SB 137 bundles a set of budget‑related and administrative changes into a single bill. Its headline move is to restructure the Consumer Privacy Fund created under the CCPA/CPRA into three distinct subfunds—one for the California Privacy Protection Agency’s operations, one for Attorney General enforcement, and one for competitive grants—and to prescribe how enforcement recoveries and existing fund balances are allocated between those subfunds.
The bill also directs how those grant dollars are to be distributed and sets a funding threshold before grantmaking begins.
Outside of consumer privacy finance, SB 137 alters a range of state administrative practices: it updates fee authority at the Department of Financial Protection and Innovation, requires legislative reports be submitted electronically, creates a process to notify DGS and the Legislature of surplus CDCR real property and authorize disposition, adjusts rules for using in‑house and outside counsel (including new exemptions), revises certain Indian gaming fund authorizations, extends and refines I‑Bank climate financing authorities, changes planning reporting standards, updates a definition for "vulnerable communities," and expands eligibility for the HOPE children’s trust. The bill takes effect immediately as an appropriation‑related measure.
At a Glance
What It Does
It splits the state’s Consumer Privacy Fund into separate subfunds for agency operations, Attorney General enforcement, and grants, and prescribes where enforcement recoveries and leftover fund balances must flow. It also makes miscellaneous administrative and programmatic changes across state departments, from property disposition to infrastructure financing rules.
Who It Affects
The California Privacy Protection Agency, the Attorney General’s enforcement arm, businesses subject to the CCPA/CPRA, DFPI‑regulated entities, the Department of General Services, Department of Corrections and Rehabilitation, local planning agencies, I‑Bank participants, and nonprofits that would apply for grant funding.
Why It Matters
The bill creates dedicated, earmarked revenue streams for privacy enforcement and a new grant program, shifting how privacy enforcement and education are financed in California. It also contains several near‑term changes—property disposition authority, fee adjustments, I‑Bank timeline extensions, and reporting requirements—that affect agency operations and local governments’ compliance obligations.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
SB 137 reorganizes where money collected in the name of consumer privacy enforcement goes and creates a narrowly focused grant program. Rather than leaving the Consumer Privacy Fund as a single pot, the bill directs the state to divide privacy enforcement recoveries and existing unspent balances so that the state privacy regulator and the Attorney General each get a dedicated subfund for carrying out CCPA/CPRA duties, and a smaller subfund is set aside exclusively for grants to support privacy education and cooperative enforcement programs.
The grant program sits inside the privacy agency and is intended to fund training, privacy promotion, child online‑privacy education, and international cooperation on fraudulent data breach activity.
Operationally, the bill leaves actual spending subject to legislative appropriation while giving the agency responsibility to design and administer the grant program. The agency must identify categories of eligible grantees and has a required distribution pattern among recipient types; it will begin making awards only after a minimum level of grant funding accumulates.
The bill also directs a one‑time reallocation of any remaining Consumer Privacy Fund balances not already assigned in the 2025 Budget Act into the three new subfunds.Beyond privacy finance, SB 137 contains a grab‑bag of administrative changes aimed at tightening operations and clarifying authority. It modernizes how agencies submit reports to the Legislature (electronic copies only), changes several fee lines administered by the Department of Financial Protection and Innovation, and establishes a process for the Department of Corrections and Rehabilitation to flag surplus real property to DGS and the Joint Legislative Budget Committee for possible sale, lease, or redevelopment.
The bill also creates narrow legal‑representation exceptions for civil discovery and for the Governor’s office, adjusts Indian gaming fund uses, temporarily modifies eligibility rules for some small business assistance grantees, and extends and refines I‑Bank climate financing rules and confidentiality protections.Several of the bill’s provisions have immediate programmatic implications: local planning agencies must follow new standards and forms issued by the Office of Land Use and Climate Innovation when preparing annual reports (other than housing elements), the definition of “vulnerable communities” used for climate adaptation work updates to the latest agency guidance, and the HOPE trust program is expanded to include certain adults who lost a parent during the COVID‑19 emergency while they were minors. The measure declares it takes effect immediately because it contains appropriations-related provisions.
The Five Things You Need to Know
The bill directs that 95% of administrative fines and settlement proceeds recovered by the California Privacy Protection Agency go to a new Consumer Privacy Subfund for agency use, and that 95% of civil penalties recovered by the Attorney General go to a new Attorney General Consumer Privacy Enforcement Subfund.
The remaining 5% of those agency recoveries and of Attorney General civil penalties are to be deposited into a Consumer Privacy Grant Subfund that the privacy agency will administer for grants and cooperative programs.
The agency must distribute one‑third of available grant funding to specified recipient categories, including nonprofit organizations that promote and protect consumer privacy.
The agency may not begin awarding grants from the Grant Subfund until the subfund’s balance exceeds $300,000.
In the 2025–26 fiscal year the bill requires a one‑time transfer of any remaining Consumer Privacy Fund balance not appropriated in the 2025 Budget Act: 45% to the Consumer Privacy Subfund, 45% to the Attorney General enforcement subfund, and 10% to the Grant Subfund.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Create three subfunds and dedicate enforcement recoveries and leftover balances
This section establishes a Consumer Privacy Subfund (for the privacy agency), an Attorney General Consumer Privacy Enforcement Subfund, and a Consumer Privacy Grant Subfund within the existing Consumer Privacy Fund, and ties recovery proceeds and unappropriated fund balances to those subaccounts. Practically, it earmarks enforcement income that previously could flow more flexibly into specific uses and makes those monies available only upon appropriation (except where the bill specifies otherwise). For grant administrators, it creates a narrow revenue stream and a statutory trigger for commencing grant awards, which will require new grant governance, reporting, and compliance processes inside the privacy agency.
Adjust fee authorities at the Department of Financial Protection and Innovation
The bill revises certain fees paid to the DFPI and makes technical edits to the department’s statutes. Although the bill text in this copy does not list each fee change, the practical impact will be changes to revenue streams that support DFPI operations and may alter compliance costs for regulated lenders, fintechs, and licensees. Agencies and regulated entities should expect updated fee schedules and conforming regulatory or administrative guidance to follow.
Require electronic submission of agency reports to the Legislature
SB 137 modernizes report delivery by replacing a mixed printed/electronic requirement with an all‑electronic submission rule to the Secretary of the Senate, Chief Clerk of the Assembly, and Legislative Counsel. That reduces printing obligations but shifts expectations for formatting, metadata, and archiving; agencies will need to ensure submissions meet the Legislature’s electronic filing standards and preserve records accordingly.
New notice and disposal path for surplus corrections property
The secretary of CDCR, with Department of Finance approval, must notify DGS and the Joint Legislative Budget Committee when real property is deemed excess to CDCR needs. DGS may sell, lease, exchange, or otherwise dispose of the property only with legislative authorization, and is explicitly authorized to execute leases as provided. Revenues (with listed exceptions) are deposited into the Property Acquisition Law Money Account and may be transferred into the Architectural Revolving Fund to support redevelopment—effectively allowing some transaction proceeds to finance predevelopment/reuse work. The mechanics create a pathway for repurposing correctional real estate but retain legislative control over final disposition.
Narrow exceptions to AGO consent for in‑house or outside counsel and clarify document custody
Current law generally requires written Attorney General consent before an agency employs in‑house counsel for adjudicative proceedings or contracts outside counsel. SB 137 carves out civil discovery‑related representation and adds the Governor’s office to the list of entities exempt from that consent requirement, while restating that agencies may still request AGO representation for any purpose. The bill also declares that the Attorney General does not have possession, custody, or control of an agency’s documents for discovery purposes—an important clarification that reallocates discovery responsibilities and could change how agencies manage and produce records in cases involving the state.
Remove a prioritized use and add a new regulatory compensation authorization
The bill removes the explicit authorization to use Indian Gaming Special Distribution Fund moneys to support state and local agencies impacted by tribal gaming, deletes the fund’s order of priority for spending, and authorizes use of fund moneys to compensate regulatory costs tied to class III gaming secretarial procedures. These edits reframe eligible uses and remove a statutory prioritization that previously guided appropriation decisions, which will alter budget planning for programs that formerly relied on that priority structure.
Temporary eligibility exceptions for grantees whose federal contracts were disrupted
For grants made in fiscal years 2025–26 through 2027–28, the bill establishes exceptions to the Office of Small Business Advocate’s eligibility criteria where an applicant’s federal contract was canceled, frozen, or rescinded in 2024–25. The office must still confirm applicants meet state performance standards and equitable service expectations, and report its findings to the Legislature. This is a narrowly time‑limited fix to avoid disqualifying grantees affected by federal contract disruptions.
Rename and extend climate catalyst authorities and change consultation/notification rules
The bill renames the Climate Catalyst program and requires the I‑Bank to adopt a climate catalyst plan for each project category, in consultation with specified agencies. It extends the deadline for approving projects eligible for I‑Bank assistance and extends a temporary public‑records confidentiality window. The bill also tightens reporting to legislative climate budget subcommittees and requires written notice to the Joint Legislative Budget Committee when federal funds are fully recycled into state dollars prior to further commitments—adding transparency where federal and state financing intersect.
Standardize annual reporting formats, update definitions, expand HOPE eligibility, and include budget‑related clauses
SB 137 requires most annual planning reports to use standards, forms, and definitions adopted by the Office of Land Use and Climate Innovation (with the housing element continuing to use HCD’s forms); those standards are exempt from the Administrative Procedure Act. It updates the statutory pointer for the definition of “vulnerable communities” to the office’s latest resource guide. Separately, the bill expands eligibility for the HOPE trust to include California residents who are now adults but lost a parent to COVID‑19 as minors and met the statute’s income criteria. Finally, the bill contains appropriation language and declares immediate effect for budget‑related purposes.
This bill is one of many.
Codify tracks hundreds of bills on Government across all five countries.
Explore Government in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- California Privacy Protection Agency — Gains a dedicated revenue stream and a statutory subfund to support staffing, investigations, rulemaking, and grant administration, reducing reliance on the General Fund for privacy enforcement operations.
- Attorney General — Receives a separate enforcement subfund to support civil enforcement of CCPA/CPRA violations, providing a clearer funding base for litigation and investigative work.
- Nonprofit organizations and privacy education providers — Become statutorily prioritized recipients under the new grant subfund, improving their ability to secure state grants for consumer privacy education and child online‑privacy programs.
- Department of General Services and redevelopment partners — Obtain a clearer statutory path to redevelop surplus CDCR properties, and access to a transfer mechanism into the Architectural Revolving Fund to pay for redevelopment‑readiness work.
- I‑Bank participants and climate project sponsors — Benefit from an extended eligibility window and clarified planning requirements that keep climate catalyst financing available beyond the bill’s prior sunset.
Who Bears the Cost
- Businesses subject to the CCPA/CPRA — Face a potentially strengthened enforcement environment as the regulator and Attorney General gain clearer, earmarked funding to pursue violations, which could increase enforcement actions and associated remediation costs.
- DFPI‑regulated entities and financial services licensees — Will see fee schedule changes that may increase licensing or regulatory compliance costs (specific fee changes will be in the bill’s implementing provisions).
- Local planning agencies — Must adopt new reporting standards and formats prepared by the Office of Land Use and Climate Innovation, imposing an administrative burden and creating a state‑mandated local program requirement.
- State agencies managing surplus CDCR property — Will need to coordinate DOF approval, DGS disposition, and potential legislative authorization, adding procedural steps and potential resource needs for property assessment and redevelopment planning.
- Tribes and programs previously relying on the Indian Gaming Special Distribution Fund’s former priorities — Face uncertainty because the bill removes the fund’s established order of priority and redirects eligible uses toward specified regulatory compensation.
Key Issues
The Core Tension
The central dilemma is between creating protected, predictable funding for privacy enforcement and education versus concentrating enforcement incentives and reducing fiscal flexibility: dedicating enforcement recoveries to agency operations and grants stabilizes those programs but risks making enforcement self‑funding through penalties, which can skew regulatory priorities and complicate fiscal oversight.
SB 137 trades budgetary flexibility for dedicated funding. By directing enforcement recoveries into statutorily specified subfunds, the bill shields privacy enforcement and grant spending from the normal ebb and flow of the General Fund—but it also ties agency operating capacity to recoveries and one‑time transfers.
That creates a risk of enforcement‑driven budget dependence: when an enforcement program is funded primarily by fines, that can create pressure to prioritize revenue‑generating enforcement avenues over other regulatory objectives or long‑term compliance strategies.
Several implementation details are unresolved or operationally difficult. The bill requires the privacy agency to design and run a grant program with a required distribution pattern and a minimum balance trigger; yet it does not appropriate start‑up funds for grant administration, so the agency will need to absorb administrative costs or seek separate appropriations.
The one‑time transfer mechanics depend on what the Legislature did not appropriate in the 2025 Budget Act, a contingent calculation that will complicate fiscal planning. Separately, exempting the Governor’s office from AGO consent and clarifying that the Attorney General does not possess agency documents for discovery will change litigation logistics and may increase the need for agencies to bolster their own e‑discovery infrastructure and litigation budgets.
Other tradeoffs are procedural. Removing a statutory order of priority from the Indian Gaming fund reduces clarity for budget planners and may intensify interagency or tribal negotiations over appropriations.
Extending confidentiality protections and project approval timelines for I‑Bank climate projects preserves financing options but narrows near‑term public transparency. And imposing new reporting standards on local governments—while administratively sensible from the state’s perspective—acts as an unfunded mandate unless the Legislature provides offsetting resources.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.