• by Wendy Davis , February 25, 2026

A new California bill would give tech company employees and contractors financial incentives to report violations of the state's privacy law.

If enacted, the proposed Whistleblower Protection and Privacy Act (AB 2021), introduced this week by Assemblymember Pilar Schiavo and sponsored by the California Privacy Protection Agency, could result in payments to whistleblowers of up to one-third of fines collected through enforcement actions or settlements.

People would only be eligible for the monetary awards if they provided "original information" -- meaning information based on independent knowledge or analysis, as opposed to information from court proceedings, government investigations or the media.

The bill includes provisions prohibiting companies from retaliating against whistleblowers.

California's privacy law gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites. The law also gives consumers the right to learn what personal information has been collected about them by companies, have that information deleted, and prevent the sale or transfer of that data to third parties.

That law "is only as good as the enforcement," Schiavo said Tuesday at a press conference.

"Not everyone plays by the rules and frankly what happens in the shadows is frightening," she said.

Tom Kemp, executive director of the California Privacy Protection Agency, added that whistleblowers are "critical for identifying privacy violations" due to the hidden nature of companies' data practices.

"The reality today is that most data collection and data processing happens in a corporate black box," Kemp said. "It is hard to detect privacy violations when we don't know what is happening inside a business, and violations we can't see, we can't fix."

Advocacy group Consumer Reports supports the legislation.