Official sources · Human review
Focused updates that affect trust readiness and responsible data practices, not a general cybersecurity news feed. Nothing appears here until a human reviewer approves the source, lifecycle, summary, and recommended action.
AB 1542 was vetoed by Governor Newsom on September 27, 2026. Vetoed, September 27, 2026. No operative requirement. The bill would have amended the CCPA's sensitive-personal-information provisions. It did not become law.
SB 354 was signed into law on September 27, 2026 as Chapter 481, Statutes of 2026. The law modernizes California insurance privacy requirements and is generally operative beginning July 1, 2028. It primarily concerns personal information processed in connection with insurance for personal, family, or household purposes. It is not a broad commercial cyber-insurance mandate.
SB 923 was signed on September 27, 2026 and takes effect January 1, 2027. For covered businesses, the CCPA deletion right can extend to personal information obtained from or about the consumer, including certain information obtained from third parties. The law also affects the mechanisms online-only covered businesses use for deletion requests.
AB 883 was signed on September 27, 2026 and takes effect January 1, 2027. Through December 31, 2026, California data brokers must access and process DROP requests at least every 45 days. Beginning January 1, 2027, AB 883 shortens that cycle to 30 days.
This is a bill, not current law. SB 690 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative requirement. If enacted, it would limit private lawsuits for alleged pen-register or trap-and-trace violations arising from conduct on a website or app, leaving those actions to the Attorney General.
This is a bill, not current law. AB 1883 passed the California Legislature on August 28, 2026 and is awaiting action by the Governor. It is not currently an operative compliance requirement. If enacted, it would address AI-enabled employee surveillance practices.
On August 17, 2026 the FTC announced a $2.1 million proposed settlement with Doxo over allegations that it used misleading search ads to impersonate billers and failed to disclose add-on fees. A federal court found Doxo violated the Restore Online Shoppers' Confidence Act. The stipulated order takes effect when signed by the district court.
FinCEN published a final rule on August 14, 2026 adopting, with limited changes, its March 2025 interim rule narrowing beneficial ownership information reporting under the Corporate Transparency Act. The rule is effective August 14, 2026. It continues to exempt reporting of U.S. person beneficial owners and also exempts U.S. person company-applicant reporting and FinCEN-identifier updates by U.S. persons.
On August 4, 2026, the IRS and Security Summit partners issued IR-2026-85 describing phishing, spear phishing, clone phishing, whaling, and fake new-client emails used against tax preparers. This is official guidance, not a new rule.
The California Privacy Protection Agency's regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits were approved by the Office of Administrative Law and became effective January 1, 2026. This is a final rule, not a proposal. CPPA states that ADMT-specific requirements must be met by January 1, 2027, with later audit and risk-assessment dates phased beginning in 2027 and 2028.