California AB 2298 cybersecurity curriculum (2026)

California — AB 2298: Cybersecurity Concepts Added to Recommended School Curricula So Young People Learn to Safeguard Their Own Personal Data (Signed September 10, 2026)
California · Cal. A.B. 2298 (2025-2026 Reg. Sess.) — cybersecurity concepts in recommended school curricula (signed September 10, 2026)

Status
Enacted (not yet in effect)
Applies to
No compulsory obligation identified; California school districts may adopt the recommended curricula, and state education agencies maintain the recommendations
Enforced by
California Department of Education (curriculum recommendations)

California Assembly Bill 2298 adds cybersecurity concepts to RECOMMENDED school curricula, so that young people learn how to safeguard their own personal data. Governor Newsom signed it on September 10, 2026, and the Electronic Frontier Foundation publicly supported it as one of the 'constitutional, empowering solutions' in a package it otherwise partly opposed. The word RECOMMENDED is doing significant work and this entry records it at limited strength for that reason. A recommended curriculum is not a required one: districts may adopt it, and many will, but nothing in the located coverage indicates a mandate, a compliance deadline or a funding mechanism. Compared with AB 2071 in the same package, which INTEGRATES digital wellness into health classes that students already take, AB 2298 is the weaker instrument — a state endorsement of content rather than a guarantee that any particular student encounters it. It is recorded here nonetheless because the pairing matters: California's response to children and technology in September 2026 combined restriction, liability and education, and the education half is routinely omitted from accounts of the package.

Who is protected: California students in districts that adopt the recommended cybersecurity curricula

Legal detail

State of California — ASSEMBLY BILL 2298, signed by Gov. Gavin Newsom on September 10, 2026. OPERATIVE EFFECT: adds CYBERSECURITY CONCEPTS to RECOMMENDED SCHOOL CURRICULA, directed at teaching young people how to SAFEGUARD PERSONAL DATA. strength IS `limited` DELIBERATELY: the located source describes the curricula as RECOMMENDED, not required. No mandate, compliance deadline, funding mechanism or accountability measure is identified in any located source, so the statute's practical reach depends entirely on voluntary district adoption. CONTRAST WITHIN THE SAME PACKAGE: California AB 2071 digital wellness curriculum (2026) INTEGRATES digital wellness into middle and high school HEALTH CLASSES \u2014 a course students already take \u2014 whereas AB 2298 endorses content without placing it anywhere compulsory. Where AB 2071 reaches the general student population by placement, AB 2298 reaches whoever a district elects to reach. ENDORSEMENT: publicly SUPPORTED by the ELECTRONIC FRONTIER FOUNDATION as among the 'constitutional, empowering solutions' in the package, against its opposition to AB 1709. WHY IT IS INDEXED DESPITE BEING WEAK: accounts of California's September 2026 action consistently describe restriction and liability and omit the education component; recording both halves keeps the package legible. STATUS IS `enacted` NOT `effective`, effective_date NULL \u2014 no operative date or phase-in schedule located. NOT PRESENT IN THIS DATASET IN ANY FORM before this pass.

Key facts

JurisdictionCalifornia
LevelState
StrengthLimited
EnactedSeptember 10, 2026
CitationCal. A.B. 2298 (2025-2026 Reg. Sess.) — cybersecurity concepts in recommended school curricula (signed September 10, 2026)
Private right of actionNo, agency enforcement only
PenaltiesNone — the curricula are recommended rather than required
Topicseducation AI · children's online safety · consumer data privacy · government use of AI
Legal analysisGovernor Newsom Signs Student-Backed Digital Literacy Bills Alongside Misguided Bans — Electronic Frontier Foundation

More AI rules in California

Related education AI rules elsewhere

See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.