Civil detention facilities.

Bill status updated from 'Amended Assembly' to 'Enrolled' with passage dates added: passed Senate and Assembly on August 30, 2026, enrolled September 1, 2026.

Formatting changed from printed legislative document layout (with page numbers, line numbers, and column headers) to a web-based display format with navigation menus and bill information panels.

Added a new Division 123 (Sections 153000-153001) to the Health and Safety Code establishing the 'Protecting Vulnerable Immigrant Detainees Model Act.' This requires the Attorney General to submit a proposed oversight plan for private civil detention facilities to the Legislature by December 31, 2027, covering health care provision and conditions of detention. The Governor must direct an appropriate state entity to cooperate with the AG in developing the plan.

State agencies directed to cooperate must designate a senior representative, provide requested information within 30 days (or an agreed timeframe), and review and provide input on the oversight plan. Information received from state agencies that they consider confidential must be kept confidential by the AG.

Narrowed the notice that social media companies must give individuals whose personal information is disclosed via administrative subpoena. Previously, companies had to notify the individual of the reason for disclosure and the basis for determining the subpoena was valid. Now they only need to state that the information was disclosed pursuant to an administrative subpoena and provide a description of the information disclosed.

The report submission requirement under the new detention facility oversight provision becomes inoperative on January 1, 2031, pursuant to Section 10231.5 of the Government Code.

Added constitutional findings (new SEC. 2) justifying a limitation on public access to records exchanged between state agencies and the Attorney General in developing the detention facility oversight plan, citing the need for free exchange of information and analysis among agencies.

Added an exception in subdivision (c)(1)(C)(D): the post-disclosure notice requirement does not apply if compliance would violate a court order prohibiting disclosure of the request.

Added a new emergency exception in subdivision (d)(3): the invalidity-determination requirement does not apply to administrative subpoenas under Section 1509(a)(1) of Title 19 if the company has a good faith belief that an emergency involving child exploitation or human smuggling or trafficking requires immediate disclosure.

Changed the post-disclosure notice from requiring 'all of the following' three items to 'both of the following' two items: (i) that the information was disclosed pursuant to an administrative subpoena, and (ii) a description of the information disclosed. The separate requirement to state the reason for disclosure and the basis for validity was restructured into the notice framework.

Added a requirement in subdivision (d)(1) that the notice to the Attorney General must also inform whether the affected user has been notified by the social media company pursuant to subdivision (c).

Changed 'must notify' to 'shall notify' in the Attorney General notification provision, and renumbered subdivisions (e) through (i) to (d) through (h) with corresponding cross-reference updates.

The notification requirement in subdivision (c)(1) was expanded from covering only Section 1225(d)(4)(A) of Title 8 (immigration) subpoenas to covering all 'administrative subpoenas' as defined, which includes both Section 1225 and Section 1509 (customs) subpoenas.

Subdivision (d)(1) now includes Section 1509(a)(1)(A) of Title 19 (customs merchandise entry records) as an additional lawful purpose for which a subpoena may be issued, alongside the existing Section 1225 reference.

The Senate version included an exception in subdivision (c)(3) allowing a social media company to respond before the 30-day period if it determined the subpoena was not invalid. The Assembly removed this exception, making the 30-day waiting period unconditional.

The invalidity standard in subdivision (d)(4) was changed from 'overly broad or compliance would be unduly burdensome' to 'too indefinite or broad,' removing the undue burden prong and simplifying the test.

The entire online dating service safety policy requirement (Chapter 22.9, Section 22690) was removed from the bill. The bill no longer requires online dating services to adopt safety policies or report to the Attorney General.

Information submitted to the Attorney General pursuant to the new notification requirement is exempt from the California Public Records Act and shall not be disclosed upon request.

The definition of 'administrative subpoena' was expanded to include subpoenas issued under Section 1509(a)(1)(A) of Title 19 of the U.S. Code (customs and trade), in addition to the existing immigration-related subpoenas under Section 1225(d)(4)(A) of Title 8.

The definition of 'personal information' now excludes records required by law or regulation for the entry of merchandise pursuant to the customs provision (Section 1509(a)(1)(A) of Title 19).

The notification standard changed from requiring individuals to have 'sufficient time' to respond or challenge a subpoena to a specific requirement that social media companies provide at least 30 days before responding.

New post-disclosure notice requirement: if a social media company discloses personal information in response to an administrative subpoena, it must notify the individual of the reason for disclosure, the basis for determining the subpoena was valid, and a description of the information disclosed.

Social media companies must now notify the Attorney General within five business days of responding to an administrative subpoena. The AG must develop a process specifying what information to provide and in what format.

A social media company is prohibited from responding to an administrative subpoena for personal information while a legal challenge to that subpoena is pending, if the company has actual knowledge of the challenge.

The invalidity grounds were restructured: 'irrelevant' was changed to 'irrelevant or immaterial,' and 'overly broad or compliance would be unduly burdensome' was changed to 'too indefinite or broad.' The framing shifted from a flat prohibition on responding to an invalid subpoena to a requirement that the company determine whether the subpoena is invalid before responding.

A new Section 3 adds legislative findings under Article I, Section 3 of the California Constitution, demonstrating the interest protected by limiting public access to records (supporting the CPRA exemption for notices submitted to the Attorney General).

The entire Online Dating Services chapter (Chapter 22.9, Sections 22690-22696) was removed. This included requirements for dating services to adopt safety policies, post links to those policies, submit annual reports to the Attorney General, and face civil penalties up to $20,000 per violation.

A new Chapter 31.7 (Section 22946.5) was added, titled the 'Stopping Harmful Information Exploitation and Lawless Data Sharing Act,' which applies to social media companies (as defined in Section 22675) and addresses federal immigration administrative subpoenas under 8 U.S.C. 1225(d)(4)(A).

The amendment to Civil Code Section 1770 that would have made failing to adopt or publish an online dating safety policy an unfair or deceptive business practice was removed.

Social media companies must promptly notify an individual when their personal information is requested by a covered administrative subpoena, and may not respond until the individual has had sufficient time to respond to or challenge the subpoena.

Social media companies are prohibited from responding to an administrative subpoena if it is invalid because: the information is not related to a lawfully authorized purpose, the information is irrelevant, or the request is overly broad or unduly burdensome.

The bill defines 'individual' as a natural person who is a California resident, limiting the notification and challenge rights to California residents only.

Both the Attorney General and any individual whose information was shared in violation of the chapter may bring a civil action for injunctive or declaratory relief against the social media company.

A severability clause was added as Section 2, stating that if any provision is held invalid, the remaining provisions continue in effect.