WeVote
Log In

Bill

Bill

AB 364

Personal information: maintenance.

2025-2026 Regular Session Introduced by Carl DeMaio

AB 364 requires explicit consumer opt-in and disclosure before Californians’ personal data can be stored outside the United States, aiming to curb foreign access to sensitive infor

In committee: Hearing postponed by committee.
#personalinformation #maintenance
0
WeVote Research Nonpartisan
Bill Summary · AB 364

AB 364 — Personal Information: Maintenance (Stop Foreign Governments from Accessing Californians’ Sensitive Personal Information Act)

Status: In committee (Hearing postponed). Introduced: Feb 3, 2025. Last action: Re‑referred to Committee on Privacy & Consumer Protection (Mar 25, 2025).

Purpose / Intent

AB 364 would strengthen protections for California residents by restricting when and how businesses may store Californians’ personal information outside the United States. The bill’s stated aim is to reduce the risk that foreign governments or foreign government‑controlled entities gain access to sensitive personal data of Californians.

Key provisions

  • Amends Civil Code §1798.100 (general duties of businesses that collect personal information):
    • Adds a requirement that, at or before collection, businesses must disclose to consumers whether the business intends to maintain the consumer’s personal information outside the United States.
    • Reinforces existing notice requirements on categories, purposes, retention period (or retention criteria), security practices, and limitations on collecting/using additional categories or purposes.
  • Adds new Civil Code §1798.122:
    • Prohibits a business from maintaining a consumer’s personal information outside the United States unless all of the following are true:
    • The business informs the consumer of potential risks associated with maintaining data abroad.
    • The consumer explicitly consents to the business maintaining the personal information outside the United States (i.e., an affirmative opt‑in).
    • (Text truncated in the provided version) — the bill’s digest and earlier text indicate additional limitations for particularly sensitive data.
    • Specifically prohibits placing certain sensitive categories — identified in the digest as health care information, financial information, and geolocation data — in the custody of a foreign government or a third party owned or controlled by a foreign government.
  • Declares that the bill furthers the purposes and intent of the California Privacy Rights Act (CPRA) and operates within the CPRA/California Consumer Privacy Act (CCPA) framework. Enforcement is expected to operate through the existing CPRA/CCPA mechanisms (including the California Privacy Protection Agency), consistent with the statute.

Who is affected

  • Businesses that collect, process, or store personal information of California residents, including online services, cloud providers, data brokers, health/financial services, and any entity using foreign data centers or foreign third‑party processors.
  • Third parties, service providers, or contractors (vendors) located outside the U.S., especially those owned or controlled by foreign governments.
  • California consumers, who would gain additional notice and an explicit opt‑in right before their data is stored abroad and added protections for certain sensitive data categories.

Potential impacts

  • Operational and compliance changes for businesses: updated privacy notices, new consent flows, contractual revisions with foreign vendors, vendor due diligence, and possible data localization or re‑routing to U.S. data centers.
  • Increased protection for particularly sensitive categories from access by foreign governments or government‑controlled entities.
  • Possible increased costs for firms relying on global cloud infrastructure or cross‑border processing.

Procedural / Timeline notes

  • Introduced Feb 3, 2025. Multiple committee referrals and amendments in March 2025; most recent status (Mar 25, 2025) shows the bill re‑referred to the Assembly Committee on Privacy & Consumer Protection with a hearing postponed.
  • The bill was amended several times by the author and committee chairs; final text may be subject to further change as it proceeds through committee.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.