CaliforniaSB 4462025-2026 Regular SessionSenateWALLET

Data breaches: customer notification.

Sponsored By: Melissa Hurtado (Democratic)

Signed by Governor

Your PRIA Score

Score Hidden

Personalized for You

How does this bill affect your finances?

Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.

Free to start

Bill Overview

Analyzed Economic Effects

7 provisions identified: 5 benefits, 0 costs, 2 mixed.

Clearer notices and free ID protection

Breach notices must be in plain language, titled “Notice of Data Breach,” use at least 10‑point type, and include clear headings like “What Happened?,” “What Information Was Involved?,” “What We Are Doing,” “What You Can Do,” and “For More Information.” Notices must list the business name and contact, the data types involved, the breach date or range, the notice date, whether police delayed notice, and a general description. If Social Security or driver’s license numbers were exposed, notices must include toll‑free contacts for major credit bureaus. If the business was the source of the breach and sensitive data was exposed or may have been exposed, it must offer free identity‑theft protection for at least 12 months and explain how to use it. Businesses may add extra helpful steps, and for biometric breaches, they may tell others to stop using that biometric.

Large breaches reported to Attorney General

If more than 500 California residents are notified from a single breach, the business must send one sample copy of the notice to the California Attorney General within 15 days of telling people. The sample must not include personal data.

Faster breach notices to Californians

Businesses that do business in California must tell affected residents about a data breach within 30 days after they discover it or are told about it. They must notify people if unencrypted data was taken, or if encrypted data was taken and a key or credential could make it readable. If a company keeps personal data it does not own, it must tell the data owner right away after discovery. Notices can be delayed only if law enforcement says notice would harm an investigation, or to scope the breach and restore systems, and then must go out promptly when the delay ends.

Special rules for account logins

If only a username or email and a password or security answer were exposed, the notice can be short and must tell you to change your password and security answers and secure related accounts. If the breached login is for an email account the business gave you, it cannot send the notice to that same email. It must use another allowed method or show a clear notice when you sign in from a known location.

Health and policy compliance safe harbors

If a HIPAA‑covered entity fully follows the HITECH Act’s breach notice rule, the state treats that as meeting the state’s notice step. The entity still must follow the other parts of state law. Also, if a business has written breach‑notice procedures in its security policy, follows them, and they meet this law’s timing, it is treated as compliant.

What counts as a reportable breach

A breach means someone got computerized personal data without permission and it compromised security or confidentiality. Good‑faith employee access for work is not a breach if the data is not misused or shared. Personal information includes name plus items like Social Security or driver’s license numbers, financial account data with access codes, medical or genetic data, and biometric data. It also includes a username or email with a password or security answer. Public government records are excluded. Encrypted data needs notice only if the key or security credential was compromised.

How businesses may deliver notices

Businesses may send breach notices by mail or electronically under e‑sign rules. They may use substitute notice if individual notice would cost over $250,000, more than 500,000 residents are affected, or they lack enough contact details. Substitute notice must include email (if available), a clear website posting for at least 30 days, and notice to major statewide media.

Sponsors & Cosponsors

Sponsor

Melissa Hurtado
Democratic • Senate

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 167 • No: 0

House vote • 8/28/2025

Item 141 — Assembly AFLOOR

Yes: 74 • No: 0

legislature vote • 8/20/2025

Vote in CX25

Yes: 15 • No: 0

legislature vote • 7/8/2025

Vote in CX13

Yes: 12 • No: 0

legislature vote • 6/24/2025

Vote in CX32

Yes: 15 • No: 0

Senate vote • 5/28/2025

Item 93 — Senate SFLOOR

Yes: 39 • No: 0

legislature vote • 4/1/2025

Vote in CS53