AB 2561 protects affirmative application privacy settings
Oct 4, 2026 edition · GC-2026-0230 · Published 2026-10-04 · Version 2 · Final
AB 2561 bars operating systems and applications from undoing an affirmative user privacy setting without consent. The text preserves specific legal-process exceptions and permits service or setting changes that maintain existing protections or increase privacy, subject to the statutory conditions.
What happened
California enacted AB 2561 on September 27, adding Business and Professions Code sections 22710 and 22711. An operating system or application may not undo a user’s affirmative configuration of a privacy setting without consent, except as required by state or federal law, court order or a subpoena in an individual case or proceeding. A privacy setting is a user-configurable option in an application’s privacy or similarly labelled menu governing collection, use, sharing, disclosure, retention or processing of personal information. The application definition covers software, mobile and desktop programs collecting, processing or storing personal information about a user in California and providing the specified privacy controls. Consent and personal information use the cited CCPA definitions. The enactment is the event reported here; the applicable commencement of these provisions must be confirmed separately.
The law does not freeze every service design or require continued collection of information. It permits discontinuing services or applications, stopping collection, use, retention or sharing, or ceasing to offer privacy options if the change complies with the section or meets its protective alternatives. Those alternatives maintain the existing protections for information collected before the change or increase privacy by reducing collection, use, sharing or retention. The operative distinction is between undoing an affirmative user choice without a lawful basis and making a permitted change that preserves or improves the relevant protection.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
Why it matters
A migration, upgrade or reset can weaken a setting even if the visible interface still appears familiar. Product and privacy teams need to know which choices the user affirmatively configured and what happens to previously collected information when a setting or service is retired.
Recommended action
Confirm the applicable commencement before treating the new provisions as current duties. Prepare the following for implementation at that commencement: Test upgrades, account migrations and reset paths against recorded affirmative settings. Identify where consent is needed and document any specific legal-process requirement. For retired features or privacy controls, verify that the change maintains existing protections or reduces the relevant data handling under the statutory conditions.
Sources
- AB2561 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-05
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →