California regulatory action

In October 2024, California Governor Gavin Newsom vetoed Senate Bill 1059 (SB 1059), a measure that would have prohibited businesses from sharing consumers' sensitive personal data with third parties for advertising purposes without explicit opt-in consent. The bill was authored by State Senator Josh Becker and had passed both chambers of the California legislature with broad support. Sensitive data categories targeted by the bill included precise geolocation, health and medical information, financial data, racial or ethnic origin, religious beliefs, sexual orientation, and citizenship status. Newsom's veto message indicated that California already had robust privacy protections through the California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), and that additional legislation could create conflicting regulatory frameworks that would burden businesses without meaningfully enhancing consumer protections.

The veto was widely seen as a significant reprieve for the AdTech industry, particularly for data brokers, demand-side platforms (DSPs), data management platforms (DMPs), and publishers that rely on sensitive audience segments for targeted advertising. Had SB 1059 passed, it would have required opt-in consent mechanisms for a broad swath of high-value audience data, fundamentally disrupting programmatic advertising workflows that depend on behavioral and demographic targeting. The decision reinforces California's existing CPRA framework as the primary regulatory vehicle, but also signals ongoing legislative pressure on sensitive data use in advertising. Industry observers note that while the veto provides short-term relief, the legislative momentum around sensitive data restrictions is unlikely to abate, and advertisers and data intermediaries should anticipate continued scrutiny at both the state and federal levels. The outcome also highlights the tension between consumer privacy advocates and the digital advertising ecosystem, with implications for identity resolution, audience targeting, and data marketplace businesses operating in California and beyond.