California Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why California Site Laws Reach Businesses in Every State

California remains a leading source of website compliance rules because its privacy statute, consumer-protection laws, data-broker rules, and newer AI and child-safety laws can apply to businesses that serve California residents even when the business is based elsewhere. The practical question is not whether a site has a California office; it is whether the particular statute reaches the business, product, data practice, or transaction.

For most website owners, California law comes in layers. The California Consumer Privacy Act (CCPA) and its regulations apply only to qualifying businesses. Subscription, pricing, advertising, breach-notice, and sales-tax rules can apply more broadly. New laws enacted in September 2026 add future-facing duties for certain social-media platforms, companion-chatbot operators, app developers, and advertisers using AI-generated performers.

The CCPA and Regulations Effective January 1, 2026

The CCPA, as amended by the California Privacy Rights Act, applies to a for-profit business that does business in California and meets one or more statutory thresholds. The current annual gross-revenue threshold is $26.625 million. The other principal thresholds are buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually, or deriving 50 percent or more of annual revenue from selling or sharing consumers’ personal information.

A covered business must provide required privacy notices, honor applicable requests to know, delete, correct, and opt out of sale or sharing, and comply with rules governing sensitive personal information and opt-out preference signals. Businesses that do not meet a CCPA threshold may still have contractual privacy duties and may still be subject to California’s more generally applicable consumer-protection and data-security laws.

The California Privacy Protection Agency finalized a major package of CCPA regulations that took effect on January 1, 2026. The package updates existing CCPA rules and establishes requirements concerning certain cybersecurity audits, privacy risk assessments, automated decisionmaking technology (ADMT), and insurance businesses. The effective date does not mean every new obligation became immediately enforceable for every covered business: important compliance dates are phased.

For example, businesses subject to the risk-assessment rules began compliance on January 1, 2026, while the first required submissions to the Agency are due by April 1, 2028. Businesses using ADMT to make significant decisions concerning consumers generally must comply with the ADMT rules beginning January 1, 2027. Required cybersecurity-audit certifications begin April 1, 2028 for businesses with more than $100 million in annual revenue, then phase in for smaller businesses through April 1, 2030. Review the final regulatory text and the Agency’s applicability standards rather than assuming that a general-purpose analytics, personalization, or AI feature automatically triggers every part of the package.

Data Brokers: DROP Is Now Operating

The Delete Act created the Data Broker Delete Request and Opt-out Platform, known as DROP. Since January 1, 2026, California residents have been able to submit one deletion request to active registered data brokers through that platform. Data brokers were required to begin processing DROP requests on August 1, 2026. The California Privacy Protection Agency states that registered brokers must access the system and process qualifying requests under the Act and its regulations.

If your business collects personal information from sources other than direct interactions with consumers and sells that information to third parties, assess carefully whether it is a data broker. A business that merely operates an ordinary customer-facing eCommerce site is not necessarily a data broker, but businesses that buy, sell, license, or compile audience data should review the statutory definition, registration duties, and DELETE Act rules.

Browser Opt-Out Signals Arrive January 1, 2027

California enacted the California Opt Me Out Act, AB 566, in 2025. Beginning January 1, 2027, a business that develops or maintains a browser must provide a consumer-configurable setting that sends an opt-out preference signal. The statute is directed principally at browser providers, but it matters to CCPA-covered websites because the CCPA already requires covered businesses to honor valid opt-out preference signals for sale or sharing of personal information.

Website owners that use advertising pixels, retargeting tools, cross-context behavioral advertising, or data-sharing arrangements should test their implementation now. A signal cannot be treated as a decorative preference if the underlying data flow constitutes a sale or sharing under the CCPA.

Chatbots, Generative AI, and AI Advertising

California’s companion-chatbot law, SB 243, was enacted in 2025 and became operative in 2026. It regulates qualifying companion chatbots rather than every automated customer-service tool. Its requirements address disclosures when a reasonable person could be misled into believing they are communicating with a human, safety protocols involving suicide or self-harm, and additional protections for known minor users. A conventional order-status or FAQ bot may present a different analysis from a product designed to simulate an ongoing social or emotional relationship.

The California AI Transparency Act, SB 942, applies to covered providers of publicly accessible generative-AI systems. The law requires qualifying providers to make an AI-detection tool available at no cost and imposes disclosure and provenance-related requirements for covered AI-generated content. The original statute defines a covered provider using, among other things, a one-million-monthly-visitor-or-user threshold. Businesses that develop, license, or white-label a public generative-AI product should review the current statutory text and later amendments before relying on a marketing vendor’s description of the law.

On September 16, 2026, Governor Newsom signed SB 1050. The law requires disclosure when a video or audio advertisement uses an AI-generated synthetic performer to sell a product or service and authorizes action to stop noncompliant advertisements. For website owners, the practical issue is straightforward: if an ad uses a realistic AI-generated voice or figure in place of a human performer, plan to evaluate the required disclosure before the law’s operative date.

September 2026 Child-Safety Package: Enacted, but Primarily Future Effective

On September 10, 2026, Governor Newsom signed a package of child online-safety laws, including AB 1709, SB 1119, AB 1856, AB 2246, and SB 867. These are enacted laws, not proposals, but their requirements do not all apply immediately. Their effective and operative dates, covered entities, definitions, and remedies vary by bill.

SB 1119, also called Adam’s Law, adds child-safety obligations for companion chatbots, including risk-assessment, audit, crisis-response, parental-control, and safety-setting provisions. AB 1709 addresses addictive features for users under 16 on covered platforms, including features such as autoplay and certain personalized feeds. AB 2246 creates new requirements for online services, products, or features likely to be accessed by children. These laws are especially important for social media, youth-directed services, and AI products that engage users socially or emotionally; they should not be treated as a general age-verification mandate for every ordinary commercial website.

California’s Digital Age Assurance Act, AB 1043, generally places age-bracket signal duties on operating-system providers, covered application stores, and developers. AB 1856 amended that framework in September 2026. If you publish a mobile application, follow the enacted text and implementation timetable. A standard website does not become subject to a universal California age-verification rule merely because it is accessible from California.

Subscriptions, Fees, and Advertising at Checkout

The California Automatic Renewal Law, Business and Professions Code section 17600 and following, applies to many subscription and free-trial offers. The law was strengthened by amendments effective July 1, 2025. The Attorney General advises that businesses must obtain affirmative consent before charging consumers under an automatic-renewal or continuous-service offer and provide a clear, straightforward cancellation method. Online sellers should review offer disclosures, acknowledgment messages, cancellation paths, reminder notices where required, and procedures for material changes to renewal terms. See the Attorney General’s Automatic Renewal Law consumer alert.

California’s hidden-fee statute, SB 478, has applied since July 1, 2024. The Attorney General explains that, for most businesses, an advertised or listed price must include mandatory fees and charges other than government-imposed taxes or fees and reasonable shipping charges for physical goods. A handling charge is not shipping. Optional add-ons and charges contingent on later conduct are treated differently. Review product pages, pricing tables, carts, checkout flows, and advertisements—not only the final payment screen.

Data Breach Notification and Reasonable Security

California Civil Code section 1798.82 applies to persons and businesses that conduct business in California and own or license computerized data containing covered personal information about California residents. A business generally must notify affected residents when unencrypted personal information was acquired, or is reasonably believed to have been acquired, by an unauthorized person. If a single incident requires notice to more than 500 California residents, the business must submit a sample notice to the Attorney General. The Attorney General’s breach-reporting page provides the submission rule and process.

Separately, Civil Code section 1798.81.5 requires reasonable security procedures and practices appropriate to the nature of the information. The CCPA’s private right of action is narrower than a general privacy lawsuit: it concerns specified unencrypted and unredacted personal information subject to unauthorized access, exfiltration, theft, or disclosure because of a failure to maintain reasonable security. The current statutory-damages range is $107 to $799 per consumer per incident, or actual damages if greater, subject to the statute’s conditions and defenses.

California Site Laws for eCommerce: Sales and Use Tax

A remote retailer can establish California economic nexus when its total combined sales of tangible personal property for delivery in California exceed $500,000 in the current or preceding calendar year. California has no transaction-count alternative. The California Department of Tax and Fee Administration states that the calculation includes sales through a marketplace facilitator as well as direct sales, although marketplace-facilitated sales are generally collected and remitted by the registered facilitator.

If all of your California sales are through registered marketplace facilitators, you generally are not required to register solely for those marketplace sales. If you also make direct sales through your own website and meet the nexus test, registration and collection duties may apply. Review the CDTFA’s Marketplace Facilitator Act guidance and remote-seller FAQs before configuring tax software.

Age Verification and Adult Content

California has not enacted a general website age-verification law for adult-content sites comparable to laws enacted in some other states. That does not eliminate obligations under federal law, including COPPA for child-directed services and services with actual knowledge that they collect personal information from children under 13, or under California laws governing particular products and services.

The more immediate California developments are sector-specific: companion chatbots, covered social-media platforms, services likely to be accessed by children, operating systems, app stores, and application developers. Do not describe AB 1043 or its 2026 amendments as a universal age-check requirement for all websites.

Pending Legislation: Do Not Treat It as Current Law

Some significant privacy measures remain pending as of September 21, 2026. For example, the California Privacy Protection Agency reports that SB 923, the Expanding Privacy Rights Act, was approved by the Legislature and sent to the Governor. If enacted, it would expand the CCPA deletion right to more nonexempt personal information and alter request-submission requirements. Until a bill is signed, chaptered, or otherwise becomes law, businesses should treat it as pending legislation rather than an enforceable duty.

What You Should Do Now

1. Confirm whether your business meets a CCPA threshold. If it does, review privacy notices, consumer-request procedures, vendor contracts, opt-out workflows, and Global Privacy Control or other opt-out preference-signal handling.
2. If you use advertising pixels, retargeting, or audience-sharing tools, map the data flows and prepare for broader browser-supplied opt-out signals on January 1, 2027.
3. Audit subscription and free-trial flows for clear disclosures, affirmative consent, required acknowledgments, reminders, and easy cancellation.
4. Check every advertised and listed price for mandatory fees that must be included before checkout under SB 478.
5. Maintain an incident-response plan that addresses California breach notice, Attorney General sample-notice submission, and reasonable-security obligations.
6. For AI products, distinguish a basic utility chatbot from a companion chatbot, review SB 243 now, and build a compliance plan for the September 2026 child-safety laws before their applicable operative dates.
7. If you publish apps, begin planning for California’s age-signal framework; if you sell physical goods directly, total California sales against the $500,000 nexus threshold.

Key Takeaways

• The CCPA regulations addressing risk assessments, cybersecurity audits, and ADMT took effect January 1, 2026, with important compliance deadlines phased through 2030.
• DROP is live, and registered data brokers have been required to process qualifying deletion requests since August 1, 2026.
• California’s browser opt-out requirement begins January 1, 2027; CCPA-covered businesses should already be able to honor valid opt-out preference signals.
• California enacted a major child-safety package on September 10, 2026 and an AI synthetic-performer advertising disclosure law on September 16, 2026. Most affected businesses have planning time, but should not mistake those enacted laws for mere proposals.
• For ordinary eCommerce sites, subscriptions, hidden fees, breach readiness, privacy practices, and sales-tax nexus are usually the most immediate California compliance priorities.

Frequently Asked Questions About California Site Laws

Does the CCPA apply to my small business?

Not automatically. The CCPA generally applies only to for-profit businesses doing business in California that meet a revenue, data-volume, or revenue-from-sale-or-sharing threshold. The current revenue threshold is $26.625 million. Other California laws, including subscription, pricing, and breach-notice statutes, can apply regardless of whether the CCPA applies.

Do California site laws apply if my business is located outside California?

They can. CCPA coverage depends on its statutory thresholds and California business activity. Consumer-protection laws can apply to transactions with California consumers, breach rules can apply when California residents’ covered information is affected, and tax duties can arise from physical presence or the $500,000 sales threshold.

Must every California-facing website verify visitors’ ages?

No. California has no general age-verification mandate for all websites. The state’s age-signal law principally addresses operating systems, app stores, and application developers, while newer laws address defined categories of child-accessible services, covered platforms, and companion chatbots.

What changed in September 2026?

Governor Newsom signed a child online-safety package on September 10, including measures affecting companion chatbots, covered social-media platforms, age signals, and services likely to be accessed by children. He also signed SB 1050 on September 16, requiring disclosure in covered video or audio advertisements that use AI-generated synthetic performers. The detailed effective and operative dates vary by statute.

Do California laws require an AI disclosure on my website?

It depends on the product and use. SB 243 covers qualifying companion chatbots, SB 942 regulates covered generative-AI providers, and SB 1050 concerns covered advertisements using synthetic performers. A business should evaluate the actual feature, advertising creative, audience, and statutory definitions rather than apply a one-size-fits-all AI label.

Conclusion

California site-law compliance is increasingly date- and product-specific. The CCPA and its 2026 regulations matter most to qualifying businesses; the Automatic Renewal Law, hidden-fee rule, breach statutes, and sales-tax rules are more immediate for many online sellers; and the September 2026 AI and child-safety laws require affected businesses to prepare for future operative dates. Recheck this page after the Governor completes action on the remaining 2026 bills, and review statutory text and agency guidance before changing a site’s privacy, checkout, AI, or age-assurance practices.