This post originally stated that AB 2564 included a private right of action allowing consumers to sue for injunctive relief plus attorney’s fees. That was incorrect, and we have corrected it below.
The bill did contain that provision when it was introduced in February 2026 and through its April amendments. It was removed in full by Senate amendment on 24 June 2026 — before this article was published. We did not catch the change before publishing. The version that ultimately passed the Senate contained no enforcement provision of any kind.
AB 2564 did not become law. It passed the Senate on 31 August 2026 but missed its final concurrence vote in the Assembly and never reached the Governor.
For the current position, the webinar discussion and what merchants should do before California’s next session opens on 7 December, see AB 2564: what the bill actually did, and what comes next.
What AB 2564 actually does
AB 2564 would prohibit “surveillance pricing” — setting or offering a customized price for a specific customer based on personal information collected through “electronic surveillance technology.” That phrase is defined broadly enough to cover the everyday tools nearly every online store runs: device tracking, behavioral data, and information about a shopper’s browsing and purchase history, including data acquired from third parties.
The bill’s supporters are aiming at a real concern — companies using detailed personal data to quietly charge some shoppers more. But the bill’s definition doesn’t distinguish between charging someone more and offering someone a deal. It sweeps in any “customized price” built on customer data, whether the price goes up or down.
Why this lands on e-commerce specifically
Think about the marketing tools online sellers use every day:
- The cart-abandonment email with a 10%-off code to win back a shopper who didn’t check out.
- The win-back offer to a customer who hasn’t ordered in a few months.
- Personalized coupons based on what someone has browsed or bought before.
Every one of these uses data about an individual shopper to offer that shopper a customized price. The bill does carve out broad, publicly posted, uniformly available discounts — student and military discounts, loyalty programs customers sign up for, sitewide promo codes. But the individualized, behavior-triggered offers that power modern e-commerce are exactly the ones sitting in the gray zone.
The bill wouldn’t necessarily ban those offers outright. What it would do is wrap them in a documentation-and-uniformity regime — you’d have to publicly post the eligibility terms and make each discount uniformly available to everyone who qualifies. For a large retailer with a compliance department, that’s a line item. For a small online seller, it’s real legal uncertainty over routine, everyday marketing.
The part that matters most: what enforcement would have looked like
When AB 2564 was introduced, it carried a private right of action — consumers could have sued for injunctive relief, with attorney’s fees for a prevailing plaintiff, alongside civil penalties of up to $12,500 and treble damages for intentional violations. That was the provision that made this look like the ADA and CIPA waves, where attorney’s-fee shifting is the fuel: a plaintiff doesn’t have to prove real harm or win at trial, because the threat of paying the other side’s legal fees is often enough to make settling the cheaper option.
It was removed by Senate amendment on 24 June 2026, and nothing replaced it.
The bill that went on to pass the Senate had no enforcement section at all — neither a consumer right to sue nor a public prosecutor’s penalty. That removal matters, and it is the part most commentary missed. The risk in the final bill was not litigation. It was a prohibition on individualized pricing with a narrow set of exceptions, and no clarity about who would enforce it or how — which for a small seller is a different problem, but still a real one.
California is trying to shut these lawsuits down — with the other hand
At the very same time, the California Legislature is moving a separate bill, SB 690, designed specifically to curb the website-lawsuit epidemic. SB 690 would strip the private right of action for those website-tracking claims and hand enforcement to the state Attorney General instead. It cleared the Assembly’s Privacy and Consumer Protection Committee unanimously (14–0) on July 1, 2026, then passed both houses unanimously — 66–0 in the Assembly and 39–0 on Senate concurrence, both on 28 August 2026 — and was presented to the Governor on 4 September 2026.
Put the two side by side:
- SB 690 takes the private-lawsuit weapon away from the firms flooding online sellers with demand letters.
- AB 2564 was originally drafted to hand those same kinds of firms a brand-new private-lawsuit weapon, aimed at the same websites and the same customer data. That provision was stripped out in June 2026, before the bill reached the Senate floor.
In one legislative session, over the same online stores, California moved to tear one litigation tool down while another was being drafted. In the end only the first happened: SB 690 passed both houses unanimously and went to the Governor, while AB 2564 lost its enforcement provision in June and then failed on a procedural vote in August.
“But I’m not in California”
Neither are most of the businesses already getting hit by California website lawsuits. These laws tend to follow the California shopper, not the seller. If a California resident visits your store and you’re using the covered data and pricing tools, you can be pulled into a California court no matter where your business is based. National sellers have learned this the hard way with ADA and wiretapping claims already.
What online sellers should do now
AB 2564 did not become law, but it came within one procedural vote of the Governor’s desk — and California’s next legislative session opens on 7 December 2026. That makes the steps below worth taking now rather than when the next version appears. A few practical steps:
- Know your own stack. Get clear on which of your promotions are individualized and data-driven (cart recovery, win-back, personalized coupons) versus broadly posted and uniformly available to anyone.
- Watch the bill. AB 2564 and SB 690 are both moving quickly and being amended. The details — especially who can sue and for what — matter a great deal.
- Make your voice heard. If personalized offers are part of how your store competes and serves customers, your representatives should hear that from the sellers who would actually be affected.
Online sellers have spent years learning to protect their websites from litigation risk. AB 2564 is the next one worth watching closely.
What was said on the webinar
On 29 July 2026 our founder Nayan Padrai joined the Connected Commerce Council to walk merchants through what AB 2564 would have meant for the way they run discounts — abandoned cart codes, win-back offers, subscriber-only drops and geo-targeted promotions.
Dealing with an ADA or CIPA demand letter right now?
Three reasons this block has to go:
- It still says “Seats are limited — register today” for an event two months past.
- The registration link is dead, so the page’s main CTA goes nowhere.
- It says “hosted by Connected Council” — the organization is the Connected Commerce Council. Check whether that error appears elsewhere on the site.
This article is for general information and is not legal advice. EcomBack is not a law firm. It was published in July 2026 and corrected in September 2026; confirm current bill text and status before relying on any specific detail.
