Gov. Gavin Newsom vetoed AB 1542 on Sept. 27, killing a CCPA amendment that would’ve prohibited California businesses from selling or sharing sensitive personal data, including precise geolocation, race, religion, sexual orientation, union membership, and health conditions. In his veto message, Newsom called the “categorical ban on sharing that information” “a step too far,” pointing to existing consumer opt-outs and enforcement budget limits.

The bill defined “precise” geolocation as pinpointing a person within 1,850 feet, a threshold that would’ve swept in most of the targeting audiences small businesses buy from data brokers to reach nearby customers.

Industry groups worked the veto hard. The ANA, 4As, AAF, and Digital Advertising Alliance all urged Newsom to reject the bill, with ANA EVP Chris Oswald calling it “overly broad and ill-conceived.” Consumer Reports, a co-sponsor, called the veto “a gift to data brokers, scammers, and spammy marketers,” and said it’ll work with legislators when the legislature reconvenes in January 2027.

California’s permissiveness is now an outlier on its own coast. Maryland and New Jersey banned sales of all sensitive data in the last year; Connecticut, Oregon, and Virginia have prohibited sales of precise geolocation data; Delaware joined the 2026 wave. Any operator running multi-state digital ads should audit which audience segments are being used where. What’s legal in Los Angeles isn’t in Baltimore.

Newsom did sign two adjacent bills: SB 923, which expands CCPA deletion rights to cover all personal data a business holds, and AB 883, which shortens data-broker deletion response times from 45 to 30 days. The framing is familiar from earlier federal moves like the FTC’s personalized-pricing inquiry: tighten consumer-facing rights, leave the ad-tech supply chain intact.

Sources

Sources