On October 8, 2025, California Governor Gavin Newsom signed into law Assembly Bill 656 — Account Cancellation. AB 656, authored by Assembly member Pilar Schiavo, focuses on social media platforms and requires them to provide users with a clear and accessible way to delete their accounts. This action must also trigger the complete deletion of the user’s personal data.
In his press release, Governor Newsom emphasized the importance of user control, stating, “it shouldn’t be hard to delete social media accounts, and it shouldn’t be even harder to take back control of personal data. With these bills, social media users can be assured that when they delete their accounts, they do not leave their data behind.”
The law which adds new Title 25 to Division 3 Part 4 of the Civil Code under the title “Social Media Platforms Endangering Californians” will go into effect on January 1, 2026.
Scope
The law applies to social media platforms that generate more than $100 million in annual gross revenue and have users in California. The law refers to the existing definition in the Business Professions Code that defines “social media platform” as follows:
(1) A public or semi-public internet-based service or application that has users in California and that meets both of the following criteria:
(A) A substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application.
(B) A service or application that provides email or direct messaging services shall not be considered to meet this criterion on the basis of that function alone.
(2) The service or application allows users to do all of the following:
(A) Construct a public or semipublic profile for purposes of signing into and using the service or application.
(B) Populate a list of other users with whom an individual shares a social connection within the system.
(C) Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.
Key Provisions
Simplified Account Deletion Process
Under the law, social media platforms must provide users with a clear and conspicuous option to delete their accounts. The law outlines specific requirements for how and where this option must appear:
A button labeled “Delete Account” must be placed as an immediately visible option within the platform’s settings menu.
The settings menu containing this option must be accessible across all formats in which the platform is used, including applications, web browsers, and any other format which users can use to access the platform.
Furthermore, when a user clicks the “Delete Account” button, the social media platform must provide clear steps to complete the account deletion request. Notably, this deletion must include the deletion of the user’s personal information.
The law permits platforms to verify the deletion request; however, any verification must be conducted in a cost-effective and user-friendly manner. The verification must rely on pre-established two-factor authentication, email, text message, telephone call, or message.
The law also clarifies that if a user logs back into their account after submitting a deletion request, that action alone does not cancel the request.
Obstruction/Dark Patterns Prohibition
The law also prohibits platforms from obstructing or interfering with a user's ability to delete their account. This includes the use of dark patterns.
CCPA Compliance
A user's request to delete their account under this law is considered a formal request to delete personal information under the California Consumer Privacy Act (CCPA). As such, platforms must process these requests in full compliance with the CCPA's requirements. Under those requirements, businesses generally have 45 days to complete deletion.
Conclusion
This law reflects a broader shift in California’s privacy legislation toward giving consumers more direct control over their personal data. The law builds on prior efforts to simplify users’ ability to cancel or close digital accounts, including last year's Click to Cancel law, also authored by Schiavo, which made it easier to cancel subscriptions, and 2023’s DELETE Act, sponsored by Senator Josh Becker, which will allow Californians to delete their data held by brokers through a single interface.
See our blog post on the DELETE Act and on further amendments to the DELETE Act.
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized, boutique law firm that provides counseling exclusively on global privacy, data security, and AI law. Its attorneys and data consultants support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of privacy, data security, and AI law.
Clara De Abreu E Souza is an Associate at Hintze Law PLLC. She has experience with artificial intelligence, data privacy, and the regulation of emerging technologies, including evolving state and federal privacy laws, algorithmic accountability, and health data governance.