes and intent of the California Privacy Rights Act of 2020 (Proposition 24), tying it to the existing CCPA enforcement framework overseen by the California Privacy Protection Agency.

Floor votes

How they voted

No floor votes recorded yet.

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Amendments

Feb 2, 2026

Lower · Passed

From committee: Filed with the Chief Clerk pursuant to Joint Rule 56.

lower

Mar 25, 2025

Lower · Passed

In committee: Hearing postponed by committee.

lower

Mar 25, 2025

Committee

Re-referred to Com. on P. & C.P.

lower

Mar 24, 2025

Introduced

From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.

lower

Mar 17, 2025

Committee

Re-referred to Com. on P. & C.P.

lower

Mar 13, 2025

Introduced

From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.

lower

Mar 13, 2025

Committee

Referred to Com. on P. & C.P.

lower

Feb 4, 2025

Lower · Passed

From printer. May be heard in committee March 6.

lower

1 primary · 0 co-sponsors