AB 2561
Operating systems and applications: privacy settings.
Vote required
Majority
Fiscal committee
No
Appropriation
No
Current location
In Floor Process
Take action
Record your position on this measure.
Sign in to record your position, submit testimony, or contact your legislator.
Sign in to take action- Introduced
- Passed Assembly
- Passed Senate
- To Governor
- Became Law
Bill overview
This bill aims to give California consumers more control over their privacy settings on operating systems and applications. It requires operating systems and apps to set the most privacy-protective default setting and prevents them from changing these settings without the user’s explicit consent. The bill defines ‘privacy setting’ to include any user-configurable option related to data collection and usage.
Key provisions
- Operating systems and applications must set the most privacy-protective default setting.
- Companies cannot change a user’s privacy settings without explicit consent.
- Defines ‘privacy setting’ as user-configurable options within an application’s privacy menu.
- Establishes a new chapter (22.9) in the Business and Professions Code related to operating system and application privacy.
- Uses definitions from existing California privacy laws (Civil Code sections 1798.140).
- Applies to software programs, mobile apps, and desktop apps that collect and process personal information.
- Requires apps to allow users to control how their personal information is collected and used.
- Addresses browser functionality to ensure opt-out preference signals can be sent.
Who is affected
- Consumers in California
- Operating system developers
- Application developers
- Technology companies
- The State of California
Notable changes
Arguments in favor
Reasons to support this legislation.
No arguments in favor have been submitted.
Submit yoursArguments opposed
Reasons to oppose this legislation.
No arguments opposed have been submitted.
Submit yoursRead the latest version inline or switch to a previous version.
AB2561:v98#DOCUMENT
Bill Start
| Amended IN Assembly April 23, 2026 |
CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION
Assembly Bill
No. 2561
| Introduced by Assembly Member Valencia |
| February 20, 2026 |
An act to add Chapter 22.9 (commencing with Section 22683) to Division 8 of the Business and Professions Code, relating to privacy.
LEGISLATIVE COUNSEL'S DIGEST
AB 2561, as amended, Valencia. Operating systems and applications: privacy settings.
Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified.
Existing law, beginning January 1, 2027, prohibits a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed.
This bill would require an operating system or an application to configure a user’s default privacy setting to be the most privacy protective setting offered by the operating system or application and would prohibit an operating system or an application from changing undoing a user’s affirmative configuration of a user’s privacy setting without the user’s explicit consent. The bill would define “privacy setting” to mean any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
Digest Key
Vote: MAJORITY Appropriation: NO Fiscal Committee: NO Local Program: NO
Bill Text
The people of the State of California do enact as follows:
SECTION 1.
Chapter 22.9 (commencing with Section 22683) is added to Division 8 of the Business and Professions Code, to read:
CHAPTER 22.9. Operating System and Application Privacy Settings
22683.
As used in this chapter:
(a) “Application” means a software program, mobile app, or desktop app that collects, processes, or stores personal information about a user in the state and that provides privacy settings allowing the user to control the collection, use, sharing, or disclosure of that personal information.
(b) “Consent” has the same meaning as defined in Section 1798.140 of the Civil Code.
(b)
(c) “Personal information” has the meaning defined in Section 1798.140 of the Civil Code.
(c)
(d) “Privacy setting” means any user-configurable option within an application application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
(a)An operating system or an application shall configure a user’s default privacy setting to be the most privacy protective setting offered by the operating system or application.
22684.
(b)An operating system or an application shall not change undo a user’s affirmative configuration of a privacy setting without the user’s explicit consent.