Assembly BillChaptered/SignedBusiness and Professions
AB 2561: Operating systems and applications: privacy settings.
What AB 2561 does, verified September 29, 2026
<ul> <li>Requires operating systems and applications to configure a user's default privacy setting to be the most privacy protective setting offered by the operating system or application.</li> <li>Prohibits an operating system or application from changing a user's privacy setting without the user's explicit consent.</li> <li>Protects consumers' right to control their personal information by preventing businesses from collecting or selling their information without consent.</li> </ul>
Bill journey
✓IntroducedComplete
✓In CommitteeComplete
✓First Chamber FloorComplete
✓Second ChamberComplete
✓GovernorComplete
6ChapteredCurrent
Last action: Chaptered by Secretary of State - Chapter 478, Statutes of 2026. (2026-09-27)Alert me
Author and sponsors
Full contact details, staff, and committees with Connect, $16/moUnlockRecent actions19 total · showing 5
| Sep. 27, 2026 | Chaptered by Secretary of State - Chapter 478, Statutes of 2026. |
| Sep. 27, 2026 | Approved by the Governor. |
| Sep. 03, 2026 | Enrolled and presented to the Governor at 4 p.m. |
| Aug. 26, 2026 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 79. Noes 0. Page 6650.). |
| Aug. 26, 2026 | In Assembly. Concurrence in Senate amendments pending. |
Latest bill textChaptered version, September 27, 2026 · 520 words
Assembly Bill No. 2561
CHAPTER 478
An act to add Chapter 23.1 (commencing with Section 22710) to Division 8 of the Business and Professions Code, relating to privacy.
[ Approved by Governor September 27, 2026. Filed with Secretary of State September 27, 2026. ]
LEGISLATIVE COUNSEL'S DIGEST
AB 2561, Valencia. Operating systems and applications: privacy settings.
Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified.
Existing law, beginning January 1, 2027, prohibits a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed.
This bill would prohibit an operating system or an application from undoing a user’s affirmative configuration of a user’s privacy setting without the user’s consent, except as specified. The bill would define “privacy setting” to mean any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
The people of the State of California do enact as follows:
SECTION 1.
Chapter 23.1 (commencing with Section 22710) is added to Division 8 of the Business and Professions Code, to read:CHAPTER 23.1. Operating System and Application Privacy Settings
22710.
As used in this chapter:(a) “Application” means a software program, mobile app, or desktop app that collects, processes, or stores personal information about a user in the state and that provides privacy settings allowing the user to control the collection, use, sharing, or disclosure of that personal information.
(b) “Consent” has the same meaning as defined in Section 1798.140 of the Civil Code.
(c) “Personal information” has the meaning defined in Section 1798.140 of the Civil Code.
(d) “Privacy setting” means any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
22711.
(a) An operating system or an application shall not undo a user’s affirmative configuration of a privacy setting without the user’s consent except as required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding.(b) This section does not prohibit a business from discontinuing services or applications, ceasing the collection, use, retention, or sharing of a user’s personal information, or ceasing to offer privacy options, provided that such changes are either compliant with this section, or the changes result in either of the following:
(1) Maintaining the current protections related to the collection, use, sharing, or retention of personal information collected by the business before the change in its services or settings.
(2) An increase in privacy protection by reducing the collection, use, sharing, or retention of personal information.
Text of AB 2561 as chaptered, from the official record. Connect Plus keeps every version and highlights what changed.Compare versions