Plural’s regular read on consumer data privacy legislation, written for government affairs and public policy teams. Every couple of weeks we cover what moved, what it means, and what to do about it. 

California is the only game in town & it has two weeks left 

Fifteen consumer privacy bills logged substantive movement between August 3 and 17. Thirteen were Californian. 

That 87% looks dramatic, and part of it is just the calendar. Most legislatures are out. California is in the final stretch before adjournment, so the Assembly and Senate are stacking privacy bills onto third reading like it’s a clearance rack. 

The calendar is also why this window matters more than the count suggests. What clears in the next two weeks becomes the language other states copy in January. 

The California pile 

The headliner is SB 923 (Becker). It tightens how businesses accept and log California Consumer Privacy Act (CCPA) deletion requests: receipts, standardized submission channels, and record-keeping obligations. It cleared the Senate and is on third reading in the Assembly. Of everything in this window, it carries the clearest operational cost if it passes.  

 
Right behind it, AB 883 (Lowenthal) forces data brokers to build an accessible deletion pipe specifically for elected officials and judges. Political privacy, meet CCPA enforcement. 

 
Sensitive data is having its own moment. AB 322 reclassifies precise geolocation.  AB 1542 rewrites the sensitive-PI definition. AB 311, the Consumer Driving Data Protection Act, takes on connected-car telematics.  

 
Insurance is on the board too.  SB 354 modernizes the Insurance Information and Privacy Protection Act and AB 1798 blocks genetic testing use in life and disability underwriting. 

 
Also worth logging: SB 1130 on wearable recording devices and SB 957 on social-media administrative subpoenas. 

 
Outside California 

 
Georgia’s SB 540 requires disclosures for conversational AI services. It passed, with a July 1, 2027 effective date. chat bot compliance clocks start now.  

The more interesting part is the vehicle. Georgia regulated generative AI through a consumer protection statute, not a standalone AI law. That is the clearest signal yet on how state houses plan to approach this, and it means the relevant bills won’t always show up under an AI label. 

In DC, Reps. Torres and Latimer introduced H.R. 10107, the Families Deserve to Know Act, on August 13. Early, and unlikely to move this Congress, but worth watching for how it frames parental notice. 

What kind of privacy — by sub-topic 

Sorting the fifteen bills by sub-topic shows where the pressure actually sits. CCPA amendments and sensitive PI account for more than half of the movement. AI and chat bot disclosure is the only category with activity in more than one jurisdiction. That’s a small number today. It won’t stay small. 

Trend to watch 

Sensitive personal information is fragmenting into vertical bills. Geolocation, driving, genetic, immigration status.  

The old cycle was one omnibus definition plus a periodic tweak. That’s being replaced by category-specific carve-outs, and it changes the compliance math. You can no longer map a single definition across your data inventory and call it done. Each vertical carries its own triggers, its own exemptions, and its own timeline. 

When California ships this pattern, expect Colorado, Washington, and Connecticut to copy it next session. 

Data broker deletion mechanics are converging on the same track. Receipts, portals, verified channels. Different bills with the same three requirements. 

Conclusion 

The next two weeks will decide most of this. California adjourns around August 31, and everything sitting on third reading either moves or dies.  

Three things worth doing before the session closes. 

Check your verticals: Look at whether your organization touches geolocation, driving data, genetic data, or immigration status. Those four are now moving as separate bills with separate scopes. If your compliance approach relies on one omnibus sensitive-PI definition, that approach has a shelf life. 

Read SB 923 closely if you handle deletion requests. Receipts, standardized channels, and record keeping stop being policy language and become operational requirements. The build time is longer than the legislative timeline. 

Put July 1, 2027 on the calendar. Georgia SB 540 gives conversational AI disclosure a real effective date. That’s far enough out to feel comfortable and close enough that the work should start being scoped now.