Assembly BillIntroducedCivil
AB 2021: California Consumer Privacy Act of 2018: whistleblower complaints.
What AB 2021 does, verified March 3, 2026
This bill aims to amend the California Consumer Privacy Act (CCPA) to include provisions for whistleblower complaints. A person can submit a whistleblower complaint to the agency, which will consider the complaint and may designate it for administrative enforcement. If the complaint is designated, the whistleblower is eligible for an award, which will be at least 15% but not more than 33% of the fines collected through an administrative enforcement action or settlement. The agency will consider certain factors when determining the award amount. The bill also authorizes the agency to assess an administrative penalty against a person who violates the CCPA to cover the whistleblower's attorney fees. The whistleblower's identity will be confidential, except as provided, and will be exempt from the California Public Records Act. The bill also includes provisions for employees, contractors, o…
Bill journey
1IntroducedCurrent
2In CommitteePending
3First Chamber FloorPending
4Second ChamberPending
5GovernorPending
6ChapteredPending
Last action: Referred to Coms. on P. & C.P. and JUD. (2026-03-02)Alert me
Author and sponsors
Full contact details, staff, and committees with Connect, $16/moUnlockRecent actions3 total · showing 3
| Mar. 02, 2026 | Referred to Coms. on P. & C.P. and JUD. |
| Feb. 18, 2026 | From printer. May be heard in committee March 20. |
| Feb. 17, 2026 | Read first time. To print. |
Latest bill textIntroduced version, February 17, 2026 · 4,254 words
CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION
Assembly Bill
No. 2021
| Introduced by Assembly Member Schiavo |
February 17, 2026 |
An act to amend Sections 1798.155, 1798.160, and 1798.199.55 of, and to add Sections 1798.141, 1798.199.101, 1798.199.102, 1798.199.103, 1798.199.104, and 1798.199.105 to, the Civil Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
AB 2021, as introduced, Schiavo. California Consumer Privacy Act of 2018: whistleblower complaints.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The CCPA law makes a business, service provider, contractor, or other person that violates the CCPA liable for an administrative fine, as provided.
The CCPA creates the Consumer Privacy Fund in the State Treasury and makes moneys in the fund available upon appropriation by the Legislature. Existing law requires 95% of any administrative fine assessed, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Subfund, which is created within the Consumer Privacy Fund. The CCPA law requires the funds to be used exclusively by the agency in carrying out its duties under the CCPA. The CCPA requires the other 5% of any administrative fine, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Grant Subfund, also within the Consumer Privacy Fund, to be used exclusively by the agency to administer and distribute grants to promote and protect consumer privacy, as provided.
This bill would authorize a person to submit to the agency, a whistleblower complaint, as defined, and would make the whistleblower eligible for an award if the agency designates a complaint for administrative enforcement and certain requirements are met. The bill would require an eligible whistleblower to receive at least 15% but not more than 33% of the fines collected through an administrative enforcement action or settlement, calculated after the allocation to Consumer Privacy Grant Subfund described above. The bill would require the agency to consider certain factors in determining the amount of the award. The bill would additionally authorize the agency to assess an administrative penalty against a person who violates the CCPA in an amount to cover the reasonable attorney’s fees of the whistleblower.
This bill would create the Consumer Privacy Whistleblower Subfund within the Consumer Privacy Fund and would require the funds awarded by the agency to a whistleblower or for attorney’s fees to be deposited into the Consumer Privacy Whistleblower Subfund. The bill would make those funds available, upon appropriation by the Legislature, for payment to the whistleblower or the whistleblower’s attorney, as appropriate.
This bill would require the whistleblower, in order to be eligible for a whistleblower award, to meet certain requirements, including that the whistleblower be represented by an attorney and declare under penalty of perjury that the information submitted with the whistleblower complaint is true and correct to the best of the whistleblower’s knowledge and belief. The bill would authorize a person to submit a whistleblower complaint anonymously, subject to certain conditions, including that the whistleblower’s attorney certify, under penalty of perjury, that the attorney has taken certain actions, including verifying the whistleblower’s identity. The bill would make a whistleblower’s identify confidential, except as provided, and would exempt disclosure of the whistleblower’s identify from the California Public Records Act.
By requiring the declarations under penalty of perjury described above, the bill would create new crimes and, thus, impose a state-mandated local program.
Under the bill, an employee, contractor, or agent would be entitled to bring a civil action to seek specified relief and damages if the employee, contractor, or agent is subject to specified forms of discrimination in the terms and conditions of their employment because of lawful acts done by the employee, contractor, agent, or associated others in furtherance of a whistleblower complaint or administrative enforcement action under the bill or other efforts to stop one or more violations of the CCPA.
The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
The people of the State of California do enact as follows:
SECTION 1.
Section 1798.141 is added to the Civil Code, to read:1798.141.
In addition to the definitions listed in Section 1798.140, the following definitions apply for purposes of this title:(a) “Original information” means information that is all of the following:
(1) Derived from the whistleblower’s independent knowledge or independent analysis.
(2) Not already known to the California Privacy Protection Agency from any other source, unless the whistleblower is the original source of the information.
(3) (A) Not exclusively derived from any of the following:
(i) A governmental report, hearing, audit, or investigation.
(ii) Allegations made in a judicial hearing.
(iii) Allegations made in or from the news media, including from social media.
(B) This paragraph does not apply if the whistleblower was the original source of the information disclosed pursuant to clauses (i) to (iii), inclusive, of subparagraph (A).
(b) “Original source” means an individual who meets either of the following requirements:
(1) Prior to a public disclosure, the individual voluntarily disclosed to the state, the agency, or a political subdivision of the state the information on which the allegations or transactions in the whistleblower complaint are based.
(2) The individual has knowledge that is independent of, and materially adds to, the publicly disclosed allegations or transactions, and has voluntarily provided the information to the state, the agency, or a political subdivision of the state before submitting a whistleblower complaint under this title.
(c) “Whistleblower” means a person who submits a whistleblower complaint to the California Privacy Protection Agency containing original information relating to a violation of this title.
(d) “Whistleblower complaint” means a written submission from a whistleblower, through the whistleblower’s attorney, that includes substantially all material evidence and information that the whistleblower possesses regarding a violation of this title.
SEC. 2.
Section 1798.155 of the Civil Code is amended to read:1798.155.
Administrative Enforcement(a) Any business, service provider, contractor, or other person that violates this title shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age, as adjusted pursuant to subdivision (d) of Section 1798.199.95, in an administrative enforcement action brought by the California Privacy Protection Agency.
(b) (1) Ninety-five (A) Except as provided in subparagraph (B), 95 percent of any administrative fine assessed for a violation of this title, and of the proceeds of any settlement of an action brought pursuant to subdivision (a), shall be deposited into the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b) of Section 1798.160, and shall be used exclusively by the California Privacy Protection Agency in carrying out its duties under this title.
(B) The amount deposited into the Consumer Privacy Subfund pursuant to subparagraph (A) shall be reduced by any amount awarded by the California Privacy Protection Agency to a whistleblower pursuant to subdivision (b) of Section 1798.199.102.
(2) Five percent of any administrative fine assessed for a violation of this title, and of the proceeds of any settlement of an action brought pursuant to subdivision (a), shall be deposited into the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.
SEC. 3.
Section 1798.160 of the Civil Code is amended to read:1798.160.
Consumer Privacy Fund(a) (1) A special fund to be known as the “Consumer Privacy Fund” is hereby created within the General Fund in the State Treasury, and is available upon appropriation by the Legislature.
(2) Funds in the Consumer Privacy Fund and all subfunds within the fund shall be used exclusively for the purposes described in this section and shall not be subject to appropriation or transfer by the Legislature for any other purpose. Any interest and earnings from the fund and all subfunds within the fund shall be transferred on an annual basis to the State Treasury to be available in the General Fund for appropriation by the Legislature.
(b) (1) The Consumer Privacy Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision.
(2) Ninety-five (A) Except as provided in subparagraph (B), 95 percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Subfund and shall be used exclusively by the California Privacy Protection Agency in carrying out its duties under this title.
(B) The amount deposited into the Consumer Privacy Subfund pursuant to subparagraph (A) shall be reduced by any amount determined by the California Privacy Protection Agency to be awarded to a whistleblower pursuant to subdivision (b) of Section 1798.199.102.
(c) (1) The Attorney General Consumer Privacy Enforcement Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Attorney General Consumer Privacy Enforcement Subfund shall be used exclusively for the purposes described in this subdivision.
(2) Ninety-five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Attorney General Consumer Privacy Enforcement Subfund and shall be used exclusively by the Attorney General in carrying out its duties under this title.
(d) The Consumer Privacy Grant Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature. Funds in the Consumer Privacy Subfund shall be used exclusively for the purposes described in this subdivision.
(1) (A) Five percent of any administrative fine recovered in an action brought by the California Privacy Protection Agency for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund.
(B) Five percent of any civil penalty recovered in an action brought by the Attorney General for a violation of this title shall be deposited into the Consumer Privacy Grant Subfund.
(2) (A) Funds deposited into the Consumer Privacy Grant Subfund shall be used exclusively by the California Privacy Protection Agency to administer and distribute grants to promote and protect consumer privacy, educate children in the area of online privacy, and fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches.
(B) Subject to subparagraph (A), the California Privacy Protection Agency shall make grants from the Consumer Privacy Grant Subfund by distributing one-third of the amount allocated for grant funding in the subfund to each of the following grant recipients:
(i) Nonprofit organizations to promote and protect consumer privacy.
(ii) Nonprofit organizations and public agencies, including school districts, to educate children in the area of online privacy.
(iii) State and local law enforcement agencies to fund cooperative programs with international law enforcement organizations to combat fraudulent activities with respect to consumer data breaches.
(3) (A) The California Privacy Protection Agency shall begin administering the grant program described in paragraph (2) when the amount of funds in the Consumer Privacy Grant Subfund exceeds three hundred thousand dollars ($300,000).
(B) In a fiscal year in which the amount of funds in the Consumer Privacy Grant Subfund is equal to or less than three hundred thousand dollars ($300,000), the funds shall remain in the Consumer Privacy Grant Subfund until the total funds exceed three hundred thousand dollars ($300,000).
(e) (1) The Consumer Privacy Whistleblower Subfund is hereby created within the Consumer Privacy Fund and is available upon appropriation by the Legislature.
(2) The funds determined by the California Privacy Protection Agency to be awarded to a whistleblower pursuant subdivision (b) of Section 1798.199.102, and any administrative penalty for attorney’s fees assessed pursuant to subdivision (d) of Section 1798.199.102, shall be deposited into the Consumer Privacy Whistleblower Subfund and shall be available, upon appropriation by the Legislature, for payment to the whistleblower or the whistleblower’s attorney, as appropriate.
(e)
(f)
Any remaining funds in the Consumer Privacy Fund and subfunds within the fund that were not appropriated as part of the 2025 Budget Act shall be transferred on a one-time basis in the 2025–26 fiscal year as follows:(1) Forty-five percent of the remaining funds shall be transferred to the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b).
(2) Forty-five percent of the remaining funds shall be transferred to the Attorney General Consumer Privacy Enforcement Subfund created within the Consumer Privacy Fund pursuant to subdivision (c).
(3) Ten percent of the remaining funds shall be transferred to the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.
SEC. 4.
Section 1798.199.55 of the Civil Code is amended to read:1798.199.55.
(a) When the agency determines there is probable cause for believing this title has been violated, it shall hold a hearing to determine if a violation has or violations have occurred. Notice shall be given and the hearing conducted in accordance with the Administrative Procedure Act (Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code). The agency shall have all the powers granted by that chapter. If the agency determines on the basis of the hearing conducted pursuant to this subdivision that a violation or violations have occurred, it shall issue an order that may require the violator to do all or any of the following:(1) Cease and desist violation of this title.
(2) Subject to Section 1798.155, pay an administrative fine of up to two thousand five hundred dollars ($2,500) for each violation, or up to seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers. When the agency determines that no violation has occurred, it shall publish a declaration so stating.
(A) Ninety-five (i) Except as provided in clause (ii), 95 percent of any administrative fine assessed pursuant to this paragraph shall be deposited into the Consumer Privacy Subfund created within the Consumer Privacy Fund pursuant to subdivision (b) of Section 1798.160.
(ii) The amount deposited into the Consumer Privacy Subfund pursuant to clause (i) shall be reduced by any amount determined by the California Privacy Protection Agency to be awarded to a whistleblower pursuant to subdivision (b) of Section 1798.199.102.
(B) Five percent of any administrative fine assessed pursuant to this paragraph shall be deposited into the Consumer Privacy Grant Subfund created within the Consumer Privacy Fund pursuant to subdivision (d) of Section 1798.160.
(b) If two or more persons are responsible for any violation or violations, they shall be jointly and severally liable.
SEC. 5.
Section 1798.199.101 is added to the Civil Code, to read:1798.199.101.
(a) A person may submit a whistleblower complaint to the agency.(b) Upon receiving and reviewing a whistleblower complaint, the agency may designate a whistleblower complaint for administrative enforcement action to remedy any violation of this title that is alleged in the whistleblower complaint.
(c) The whistleblower’s attorney shall not represent the agency in connection with any administrative enforcement action based on information contained in a whistleblower complaint, but may provide as much assistance as the agency determines is appropriate to advance the investigation or litigation of the administrative enforcement action.
(d) A decision by the agency to take administrative enforcement action based on information contained in a whistleblower’s complaint does not confer a private right of action, create any property or substantive rights, or permit the whistleblower to bring a claim on behalf of the agency or the state.
SEC. 6.
Section 1798.199.102 is added to the Civil Code, to read:1798.199.102.
(a) If the agency designates a complaint for administrative enforcement and the whistleblower is eligible for an award, the whistleblower shall receive at least 15 percent but not more than 33 percent of the fines of the administrative enforcement action or settlement, calculated after the allocation to the Consumer Privacy Grant Subfund pursuant to Sections 1798.155, 1798.160, and 1798.199.55.(b) The agency shall determine, in its final agency decision or order, the percentage amount of an award. In determining the amount of the award, the agency shall consider the following factors:
(1) The significance of the information provided by the whistleblower to the success of the administrative enforcement action or settlement.
(2) The degree of assistance provided by the whistleblower and the whistleblower’s attorney in advancing the investigation and the administrative enforcement action or settlement. In considering this factor, the agency may take into account any of the following:
(A) Whether the whistleblower provided ongoing, extensive, and timely cooperation and assistance, including, but not limited to, explaining complex facts, interpreting key evidence, or identifying new and productive lines of inquiry.
(B) The timeliness of the whistleblower complaint to the agency or an initial complaint to an internal compliance or reporting system of a business committing or impacted by a violation of this title, if appropriate.
(C) The resources conserved as a result of the whistleblower’s assistance.
(D) Whether the whistleblower appropriately encouraged or authorized others to assist the agency who might otherwise not have participated in the investigation or administrative enforcement action.
(E) The efforts undertaken by the whistleblower to remediate the harm caused by the violations.
(F) Any unique hardships experienced by the whistleblower as a result of reporting and assisting in the administrative enforcement action or settlement.
(c) If the agency determines that an award is payable to a whistleblower pursuant to this section, the award shall be paid to the whistleblower from the Consumer Privacy Whistleblower Subfund, upon appropriation by the Legislature, pursuant to subdivision (e) of Section 1798.160.
(d) In addition to any administrative fine assessed against a business, service provider, contractor, or other person pursuant to Sections 1798.155 and 1798.199.55 for a violation of this title, the agency may also assess an administrative penalty in an amount to cover the reasonable attorney’s fees of the whistleblower. The penalty amount collected shall be deposited into the Consumer Privacy Whistleblower Subfund and shall be payable upon appropriation by the Legislature pursuant to subdivision (e) of Section 1798.160.
SEC. 7.
Section 1798.199.103 is added to the Civil Code, to read:1798.199.103.
(a) To be eligible for an award under subdivision (a) of Section 1798.199.102, a whistleblower shall declare under penalty of perjury that the information submitted with the whistleblower complaint is true and correct to the best of the whistleblower’s knowledge and belief. The whistleblower’s attorney shall submit the complaint to the agency’s headquarters by certified mail, with a return receipt requested, and shall also submit the information electronically through the agency’s internet website.(b) An award shall not be made to any of the following:
(1) A whistleblower who is, or was, at the time the whistleblower acquired the original information submitted to the agency, a member, officer, or employee of either of the following entities:
(A) A federal, state, or law enforcement agency.
(B) A foreign government or data protection authority.
(2) A whistleblower who is the spouse, parent, child, or sibling of an employee, or who resides in the same household as an employee, of the entities listed in paragraph (1).
(3) A whistleblower who is convicted of a criminal violation related to the administrative enforcement action that was instigated based on the whistleblower’s complaint.
(4) A whistleblower who fails to submit information to the agency in the form required by the agency.
(5) A whistleblower who, in the whistleblower complaint or in any other dealings with the agency, knowingly and willfully makes a materially false, fictitious, or fraudulent statement or representation, or knowingly uses a false writing or document with the intent to mislead the agency.
(6) A whistleblower who fails to provide substantial assistance in the investigation and administrative enforcement action.
(7) A whistleblower who submits a whistleblower complaint based on the same essential facts contained in a prior whistleblower complaint received by agency.
(8) A whistleblower who is not represented by an attorney.
SEC. 8.
Section 1798.199.104 is added to the Civil Code, to read:1798.199.104.
(a) A person may submit a whistleblower complaint anonymously.(b) If a person submits a whistleblower complaint anonymously, the whistleblower’s attorney shall certify, under penalty of perjury, that the attorney has taken all of the following actions:
(1) Verified the whistleblower’s identity.
(2) Reviewed the whistleblower’s complaint for completeness and accuracy and has verified that the information contained in the whistleblower complaint is true and complete to the best of the attorney’s knowledge, information, and belief.
(3) Obtained the whistleblower’s consent to disclose the whistleblower’s identity to the agency for purposes of determining whether the whistleblower may have knowingly and willfully made a false, fictitious, or fraudulent statement or representation, or used any false writing or document knowing that the writing or document contains any false, fictitious, or fraudulent statement or entry.
(c) A whistleblower’s identity is confidential and shall not be subject to disclosure pursuant to the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code) or other applicable law.
(d) Notwithstanding subdivision (c), the agency may require a whistleblower to disclose their identity, and may further disclose the whistleblower’s identity, to advance an investigation or to take administrative enforcement action.
(e) Prior to the payment of an award, a whistleblower shall disclose their identity to the agency and provide other information as the agency may require.
SEC. 9.
Section 1798.199.105 is added to the Civil Code, to read:1798.199.105.
(a) An employee, contractor, or agent shall be entitled to all relief necessary to make that employee, contractor, or agent whole, if that employee, contractor, or agent is discharged, demoted, suspended, threatened, harassed, or in any other manner discriminated against in the terms and conditions of that employee’s, contractor’s, or agent’s employment because of lawful acts done by the employee, contractor, agent, or associated others in furtherance of a whistleblower complaint or administrative enforcement action under this title or other efforts to stop one or more violations of this title.(b) Relief under this section shall be sought through a civil action and shall include all of the following:
(1) Reinstatement with the same seniority status that the employee, contractor, or agent would have had but for the discrimination.
(2) Two times the amount of back pay, plus interest on the back pay.
(3) Compensation for any special damages sustained as a result of the discrimination.
(4) Reasonable attorney’s fees and costs.
(c) The court may order either of the following where appropriate:
(1) Punitive damages.
(2) Any other relief the court deems proper.
(d) A civil action under this section shall not be brought more than three years after the date when the discrimination occurred.
SEC. 10.
The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.SEC. 11.
The Legislature finds and declares that Section 8 of this act, which adds Section 1798.199.104 to the Civil Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:In order to balance the public’s right to access records with the need to protect whistleblowers from retaliation, it is necessary that a whistleblower’s identity be kept confidential.
SEC. 12.
No reimbursement is required by this act pursuant to Section 6 of Article XIII B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII B of the California Constitution.Text of AB 2021 as introduced, from the official record. Connect Plus keeps every version and highlights what changed.Compare versions