Governor Gavin Newsom has until Sept. 30 to sign or veto a stack of privacy and AI bills the Legislature sent him on Aug. 31, and, as Ropes & Gray notes, California has no pocket veto: anything he doesn’t touch becomes law anyway. Two bills in that stack quietly rewrite how small businesses in California acquire customers.

The first is AB 1542, which would prohibit selling or sharing sensitive personal information, including geolocation and health data, under the CCPA. For any owner-led shop that depends on programmatic, Meta, or Google audiences built from broker-sourced signals, that’s a same-day retooling of the ad stack. The second is SB 690, which kills off private CIPA pen-register claims retroactively for two years, the litigation theory that’s been aimed at small-business websites running ordinary tracking pixels.

Sitting alongside them is SB 1000, which strips the 1,000,000 monthly-visitor floor out of the AI Transparency Act’s “covered provider” definition and attaches a $5,000-per-violation-per-day penalty. AB 1609 stays narrower, applying only to customer service chatbots at firms above $500,000,000 in annual gross revenue and requiring a good-faith effort to reach a human within 15 minutes. SB 947, the “No Robo Bosses Act,” takes effect July 1, 2027 with $500 civil penalties. Newsom has already signed the AI-generated advertising disclosure law SB 1050 at SAG-AFTRA headquarters, and on Sept. 19 directed state agencies to deliver AI safety recommendations by Nov. 16. NBC News counted 26 AI- and social-media bills passed in the final week alone.

For a founder-led business, the exposure isn’t the headline bills. It’s the ad stack underneath them. LemonLime prepares outreach and content from publicly observable signals, not from sensitive consumer data purchased downstream. The channel it uses to find customers is the one Sacramento isn’t closing this week.

Sources

Sources