SB 930: Student Test Taker Privacy Protection Act: end-to-end encryption.

Official summary

Legislative Counsel’s Digest (official, as of the latest version). Written by nonpartisan legislative staff; reproduced verbatim.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K–12 student’s personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill, beginning July 1, 2027, would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define “end-to-end encryption” for these purposes to mean a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Sponsors

Sponsors by party (alphabetical): Democratic 1

“Support” is shown only as formal sponsorship recorded by the legislature. Roll-call votes are available on the official bill page.

Recent official actions

1. September 30, 2026Chaptered by Secretary of State. Chapter 989, Statutes of 2026.
2. September 30, 2026Approved by the Governor.
3. August 21, 2026Enrolled and presented to the Governor at 3 p.m.
4. August 17, 2026Assembly amendments concurred in. (Ayes 40. Noes 0. Page 5485.) Ordered to engrossing and enrolling.
5. August 6, 2026In Senate. Concurrence in Assembly amendments pending.
6. August 6, 2026Read third time. Passed. (Ayes 75. Noes 0. Page 6080.) Ordered to the Senate.
7. August 3, 2026Read second time. Ordered to third reading.
8. July 2, 2026From committee: Do pass as amended. (Ayes 8. Noes 0.) (July 1).
9. July 2, 2026Read second time and amended. Ordered to second reading.
10. June 17, 2026From committee: Do pass and re-refer to Com. on ED. with recommendation: To consent calendar. (Ayes 15. Noes 0.) (June 16). Re-referred to Com. on ED.
11. May 11, 2026Referred to Coms. on P. & C.P. and ED.
12. April 27, 2026In Assembly. Read first time. Held at Desk.