AB 2561 protects affirmative application privacy settings
Oct 11, 2026 edition · GC-2026-0230 · Published 2026-10-11 · Version 3 · Final
AB 2561 protects users' affirmative application privacy configurations from being undone without consent, subject to stated legal exceptions. It preserves service or settings changes that maintain existing information protections or increase privacy, rather than requiring every product option to remain available indefinitely.
What happened
California enacted AB 2561 on September 27 as Chapter 478. New Business and Professions Code section 22711 prohibits an operating system or application from undoing a user's affirmative privacy-setting configuration without consent, except as required by state or federal law, court order, or an individual-case subpoena. Covered settings are user-configurable choices in a privacy or similarly labeled menu governing personal-information collection, use, sharing, disclosure, retention, or processing. The application definition concerns programs that handle California users' personal information and offer the defined controls.
The section permits a business to discontinue services or applications, stop handling personal information, or cease offering privacy options when the change complies with the rule or preserves existing protections for previously collected information or increases privacy by reducing the specified handling. That exception makes the effect of a product change on information protections important, alongside whether the user consented. The short act adds this protection for affirmative choices; it does not itself require a particular new setting, a recurring filing, or permanent support for every discontinued application.
Scope and timing
- Authority status
- Final
- Applicability
- Potentially applicable
- Audience
- Health systems, Provider networks, Health-tech
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Health apps need to preserve user choices across upgrades and defaults.
Recommended action
Test migrations and settings resets, record lawful consent and prevent upgrades from silently weakening affirmative privacy choices.
Sources
- AB2561 enacted final textOfficial · California Legislature · 2026-09-27 · Source review 2026-10-11
- California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →