AB 656: Account cancellation. - California

09/04/25 - Amended Senate → 09/12/25 - Enrolled · 4 edits · Sep 12, 2025

MODERATE

The enrolled version of AB 656 makes several substantive strengthening changes to the social media account deletion requirements. The bill now requires platforms to provide steps for account and personal information deletion (rather than merely permitting deletion with optional verification), broadens the anti-obstruction prohibition beyond just dark patterns to any form of interference, removes a 'logged in' limitation on CCPA treatment, and adds a new provision preventing platforms from treating a subsequent login as revoking a pending deletion request.

REQUIREMENT

Section 3273.91(b)(1) was changed from requiring the platform to 'permit a user to complete a deletion' (with optional two-factor authentication confirmation) to requiring the platform to 'provide a user with the steps necessary to complete an account deletion request, which shall include deletion of the user's personal information.' This shifts the obligation from allowing completion to actively providing a defined process that must cover personal data deletion.

New Section 3273.91(e) provides that a user logging into an account after submitting a deletion request does not, by itself, revoke that request. This prevents platforms from using a subsequent login as grounds to cancel a pending deletion.

SCOPE

Section 3273.91(c) was broadened from prohibiting only 'dark patterns' used to obstruct or interfere with account deletion, to prohibiting any obstruction or interference with a user's ability to delete their account, with dark patterns listed as one non-exhaustive example. This significantly expands the range of prohibited platform behaviors.

ELIGIBILITY

Section 3273.91(d) removed the requirement that the user be 'logged in' for a deletion request to qualify as a verified consumer request under CCPA. It now applies to any request submitted under subdivision (b), and adds an explicit requirement that the request be processed in accordance with all CCPA requirements.

10/08/25 - Chaptered → AB656 · 3 edits

MINOR

No substantive policy changes were made between these two versions. The diff reflects a transition from the official chaptered law format (with centered headers, page numbers, and formal layout) to a web page rendering of the same bill text on the California legislature website. All legal provisions remain identical.

TECHNICAL

The document was reformatted from the official chaptered law layout (centered headers, page numbers like '93', em dashes for section breaks) to a web page format with standard left-aligned text and HTML-style structure.

Website navigation elements were added including skip-to-content links, home, accessibility, FAQ, feedback, sitemap, login, search bar, bill information sidebar, version history dropdown, share options, and a digest key showing Vote: MAJORITY, Appropriation: NO, Fiscal Committee: NO, Local Program: NO.

Minor capitalization changes in headings (e.g., 'TITLE 25. SOCIAL MEDIA PLATFORMS ENDANGERING CALIFORNIANS' became 'TITLE 25. Social Media Platforms Endangering Californians') and section numbering formatting was adjusted for web display.

06/23/25 - Amended Senate → 09/04/25 - Amended Senate · 5 edits · Sep 4, 2025

MODERATE

The September 4 amendment to AB 656 significantly softened the core deletion requirement: instead of mandating that platforms actually delete all personal information upon user confirmation, the bill now only requires platforms to provide users with the necessary steps to complete an account and data deletion. However, it added two new protections: deletion requests must be processed under CCPA requirements, and a user logging back in cannot by itself revoke a pending deletion request.

REQUIREMENT

The core obligation changed from requiring platforms to delete all personal information upon confirmation of account deletion, to only requiring them to provide users with the steps necessary to complete an account deletion request (including deletion of personal information). This is a substantial weakening of the mandate.

New subdivision (d) explicitly states that a deletion request submitted under the new button requirement constitutes a request to delete personal information under CCPA Section 1798.105 and must be processed in accordance with all CCPA requirements, giving users access to existing privacy law enforcement mechanisms.

New subdivision (e) provides that a user logging back into an account for which a deletion request has been submitted does not, by itself, revoke that request. This prevents platforms from treating continued use as implicit cancellation of a pending deletion.

The dark pattern prohibition was broadened from 'interfere with' to 'obstruct or interfere with' a user's ability to delete their account.

New language requires that if a platform seeks verification of a deletion request, that verification must be done in a 'cost-effective and easy-to-use manner,' adding a usability standard for the verification process.

09/12/25 - Enrolled → 10/08/25 - Chaptered · 3 edits · Oct 8, 2025

MINOR

This diff reflects the transition of AB 656 from its enrolled form to its chaptered (statutory) form after the Governor approved it on October 8, 2025. No substantive policy changes were made; the differences are limited to formatting, page numbering, and the addition of standard chaptered publication elements such as the chapter number (464), the authenticated electronic legal material header, and the approval/filing date.

TECHNICAL

Added 'STATE OF CALIFORNIA AUTHENTICATED ELECTRONIC LEGAL MATERIAL' header and Chapter 464 designation with the Governor's approval date of October 8, 2025.

Removed enrolled-bill process language including Assembly and Senate passage dates, clerk signatures, and the blank governor receipt date line.

Page numbering changed from 'AB 656' format to 'Ch. 464' format throughout the document.

05/08/25 - Amended Assembly → 06/23/25 - Amended Senate · 5 edits · Jun 23, 2025

MODERATE

The Senate amendment to AB 656 streamlines the account deletion requirement by removing the obligation to display a message on every screen and instead requiring a single clear button in the settings menu. It adds a new provision linking account deletion directly to CCPA data deletion rights, specifies that confirmation must use immediate two-factor authentication, and removes the option for users to suspend (rather than delete) their accounts.

REQUIREMENT

Replaced the requirement to post a message on every screen visible to the user with a single clear and conspicuous button in the settings menu. The button must now be 'immediately visible' as an option in the settings menu.

Narrowed the confirmation method from any email, text, phone call, or message to specifically require 'immediate two-factor authentication' delivered by those channels.

Added a new provision requiring social media platforms to treat a user's decision to delete an account while logged in as a verified consumer request under CCPA Section 1798.105, directly linking account deletion to statutory data deletion obligations.

SCOPE

Removed the option for users to suspend their account. The bill now only requires platforms to enable account deletion, not suspension.

TECHNICAL

Consolidated the bill structure by removing the duplicate Title 23 (Section 3273.72) and keeping only Title 25 (Section 3273.90), eliminating redundant definitions that appeared in both titles in the prior version.

03/24/25 - Amended Assembly → 05/08/25 - Amended Assembly · 6 edits · May 8, 2025

MODERATE

The May 8 amendment substantially strengthened AB 656 by replacing a simple 'clickable message' requirement with a mandatory 'Delete Account' button in settings menus, adding a prohibition on dark patterns that interfere with account deletion, and requiring platforms to delete all personal information upon confirmed account deletion. The bill was also renumbered from Title 23 (Section 3273.72) to Title 25 (Section 3273.90), likely to avoid a numbering conflict with another bill, and a co-author (Assembly Member Lowenthal) was added.

Scope change

Scope narrowed by removing the online subscriptions intent language, but substantively expanded by adding dark pattern prohibition and mandatory data deletion obligations tied to CCPA definitions. The revenue threshold (over $100 million gross revenues per year) remains unchanged.

REQUIREMENT

The core requirement changed from posting a clickable message about account deletion to providing a clear and conspicuous button labeled 'Delete Account' placed in the settings menu, accessible via app, browser, or any other format the user can use to access the platform.

New prohibition: social media platforms may not use dark patterns (as defined in CCPA Section 1798.140(l)) to interfere with a user's ability to delete their account.

New data deletion requirement: upon a user's confirmation of account deletion, the platform must delete all personal information pertaining to the account or collected directly through the platform by that user.

DEFINITION

Two new definitions added: 'dark pattern' (referencing CCPA Section 1798.140(l)) and 'personal information' (referencing CCPA Section 1798.140(v) and related regulations).

SCOPE

The bill's stated legislative intent to enact future legislation relating to online subscriptions was removed entirely, narrowing the bill's scope to account deletion on social media platforms.

TECHNICAL

The bill was renumbered from Title 23 (Section 3273.72) to Title 25 (Section 3273.90), indicating a section number change in the Civil Code placement, likely due to another bill occupying the original numbering.

02/13/25 - Introduced → 03/24/25 - Amended Assembly · 7 edits · Mar 24, 2025

MODERATE

AB 656 was transformed from a one-line legislative intent statement about online subscriptions into a substantive regulatory bill requiring large social media platforms (those generating over $100 million in annual gross revenue) to display a clear account deletion or suspension option on every screen visible to users. The amendment adds detailed legislative findings linking excessive social media use to adolescent addiction and suicide-related outcomes, and creates a new Title 23 in the Civil Code titled 'Social Media Platforms Endangering Californians.' This is a significant expansion from a placeholder bill to an enforceable consumer protection requirement.

SCOPE

The bill now applies specifically to social media platforms that generate more than $100 million per year in gross revenues, as defined by reference to Business and Professions Code Section 22675.

A new Title 23 ('Social Media Platforms Endangering Californians') is added to Part 4 of Division 3 of the Civil Code, establishing a new statutory framework.

The original single-section intent statement about online subscriptions was retained but renumbered and moved to the end of the bill, while the primary focus shifted to social media account deletion requirements.

REQUIREMENT

Social media platforms must clearly and conspicuously post a message on each screen visible to a user stating that clicking the message allows the user to delete or suspend their account.

If a user clicks the deletion/suspension message, the platform must permit completion of the request but may seek confirmation via email, text message, telephone call, or in-app message.

DEFINITION

New definitions added: 'clearly and conspicuously' (referencing Business and Professions Code Section 17601) and 'social media platform' (with the $100 million revenue threshold).

ENFORCEMENT

Anti-waiver provision added: any waiver of the act is void and unenforceable as contrary to public policy. A severability clause was also added.

Account cancellation.

What changed between versions

How they voted

Actions timeline

Sponsors