Session:   
Updated:   2026-02-04

Home - Bills - Bill - Authors - Dates - Locations - Analyses - Organizations

Measure
Authors Addis  
Subject Student personal information.
Relating To relating to privacy.
Title An act to amend Sections 22584 and 22586 of, to add Section 22586.1 to, to add Chapter 22.2.6 (commencing with Section 22587) to Division 8 of, to repeal Section 22587 of, and to repeal and add Section 22585 of, the Business and Professions Code, relating to privacy.
Last Action Dt 2026-01-16
State Amended Assembly
Status Pending Referral
Flags
Vote Req Approp Fiscal Cmte Local Prog Subs Chgs Urgency Tax Levy Active?
Majority No Yes No None No No Y
i
Leginfo Link  
Bill Actions
2026-01-27     In Senate. Read first time. To Com. on RLS. for assignment.
2026-01-26     Read third time. Passed. Ordered to the Senate. (Ayes 65. Noes 5.)
2026-01-22     Assembly Rule 63 suspended.
2026-01-22     In committee: Set, first hearing. Referred to suspense file.
2026-01-22     From committee: Do pass. (Ayes 14. Noes 1.) (January 22).
2026-01-22     Read second time. Ordered to third reading.
2026-01-20     Re-referred to Com. on APPR.
2026-01-16     Read second time and amended.
2026-01-15     From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 10. Noes 2.) (January 15).
2026-01-13     From committee: Do pass and re-refer to Com. on JUD. (Ayes 11. Noes 2.) (January 13). Re-referred to Com. on JUD.
2026-01-08     Assembly Rule 56 suspended.
2026-01-08     (Pending re-refer to Com. on JUD.)
2026-01-06     Re-referred to Com. on P. & C.P.
2026-01-05     In committee: Hearing postponed by committee.
2026-01-05     From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.
2025-04-08     In committee: Set, first hearing. Hearing canceled at the request of author.
2025-03-25     Re-referred to Com. on P. & C.P.
2025-03-24     Referred to Coms. on P. & C.P. and JUD.
2025-03-24     From committee chair, with author's amendments: Amend, and re-refer to Com. on P. & C.P. Read second time and amended.
2025-02-21     From printer. May be heard in committee March 23.
2025-02-20     Read first time. To print.
Versions
Amended Assembly     2026-01-16
Amended Assembly     2026-01-05
Amended Assembly     2025-03-24
Introduced     2025-02-20
Analyses TBD
Latest Text Bill Full Text
Latest Text Digest

Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA), generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.

Existing law, the Early Learning Personal Information Protection Act (ELPIPA), generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes.

This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator’s site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system.

This bill would also enact the Higher Education Student Information Protection Act (HESIPA), which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027.

This bill would authorize a pupil or student actually harmed by the noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed.