What California’s New Immigration-Worker Privacy Law Actually Does — And What Comes Next

By Thomas M. Lee 

Governor Gavin Newsom signed Assembly Bill 2624 on Saturday, August 22, extending new privacy protections to workers and volunteers at nonprofits that help immigrants navigate the legal system. The law is narrowly drawn but has already become a flashpoint in a broader fight over where personal-safety protections end and constitutionally protected speech and journalism begin. Here is a closer look at what the law actually contains, why it took the shape it did, and what it means both for California and for the immigrant communities it is meant to serve.

The core protection: address confidentiality

At its center, AB 2624 folds immigration-service workers into California’s Safe at Home program, an address-confidentiality system that has been in place since 1999. Safe at Home originally covered domestic violence survivors and was later expanded to include reproductive- and gender-affirming-care workers. Under the new law, employees, volunteers, and providers at qualifying legal clinics, nonprofit offices, and immigration-focused health facilities can apply to the Secretary of State for a government-issued substitute address, keeping their home address out of public records. To qualify, an applicant must show — through an employer statement, a sworn personal certification, or an existing restraining order — that they or their workplace experienced threats, harassment, or violence connected to the job within the past year.

Amendments added before final passage go a step further, allowing protected workers to demand in writing that the Secretary of State’s office not post their personal information or image online at all, giving them an additional layer of control beyond the substitute-address mechanism itself.

The narrower, and more legally significant, piece

The provision drawing the most scrutiny is the one attaching penalties to the publication of a covered worker’s information or image. As amended, the law applies only when someone acts with “specific intent” to threaten a person or to incite others to harm them in a way that would cause “objectively reasonable fear for their personal safety.” That intent requirement was added specifically in response to concerns that an earlier, broader version of the bill could sweep in ordinary reporting, criticism, or fraud investigations aimed at immigration nonprofits. Violations carry fines generally ranging from $10,000 to $50,000, along with potential sentences from a year in county jail up to state prison time.

Timeline and cost

Implementation was pushed back from January to October 1, 2027, giving the Secretary of State’s office additional time to stand up the expanded confidentiality program. A Senate analysis estimated the buildout would cost about $290,000 initially, followed by roughly $154,000 annually for staffing, outreach, training, and policy administration. Because the law does not take effect until after Newsom leaves office under term limits, it will fall to his successor’s administration to implement it and to defend it in court.

The bill’s political backstory

AB 2624 was introduced in February by Assemblymember Mia Bonta, following testimony describing an escalation of hate calls, stalking, and threats against immigrant-service organizations. It passed through six policy committees, two fiscal committees, and full floor votes in both chambers. Republican Assemblyman Carl DeMaio of San Diego made three separate procedural attempts to block the bill from reaching a floor vote, all of which failed, and gave the bill its widely used nickname, “the Stop Nick Shirley Act,” after independent journalist and YouTuber Nick Shirley, whose videos alleging fraud at immigration-adjacent nonprofits in Minnesota and later in San Diego drew national attention. Shirley and his supporters argue the bill was crafted in direct response to his reporting; Bonta and the bill’s supporters reject that framing, describing it instead as a response to a documented pattern of threats against nonprofit staff.

A challenge already in court — and why it didn’t succeed, yet

A constitutional challenge to AB 2624 reached federal court even before the bill became law. The case, Creel v. Bonta, was filed by a self-represented plaintiff, Chad Creel, who has been described in court filings as a vexatious litigant. U.S. District Judge Dena M. Coggins dismissed Creel’s First and Fourteenth Amendment claims on August 5, ruling that the claims were premature: at the time, AB 2624 had not yet been signed into law, and any threatened prosecution under it was speculative. That dismissal does not resolve the underlying constitutional questions — it simply means no court has yet ruled on the merits, and a properly timed challenge, brought after the law takes effect, remains possible.

Where the law may still be vulnerable

Eugene Volokh, a senior fellow at the Hoover Institution and professor emeritus at UCLA School of Law, has said the statute as amended appears to track categories of speech the Supreme Court has already excluded from First Amendment protection: incitement, meaning speech intended to and likely to cause imminent illegal conduct, and true threats, meaning speech intended to place someone in reasonable fear of illegal conduct. Because those categories are already unprotected, a law that reaches only them is on firmer constitutional ground than one that reaches speech more broadly.

But Volokh has also pointed to a different, less obvious vulnerability: the law protects immigration-service workers specifically, without extending the same protection to other groups who may face comparable hostility and threats. He cited R.A.V. v. City of St. Paul, a 1992 Supreme Court case in which the justices struck down a hate-speech ordinance for discriminating among viewpoints even within an otherwise unprotected category of speech — cross-burning intended to intimidate based on race, in that case. The concern is that a law singling out threats against one specific class of worker, rather than prohibiting true threats and incitement generally, could be read as a form of viewpoint or subject-matter discrimination, even though the underlying conduct it targets is not protected speech to begin with. That is a more technical and less predictable line of attack than a straightforward incitement challenge, and it is the argument most likely to resurface once the law is actually in effect and a plaintiff with standing brings a case.

What it means for California

For the state, AB 2624 represents a modest but real expansion of an existing privacy infrastructure, not a new legal framework. The Secretary of State’s office will need to build out capacity to process applications, verify documentation, and manage a growing confidentiality program, at an ongoing cost the state has already priced into its budget projections. The law also puts California in the position of testing, once again, how far a state can go in carving out specific protected categories of speech-adjacent conduct — threats and incitement — for the benefit of one class of worker without inviting an equal-protection or viewpoint-discrimination challenge down the line. That question likely won’t be settled until a case is filed after the law’s 2027 effective date, when a court can no longer dismiss the claims as premature the way Judge Coggins did with Creel v. Bonta.

What it means for immigrants and the workers who serve them

For the immigration nonprofits, legal clinics, and health providers the law is designed to protect, AB 2624 offers a concrete, if delayed, tool: the ability to keep a home address off public records and to formally demand that the state not publish personal information or images tied to their work. Supporters argue this matters directly for the safety of the people these organizations serve — workers who feel physically exposed are less able to do outreach, represent clients, or operate clinics openly, and a documented pattern of harassment can discourage nonprofits from taking on politically sensitive casework in the first place. Whether the law meaningfully changes that dynamic will depend heavily on how the “specific intent” standard is applied in practice once prosecutions or civil enforcement actions actually begin after 2027, and on whether the law survives the constitutional challenge that Volokh’s analysis suggests is still likely to come.

Legal Disclaimer and Contact Information

The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice. Reading this material does not create an attorney-client relationship. Every case involves unique facts, and individuals seeking guidance on their case should consult an experienced attorney for legal advice. For a free phone consultation with

Attorney Thomas Lee, please call (213) 251-5533.