Capitol Axis

Technology and Privacy

California’s technology debates are also debates about privacy, consumer rights, and the limits of surveillance. Capitol Axis brings experience in these issues to legislative advocacy and regulatory strategy.

Discuss your issue
427 organizations on the record across the 12 bills we track here
Signed into law
3
On the Governor's desk
6
Still moving
2
Vetoed
1
SB 771 · Personal rights: liability: social media platforms 28 for · 60 against

From the public record, updated September 18, 2026. See every privacy bill.

Privacy experience.
Down to the language.

Our experience includes advocacy on automated license plate readers, cell-site simulators, and safeguards around access to communications records.

These issues bring civil liberties, public safety, and commercial interests into the same debate. We bring close attention to the proposed language and the protections at stake.

Representation for organizations like yours.

  • Privacy and civil-liberties organizations
  • Consumer advocacy groups
  • Technology businesses and trade associations
  • Device and connected-product makers
  • Organizations handling consumer data
  • Public-interest and professional associations

Services.

Rulemaking

  • CPPA comment cycles on ADMT, risk assessment, and cybersecurity audit rules
  • Attorney General rulemaking on SB 976 age assurance and parental consent

Legislation

  • Testimony before the Privacy committees on children's privacy, platform design, device, and data broker bills
  • Litigation-aware strategy that tracks which provisions are enjoined and which are enforceable

Compliance positioning

  • Delete Act registration, 45-day access cycle, and deletion processing standards
  • Positioning ahead of AB 1043 implementation in 2027
  • Right to Repair Act monitoring for successor bills

Enforcement trends

  • Briefings drawn from CPPA and Attorney General settlement patterns to anticipate audit and investigation priorities
  • Data broker registry strategy and agency relationship management

Why now.

  • Delete Act enforcement is live.

    Full broker compliance became mandatory August 1, 2026 and the first fine followed within two weeks.

  • Two age-verification regimes land on the same day.

    The AG's SB 976 regulations and AB 1043's device signals both arrive January 1, 2027. The window to align them is narrow.

  • Enforcement is widening.

    2026 produced the largest CCPA settlement to date and the first joint action with county district attorneys.

Explore legislative prioritiesExplore the agency landscape

Questions clients ask.

What is the Delete Act deadline for data brokers?

The Delete Request and Opt-out Platform went live January 1, 2026. Registered data brokers had to begin accessing it and processing deletion requests at least every 45 days from August 1, 2026, with penalties of $200 per request per day of noncompliance. The Privacy Protection Agency issued its first Delete Act fine in August 2026.

Is the California Age-Appropriate Design Code enforceable?

Largely not. As of a March 2026 Ninth Circuit ruling, five of six challenged provisions remain enjoined on First Amendment grounds. The addictive-feeds law, SB 976, was upheld by the Ninth Circuit in September 2025 and is in effect, and the Digital Age Assurance Act, AB 1043, takes effect January 1, 2027.

How large have CCPA enforcement penalties been?

The largest to date is a $12.75 million settlement with General Motors in May 2026, followed by $2.75 million with Disney in February 2026 and a $1.1 million Privacy Protection Agency fine against PlayOn Sports in March 2026.

Discuss your California
policy priorities.

Tell us what is changing for your organization.
We’ll discuss the representation and scope you need.

Contact us