Operating systems and applications: privacy settings.

Removed erroneous duplicate reference to Chapter 22.9 (Section 22683) that appeared in the Senate amendment markup alongside the correct Chapter 23.1 (Section 22710). The enrolled version contains only Chapter 23.1.

Consolidated section numbers from the dual numbering shown in amendment markup (22683/22710 and 22684/22711) to the final single numbering (22710 and 22711).

Cleaned up the legislative counsel's digest language from 'without the user's consent. consent, except as specified' to 'without the user's consent, except as specified,' removing leftover amendment markup artifacts.

Added enrolled bill formatting elements including passage dates (Assembly and Senate both August 26, 2026), Chief Clerk and Secretary of the Senate lines, Governor's receipt line, and approval signature block.

The requirement that operating systems and applications must configure a user's default privacy setting to the most privacy-protective option available was entirely deleted. This was arguably the bill's strongest consumer protection provision.

The consent standard for undoing a user's affirmative privacy configuration was changed from 'explicit consent' to simply 'consent,' and new exceptions were added permitting such changes when required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding.

A new subsection (b) creates a safe harbor: businesses may discontinue services or applications, stop collecting/using/sharing personal information, or remove privacy options entirely, as long as the change either complies with the section or results in maintaining or increasing the level of privacy protection that existed before the change.

The bill was renumbered from Chapter 22.9 (Sections 22683-22684) to Chapter 23.1 (Sections 22710-22711) in Division 8 of the Business and Professions Code, likely to resolve a conflict with another pending bill.

The definition of 'privacy setting' was narrowed from any user-configurable option within an application to only options found within the application's privacy, or similarly labeled, menu. This excludes settings that may be buried elsewhere in an app's interface.

A new definition of 'consent' was added, incorporating the existing definition from Section 1798.140 of the Civil Code (the CCPA's definitions section), providing a statutory basis for what counts as explicit consent.

The prohibition on changing privacy settings without consent was narrowed. The original barred any change to a user's privacy setting. The amended version only bars undoing a user's affirmative configuration of a privacy setting, meaning apps could potentially alter settings the user never actively changed from their default.