California changes disclosure rules for sexual orientation, gender identity, and intersex data
Oct 11, 2026 edition · GC-2026-0128 · Published 2026-10-11 · Version 3 · Final
SB 1114 limits identifiable disclosures of sexual orientation, gender identity, and intersex information by enumerated California agencies and specified public higher-education institutions. The September 26 law preserves defined exceptions and minimum-necessary sharing, with distinct automation and Department of Social Services implementation provisions.
What happened
California chaptered SB 1114 on September 26 as Chapter 471. The amendments restrict disclosure of covered SOGISC information in personally identifiable form outside California state or local government or its authorized agents, subject to the listed exceptions. Covered information includes specified data reasonably capable of revealing transgender or intersex status, such as certain combinations of identity and birth-sex information and gender-marker records. The framework names the covered state agencies and incorporates disclosure restrictions for the identified public postsecondary institutions; it does not create a universal private-provider demographic-collection mandate.
Exceptions include mandatory federal or interstate program agreements, warrants or orders enforceable in California, designated public-health functions, qualifying protected vendor services, permitted Information Practices Act disclosures, and specified Civil Rights Department activities. Identifiable sharing must be limited to the minimum required by the applicable exception. For shared state-federal systems, the separation and limited-sharing duties become operative for each agency when it notifies the Legislature that the necessary automation is complete. Separately, DSS must comply with the identified external-disclosure restrictions as early as possible, no later than January 1, 2028. The DSS dated phase and shared-system automation trigger apply to different statutory requirements.
Scope and timing
- Authority status
- Final
- Applicability
- Directly applicable
- Audience
- Health systems, Provider networks
- Jurisdiction
- California
- Recorded date
- 2027-01-01
- Date type
- effective
Why it matters
Privacy, data governance, patient access, analytics, and vendor workflows may handle the covered data and need consistent disclosure controls.
Recommended action
Map where the covered data is collected and disclosed, compare existing authorization and disclosure controls with the chaptered text, and assign remediation owners.
Sources
- SB 1114, bill historyOfficial · California Legislature · 2026-09-26 · Source review 2026-09-27
- SB1114 current official textOfficial · California Legislature · 2026-09-26 · Source review 2026-10-11
- California Constitution, Article IV section 8(c), official Assembly 2023–24 editionOfficial · California State Assembly · Source review 2026-10-14
Complete edition and supplemental material
This finding in the complete approved report →Regulatory horizons, CIA trends and implementation trackers remain in the full report.
Read the entire Compliance Sweep report →