AB 1159: Student personal information.

Official summary

Legislative Counsel’s Digest (official, as of the latest version). Written by nonpartisan legislative staff; reproduced verbatim.

Existing law, the K–12 Pupil Online Personal Information Protection Act (KOPIPA), generally protects the personal information of a student enrolled in a K–12 course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.

Existing law, the Early Learning Personal Information Protection Act (ELPIPA), generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a “pupil,” by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes.

This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator, or an entity working on behalf of the operator, of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operator’s site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system.

This bill would also enact the Higher Education Student Information Protection Act (HESIPA), which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2027.

This bill would authorize a pupil or student actually harmed by noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed, and would require a person bringing that action to furnish a copy of the complaint to the Attorney General within 10 days after filing the action.

Sponsors

Sponsors by party (alphabetical): Democratic 1

“Support” is shown only as formal sponsorship recorded by the legislature. Roll-call votes are available on the official bill page.

Recent official actions

1. September 10, 2026Chaptered by Secretary of State - Chapter 182, Statutes of 2026.
2. September 10, 2026Approved by the Governor.
3. September 9, 2026Enrolled and presented to the Governor at 1 p.m.
4. August 31, 2026Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 70. Noes 4. Page 6976.).
5. August 30, 2026In Assembly. Concurrence in Senate amendments pending.
6. August 30, 2026Read third time. Passed. Ordered to the Assembly. (Ayes 32. Noes 0.).
7. August 24, 2026Read second time. Ordered to third reading.
8. August 21, 2026Read third time and amended. Ordered to second reading.
9. August 13, 2026Read second time. Ordered to third reading.
10. August 13, 2026From committee: Do pass. (Ayes 5. Noes 0.) (August 13).
11. August 10, 2026In committee: Referred to APPR. suspense file.
12. August 3, 2026From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on APPR.