AMENDED IN ASSEMBLY AUGUST 21, 2026
AMENDED IN ASSEMBLY AUGUST 13, 2026
AMENDED IN ASSEMBLY JUNE 18, 2026
AMENDED IN SENATE APRIL 27, 2026
AMENDED IN SENATE MARCH 26, 2026
CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION
94
Introduced by Senator Pérez
February 2, 2026
An act to add Chapter 31.7 (commencing with Section 22946.5) to Division 8 of the Business and Professions Code, relating to privacy. Division 123 (commencing with Section 153000) to the Health and Safety Code, relating to civil detention facilities.
Vote: majority Appropriation: no Fiscal committee: yes Local program: no
LEGISLATIVE COUNSEL’S DIGEST
Existing law requires the operator of a private detention facility, as defined, to comply with, and adhere to, the detention standards of care and confinement agreed upon in the facility’s contract for operations, as specified. Existing law requires a private detention facility operator to comply with, and adhere to, all local and state public health orders and occupational safety and health regulations.
This bill, the Protecting Vulnerable Immigrant Detainees Model Act, would require the Attorney General, on or before December 31, 2027, to submit to the Legislature a proposed oversight plan for private civil detention facilities that protects the health, safety, and welfare of persons detained in those facilities, as specified. The bill would require the Governor to direct the appropriate state entity to cooperate with the Attorney General for the purposes of developing the oversight plan, as specified.
The bill would make related findings and declarations.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
Existing federal law authorizes specified federal officers to require, among other things, the attendance and testimony of witnesses before immigration officers and the production of books, papers, and documents relating to, among other things, the privilege of any person to enter, reenter, reside in, or pass through the United States.
This bill would require a social media company, as defined, to promptly notify an individual whose personal information is requested by an administrative subpoena issued as described above, except as specified. The bill would require the social media company to provide the individual whose personal information is requested in an administrative subpoena with at least 30 days to respond to or challenge the administrative subpoena before responding to the administrative subpoena. The bill would also require a social media platform, before responding to an administrative subpoena, to determine if the administrative subpoena is invalid for any of specified reasons, including that the information requested by the subpoena is too indefinite or broad, except as specified.
This bill would require a social media company that discloses personal information in response to an administrative subpoena to provide notice to the individual whose information was disclosed and would require a social media company that responds to an administrative subpoena to notify the Attorney General of that response, as specified. The bill would prohibit a social media company from responding to an administrative subpoena for personal information while a legal challenge to the subpoena is pending if the social media company has actual knowledge of the challenge.
This bill would require the Attorney General to develop a process for a social media company to submit the notice described above, as specified. The bill would exempt notices submitted as described above from the California Public Records Act. The bill would authorize the Attorney General, and a person whose information has been shared in violation of the above provisions by a social media company, to bring an action for injunctive or declaratory relief, as specified. The bill would declare its provisions severable.
Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest.
This bill would make legislative findings to that effect.
The people of the State of California do enact as follows:
SECTION 1.
Division 123 (commencing with Section 153000) is added to the Health and Safety Code, to read:
Division 123. Protecting Vulnerable Immigrant Detainees Model Act
The Legislature finds and declares all of the following:
(a) California has a compelling interest in protecting the health, safety, and welfare of individuals residing in civil detention facility environments.
(b) Existing law provides that civil detainees have the same legal rights and responsibilities guaranteed to all other individuals by the United States Constitution and laws and the Constitution and laws of the State of California.
(c) In 2017, pursuant to Assembly Bill 103, the Legislature directed the Attorney General, or their designee, to review and report on the conditions of confinement, how those conditions affect due process, and the standards of care offered to individuals held in civil immigration detention facilities across the state. The Attorney General’s reports shed light on the conditions to which individuals held in privately operated detention facilities are subjected, including recurring substandard conditions and limited access to critical health care.
(d) Multiple state agencies and departments, including the State Department of Public Health, currently oversee, inspect, and fine civil facilities if violations of regulations promulgated by that agency or department are found.
(e) While other civil and correctional facilities across the state have oversight mechanisms to ensure the health, safety, and welfare of individuals held within them, no such oversight currently exists over all privately operated civil detention facilities in the state. As the Ninth Circuit recognized in United States v. California, 921 F.3d 865, 886 (9th Cir. 2019), “California possesses the general authority to ensure the health and welfare of inmates and detainees in facilities within its borders.” Therefore, California needs a comprehensive oversight mechanism to protect the health, safety, and welfare of those held in all privately operated civil detention facilities across the state that aligns with the oversight mechanisms of similarly situated entities.
(a) (1) The Attorney General, on or before December 31, 2027, shall submit to the Legislature a proposed oversight plan for private civil detention facilities that protects the health, safety, and welfare of persons detained in those facilities.
(2) The Attorney General shall consider applicable federal and state laws and, at a minimum, consider the provision of health care and the conditions of detention in those facilities in developing the oversight plan.
(3) The oversight plan shall propose requirements for civil detention facilities that are comparable to facilities that are currently under the oversight of state agencies and departments and shall give consideration to how detention facilities operate and the populations they hold in developing those requirements.
(4) The Attorney General may make other recommendations necessary to implement the oversight plan.
(b) The Governor, or the Governor’s designee, shall direct the appropriate state agency, department, board, or commission to cooperate with the Attorney General for the purposes of developing the oversight plan described in subdivision (a) by doing all of the following:
(1) Designate a senior representative for the state entity described in this subdivision to facilitate the provision of information requested by the Attorney General in the discharge of their duties pursuant to this subdivision.
(2) Provide information requested by the Attorney General within 30 days or a timeframe otherwise agreed upon by the parties.
(3) Review and provide input on the oversight plan described in subdivision (a).
(c) The Attorney General shall keep confidential any information received from a state agency that the state agency considers confidential. The Attorney General shall also withhold from public disclosure information that is otherwise exempt from disclosure under the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).
(d) (1) The requirement for submitting a report imposed under subdivision (a) is inoperative on January 1, 2031, pursuant to Section 10231.5 of the Government Code.
(2) A report to be submitted pursuant to subdivision (a) shall be submitted in compliance with Section 9795 of the Government Code.
SEC. 2.
The Legislature finds and declares that Section 1 of this act, which adds Section 153001 of the Health and Safety Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
In order to develop a robust oversight plan for private civil detention facilities to ensure the health, safety, and welfare of individuals residing in private civil detention facility environments and protect the health, safety, and welfare of individuals residing in such facilities, it is necessary to allow state agencies freely exchange information and analysis and limit the public’s right of access to records exchanged in furtherance of the goals of this act.
Chapter 31.7 (commencing with Section 22946.5) is added to Division 8 of the Business and Professions Code, to read:
31.7.
Stopping Harmful Information Exploitation and Lawless Data Sharing Act
22946.5.
(a) This chapter shall be known, and may be cited, as the “Stopping Harmful Information Exploitation and Lawless Data Sharing Act.”
(b) For purposes of this chapter, the following definitions shall apply:
(1) “Administrative subpoena” means a subpoena issued pursuant to either of the following:
(A) Subparagraph (A) of paragraph (1) of subsection (a) of Section 1509 of Title 19 of the United States Code, as that section read on January 1, 2026.
(B) Subparagraph (A) of paragraph (4) of subsection (d) of Section 1225 of Title 8 of the United States Code, as that section read on January 1, 2026.
(2) “Individual” means a natural person who is a California resident.
(3) “Maintain” includes maintain, acquire, use, or disclose.
(4) “Personal information” means any information that is maintained by a social media company that is reasonably capable of identifying or describing an individual, including, but not limited to, the individual’s name, social security number, physical description, address, telephone number, IP address, online browsing history, location information, social media information, education, financial matters, and medical or employment history. “Personal information” does not include any record that is required by law or regulation for the entry of merchandise pursuant to subparagraph (A) of paragraph (1) of subsection (a) of Section 1509 of Title 19 of the United States Code, as that section read on January 1, 2026.
(5) “Social media company” means a social media company, as defined in Section 22675.
(c) (1) (A) A social media company shall promptly notify an individual whose personal information is requested by an administrative subpoena.
(B) Prior to disclosing personal information in response to an administrative subpoena requesting the personal information of an individual, a social media company shall provide the individual whose personal information is requested with at least 30 days to respond to or challenge the administrative subpoena.
(C) If a social media company discloses personal information in response to an administrative subpoena, the social media company shall provide notice to the individual whose personal information was disclosed of both of the following:
(i) That the information was disclosed pursuant to an administrative subpoena.
(ii) A description of the information that was disclosed.
(D) This paragraph shall not apply if compliance would violate a court order prohibiting disclosure of the request.
(2) Notwithstanding any other law, prior to disclosing any personal information in response to an administrative subpoena requesting the personal information of an individual, a social media company shall determine if the administrative subpoena is invalid for any of the following reasons:
(A) The information requested by the administrative subpoena is not related to any purpose lawfully authorized pursuant to subparagraph (A) of paragraph (4) of subsection (d) of Section 1225 of Title 8 of the United States Code, as that section read on January 1, 2026, or pursuant to subparagraph (A) of paragraph (1) of subsection (a) of Section 1509 of Title 19 of the United States Code, as that section read on January 1, 2026, as applicable.
(B) The administrative subpoena is procedurally improper.
(C) The information requested by the administrative subpoena is irrelevant or immaterial to the purpose described in subparagraph (A).
(D) The information requested by the administrative subpoena is too indefinite or broad.
(3) This subdivision shall not apply with respect to an administrative subpoena issued pursuant to subparagraph (A) of paragraph (1) of subsection (a) of Section 1509 of Title 19 of the United States Code, as that section read on January 1, 2026, if the social media company has a good faith belief that an emergency involving child exploitation or human smuggling or trafficking requires disclosure of the information requested by the administrative subpoena without delay.
(d) (1) If a social media company responds to an administrative subpoena for personal information, it shall notify the Attorney General within five business days of the response. The notice shall also inform the Attorney General of whether the user whose personal information was requested has been notified by the social media company pursuant to subdivision (c).
(2) The Attorney General shall develop a process for a social media company to submit the notice described in paragraph (1), including specifications for what information the social media company must provide and in what format.
(e) A social media company shall not respond to an administrative subpoena for personal information while a legal challenge to the subpoena is pending if the social media company has actual knowledge of the challenge.
(f) (1) The Attorney General may bring an action for injunctive or declaratory relief against any social media company who violates this chapter.
(2) An individual whose information has been shared in response to an administrative subpoena by a social media company in violation of this chapter may also bring a civil action against the social media company for injunctive or declaratory relief.
(g) Nothing in this chapter shall be construed to prohibit a social media company from responding to an order issued by a court pursuant to subparagraph (B) of paragraph (4) of subsection (d) of Section 1225 of Title 8 of the United States Code, as that section read on January 1, 2026, or any other law.
(h) Information submitted to the Attorney General pursuant to subdivision (d) shall not be considered a public record and shall not be disclosed pursuant to a request under the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code).
SEC. 2.
The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
SEC. 3.
The Legislature finds and declares that Section 1 of this act, which adds Chapter 31.7 (commencing with Section 22946.5) to Division 8 of the Business and Professions Code, imposes a limitation on the public’s right of access to the meetings of public bodies or the writings of public officials and agencies within the meaning of Section 3 of Article I of the California Constitution. Pursuant to that constitutional provision, the Legislature makes the following findings to demonstrate the interest protected by this limitation and the need for protecting that interest:
In order to protect sensitive personal information, it is necessary that this act limit the public’s right of access to that information.