California changes disclosure rules for sexual orientation, gender identity, and intersex data
Sep 27, 2026 edition · GC-2026-0128 · Published 2026-09-27 · Version 2 · Final
SB 1114 limits identifiable SOGISC disclosures by specified state entities and includes inference data, exceptions and staged implementation.
What happened
The Governor signed SB 1114 on September 26 to change collection, use and disclosure of sexual-orientation, gender-identity and intersex/sex-characteristic information, or SOGISC. The named state entities include DHCS, CDPH, Social Services and other specified departments; this is not a universal direct collection rule for every private provider. The disclosure protection reaches information reasonably usable to infer transgender or intersex status, including specified marker records and medical information not otherwise protected by HIPAA or CMIA. Voluntary self-identification and statutory collection exceptions remain important, including the express limit on compelling providers or other third parties to supply information not voluntarily provided.
Identifiable disclosure outside California state or local government or its authorized agent is limited to listed exceptions, including mandatory federal/interstate participation terms, valid California-enforceable warrants or orders, public-health functions, protected necessary vendor services, the Information Practices Act and Civil Rights Department statutory work. Disclosures must be minimized. Shared-system separation has an entity-specific automation-notice trigger; Social Services has a separate January 2028 timing provision and CDPH’s stated third-party collection milestone is March 28, 2029. The act also creates a public-records confidentiality provision with deidentification/Information Practices Act exceptions and express vehicle-record/Civil Rights Department exclusions. The January 2027 effective date therefore does not make every provision operative for every data holder at once.
Scope and timing
- Authority status
- Final
- Applicability
- Directly applicable
- Audience
- Health systems, Provider networks
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Data inventories must capture inferential information, permitted purpose and recipient, as well as the relevant agency and implementation trigger.
Recommended action
Have Privacy and data owners assess the statutory entity and data scope, map allowed uses and disclosure exceptions, minimize shared data and track the actual automation and agency-specific milestones before changing collection or release workflows.
Sources
- SB 1114, bill historyOfficial · California Legislature · 2026-09-26 · Source review 2026-09-27
- Official retained source documentOfficial · Official issuing agency · Source review 2026-10-16
- Official retained source documentOfficial · Official issuing agency · Source review 2026-10-16
- Official retained source documentOfficial · Official issuing agency · Source review 2026-10-16
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →