What AB 1159 does
An act to amend Sections 22584 and 22586 of, to add Section 22586.1 to, to add Chapter 22.2.6 (commencing with Section 22587) to Division 8 of, to repeal Section 22587 of, and to repeal and add Section 22585 of, the Business and Professions Code, relating to privacy.
Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA), generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.
Existing law, the Early Learning Personal Information Protection Act (ELPIPA), generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes.
This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator’s site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system.
This bill would also enact the Higher Education Student Information Protection Act (HESIPA), which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027.
This bill would authorize a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed, and would require a person bringing that action to furnish a copy of the complaint to the Attorney General within 10 days after filing the action.
Summary from the Legislative Counsel's Digest of the chaptered text, September 10, 2026. Read the full text on leginfo.
How it got here
Assemblymember Addis introduced AB 1159 on February 20, 2025. The text was amended 5 times, 3 in the Assembly and 2 in the Senate, and heard in 7 committee hearings before its final floor votes.
- Assembly Floor, January 26, 2026: 65 ayes, 5 noes.
- Assembly Floor, August 31, 2026: 70 ayes, 4 noes.
Committee votes along the way:
- Assembly Privacy and Consumer Protection, January 13, 2026: Do pass and be re-referred to the Committee on [Judiciary], 11-2.
- Assembly Judiciary, January 15, 2026: Do pass as amended and be re-referred to the Committee on [Appropriations], 10-2.
- Assembly Appropriations, January 22, 2026: Do pass., 14-1.
- Senate Education, June 10, 2026: Do pass, but first be re-referred to the Committee on [Privacy, Digital Technologies, and Consumer Protection], 4-0.
- Senate Privacy, Digital Technologies, and Consumer Protection, June 22, 2026: Do pass, but first be re-referred to the Committee on [Appropriations], 7-0.
- Senate Appropriations, August 10, 2026: Placed on suspense file, 6-0.
- Senate Appropriations, August 13, 2026: Do pass, 5-0.
Who supports and opposes AB 1159
The Senate Floor Analyses analysis dated August 24, 2026 lists 37 organizations in support and 5 in opposition. When Assembly Privacy and Consumer Protection first listed positions on January 10, 2026, the count was 20 in support and 5 opposed. By the Senate Floor Analyses analysis of August 24, 2026 it was 37 to 5.
In support: Privacy Rights Clearinghouse (sponsor); Lieutenant Governor Eleni Kounalakis; Alliance of Californians for Community Empowerment Action; Asian Americans Advancing Justice Southern California; Asian Solidarity Collective; Bright Light Strategies; CA Now; California Faculty Association; and 29 more.
Opposed: California Association of College Stores; California Chamber of Commerce; Computer & Communications Industry Association; National Association of College Stores; TechNet.
Read the Senate Floor Analyses analysis.
What happens next
It was signed and chaptered on September 10, 2026 as Chapter 182, Statutes of 2026. Most provisions of a bill chaptered in this session take effect January 1.
The Governor can sign the bill, veto it, or let it become law without a signature. Until the decision, sign and veto request letters are the remaining channel, and the Department of Finance's enrolled bill report carries weight on anything with a fiscal effect. If signed, most provisions take effect January 1, and implementation moves to the agencies named in the bill.
What it means for privacy organizations
The work now is implementation: which agency writes the rules, when the comment period opens, and which obligations begin January 1. An organization that was not in the room for the bill can still shape the regulation, and the regulation is usually where the operating detail is settled.
The privacy group at Capitol Axis handles that for privacy clients.
Questions about AB 1159
What does AB 1159 do?
This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers
Is AB 1159 law in California?
It was signed and chaptered on September 10, 2026 as Chapter 182, Statutes of 2026. Most provisions of a bill chaptered in this session take effect January 1.
Who supports and opposes AB 1159?
The Senate Floor Analyses analysis dated August 24, 2026 lists 37 organizations in support and 5 in opposition. Supporters include Privacy Rights Clearinghouse (sponsor); Lieutenant Governor Eleni Kounalakis; Alliance of Californians for Community Empowerment Action. Opponents include California Association of College Stores; California Chamber of Commerce; Computer & Communications Industry Association.
What happens next with AB 1159?
The question now is implementation. The agencies named in the bill write the rules that decide what it means in practice, and those proceedings are open to comment.