Stop Nick Shirley Act (AB 2624): Immigration Law Firm Perspective

Background

On August 22, 2026, Governor Gavin Newsom signed Assembly Bill 2624. It adds Chapter 3.26 (commencing with Section 6218.10) to Division 7 of Title 1 of the California Government Code. The author’s office has called it the “Safe at Work Act” but some press coverage refers to it by a different name, the “Stop Nick Shirley Act.” This article explores why many groups are urging legislators to stop Nick Shirley Act AB 2624 from becoming law.

The bill was authored by Assemblymember Mia Bonta and sponsored by the Coalition for Humane Immigrant Rights of Los Angeles (CHIRLA), with more than twenty immigrant-rights, legal-services, labor, and medical organizations registered in support. Opposition was narrow but consistent, principally from California Baptists for Biblical Values, and rested on the argument that the law would shield publicly funded organizations from journalistic scrutiny. It passed both houses on largely party-line votes, clearing the Assembly floor 57–19.

The law does two distinct things:

1. It creates a new Secretary of State address-confidentiality program, a fourth iteration of California’s long-running Safe at Home program, for people who provide, assist in providing, or receive immigration support services and who fear for their safety because of that affiliation.
2. It creates new anti-doxxing prohibitions and private causes of action aimed at internet publication, disclosure, distribution, solicitation, sale, or trade of those people’s personal information or images, where the publisher acts with specific intent to incite imminent great bodily harm or to threaten.

The law becomes operative October 1, 2027 (Gov. Code § 6218.21), and the Secretary of State begins accepting applications October 1, 2027 (§ 6218.17(e)(2)). Nothing in Chapter 3.26 is enforceable before that date. Fiscally, AB 2624 is estimated at approximately $290,000 in year one and $154,000 annually thereafter, covering staffing, outreach, training, intake forms, system updates, translation, and postage.

On September 4, 2026, investigative journalist Nicholas Shirley filed a pre-enforcement constitutional challenge in the United States District Court for the Eastern District of California, Shirley v. Bonta, No. 2:26-at-01477, against Attorney General Rob Bonta and Secretary of State Shirley N. Weber in their official capacities. The complaint pleads five counts: facial and as-applied First Amendment claims, overbreadth, Fourteenth Amendment vagueness, and an Ex Post Facto Clause claim. As of this writing, no motion for preliminary injunction, answer, or ruling appears in the materials available to us. The statute is on the books and nothing has been enjoined.

Where Does AB 2624 Come From?

The Safe at Home

California’s Safe at Home address confidentiality program has existed since 1998. Under this program, the state gives a qualifying person a substitute address designated by the Secretary of State, and state and local agencies must accept that substitute address in place of the person’s real residential address when creating or maintaining public records. The Secretary of State receives and forwards the participant’s first-class mail.

The program has been expanded in layers. It began with survivors of domestic violence, sexual assault, stalking, and human trafficking. It was later extended to reproductive health care providers, employees, volunteers, and patients and, more recently, to gender-affirming health care. Alongside those enrollment programs, the legislature built a parallel set of anti-doxxing prohibitions, first civil-only in 2006 and later carrying criminal penalties, aimed at internet publication of protected persons’ information with intent to facilitate violence.

AB 2624 is the next layer. It borrows the reproductive-health architecture almost verbatim and applies it to a new class: people connected to immigration support services. Because it is built on a two-decade-old template, much of its structure is familiar, and much of the operational guidance the Secretary of State has developed for the existing tracks will carry over. The Legislature made this explicit: § 6218.17(c) directs the Secretary of State to administer this chapter “together with and in the same manner as” the existing programs in Chapters 3.1 and 3.2.

The legislative findings

Section 6218.10 states the Legislature’s rationale in two parts. First, the Legislature finds that people providing support services to the immigrant community “have been subject to harassment, threats, and intimidation for their work.” Second, it finds that such workers “have faced doxxing, courthouse targeting, online harassment, anti-immigrant vigilante threats, and coordinated campaigns and death threats,” and that these acts “have risen to alarming levels in 2025 and will continue due to the current federal administration’s anti-immigration attitude and policies.”

Separately, Section 2 of the act makes findings under Article I, Section 3 of the California Constitution, the provision requiring the Legislature to justify any statute limiting public access to the writings of public officials and agencies. The legislature found that keeping these individuals’ home addresses confidential is necessary to prevent acts of violence. Section 3 addresses state-mandated local costs and states that no reimbursement is required in part because the act “creates a new crime or infraction.”

Who is Covered?

This is the single most important structural feature of AB 2624, and it is easy to miss on a first read. The statute protects two overlapping but different groups, and the protections available to each are different.

Tier 1: The definitional class (no enrollment required)

Section 6218.11(c) defines a “designated immigration support services provider, employee, or volunteer” as:

“a person who provides, assists in providing, or receives immigration support services at a designated immigration support services facility.”

Note the third verb, “receives.” The defined term is not limited to workers despite its name. On the face of the statute, a person who receives immigration support services at a covered facility (that is, a client) falls within the defined class.

Section 6218.11(b) defines “designated immigration support services” expansively: “services provided to the immigrant population, including, but not limited to, legal representation, legal assistance, advocacy, case management, humanitarian relief, immigration resources, referrals, translation services, counseling services, and health care.”

Section 6218.11(d) defines a “designated immigration support services facility” as “a facility where immigration support services are provided, including, but not limited to, nonprofit organizations’ offices, Department of Justice-recognized entities, community legal clinics, law offices, accredited representative sites that provide immigration legal services, and health care facilities.”

Since private immigration law firms are expressly named, there is no question about eligibility for a firm like ours, or for the great majority of practitioners reading this.

The protections keyed to this definitional class, meaning they apply whether or not the person ever enrolls in anything, are:

• § 6218.19(a): the prohibition on knowingly publicly posting, displaying, disclosing, or distributing personal information or images on the internet with the specified intent, and the private causes of action attached to it;
• § 6218.19(c): the prohibition on soliciting, selling, or trading such information on the internet with the specified intent, and its damages remedy;
• § 6218.20: the prohibition on posting personal information or images with the specific intent that another person imminently use it to commit a violent crime.

Tier 2: Program participants (enrollment required)

A “program participant” is a person the Secretary of State has certified under § 6218.12. The protections keyed to participant status are:

• § 6218.15: the substitute address itself, and the obligation of state and local agencies to accept it;
• § 6218.16: confidential voter registration under Elections Code § 2166.5;
• § 6218.18: the prohibition on knowingly posting the home address of a program participant, or the participant’s residing spouse or child;
• § 6218.19(b): the written “do not disclose” demand, which is available only to a program participant.

The gap between the tiers and what it means for clients

Here is the consequence, and it is not obvious from any summary of this bill we have seen: Tier 1 sweeps in clients. Tier 2 does not.

Section 6218.12(a)(1)(A) requires every applicant to submit “documentation showing that the individual is to commence employment or is currently employed as a provider or employee at a designated immigration support services facility or is volunteering at a designated immigration support services facility.” A client who receives services has no such documentation and cannot produce it. There is no separate application pathway for recipients.

So the practical answer to “how are our clients affected?” is:

• Clients appear to be within the protected class for the anti-doxxing provisions of §§ 6218.19(a), 6218.19(c), and 6218.20. That includes the private right of action for injunctive and declaratory relief with mandatory costs and fees, and the damages remedy of up to treble actual damages with a $4,000 statutory floor.
• Clients cannot enroll in the address confidentiality program, and therefore cannot obtain a substitute address, cannot register to vote confidentially under this chapter, cannot invoke § 6218.18’s home-address prohibition, and cannot serve a § 6218.19(b) written demand.

One genuine open question remains. Section 6218.11(c) says “receives immigration support services at a designated immigration support services facility.” Whether a client who is served entirely remotely (by video consultation, phone, or secure portal) is receiving services “at” a facility is not answered by the text. Post-2020 immigration practice is substantially remote. Until the Secretary of State’s rules or a court addresses it, we would not tell a fully remote client that the answer is settled. It is a real ambiguity, and it is one of several places where the challengers’ vagueness argument has textual purchase.

How does the address confidentiality program actually work?

Who may apply and how (§ 6218.12)

An adult domiciled in California, a parent or guardian acting for a minor, or a guardian acting for an incapacitated person may apply. Three procedural features are worth flagging immediately for anyone planning around this:

1. The application must be completed in person at a community-based assistance program designated by the Secretary of State. § 6218.12(a). This is not an online form.
2. The applicant must meet with a counselor and receive program orientation as part of the application process. § 6218.12(a).
3. Applications are filed with the office of the Secretary of State. § 6218.12(b).

The documentation an applicant must produce

Under § 6218.12(a)(1), an applicant relying on affiliation with a facility must submit:

(A) Employment or volunteer documentation: proof the person is employed, is about to commence employment, or is volunteering at a designated facility.

(B) One of three showings. This is a choice, not a checklist:

• (i) A facility certification. A certified statement signed by a person authorized by the facility stating that the facility, or any of its providers, employees, or volunteers, is or was the target of threats, harassment, or acts of violence or harassment within one year of the application date. Note the breadth: the certification may rest on the targeting of the facility or any of its people, not necessarily the applicant. A person who willfully certifies as true any material matter under this section knowing it to be false is guilty of a misdemeanor.
• (ii) A self-certification. A certified statement signed by the provider, employee, or volunteer stating that they personally have been the target of threats, harassment, or acts of violence within one year because of their association with the facility. The same misdemeanor provision applies. Practically, this means an individual attorney or staff member who has personally been targeted does not need firm leadership to sign anything.
• (iii) A restraining order. A workplace violence restraining order under Code of Civil Procedure § 527.8, or a civil harassment restraining order under § 527.6, issued after a noticed hearing, protecting the applicant, based on threats or acts of violence connected with the facility. Ex parte temporary orders do not satisfy this subdivision by its terms.

(C) A sworn statement that the applicant fears for their own safety, their family’s safety, or the safety of the minor or incapacitated person on whose behalf the application is made, due to affiliation with the facility.

Volunteers must additionally provide facility documentation showing the length of time the volunteer has committed to working at the facility. § 6218.12(a)(2).

Designation of the Secretary of State as agent for service of process

Section 6218.12(a)(3) requires every application to designate the Secretary of State as the participant’s agent for service of process and receipt of mail. The mechanics:

• Service is made by delivering two copies of the summons, writ, notice, demand, or process to the address confidentiality program personnel at the Secretary of State’s office. § 6218.12(a)(3)(A).
• The Secretary of State must forward a copy so that the participant receives it within three days. § 6218.12(a)(3)(B).
• The Secretary of State keeps a record of all process served and the time of service. § 6218.12(a)(3)(C).
• The Secretary of State and its personnel are held harmless from liability arising out of handling participants’ first-class mail. § 6218.12(a)(3)(D).

Litigators should note this runs both ways. It is how an enrolled staff member gets served, and it is how you serve an enrolled adverse party or witness in an unrelated matter.

Fees, funds, and certification terms

• Fees. The Secretary of State sets an application fee not to exceed the reasonable costs of enrolling, and may assess annual maintenance fees, which are also used to reimburse the General Fund for amounts expended on the program. § 6218.12(c). The amount is not set in the statute.
• Fund. The act creates the Address Confidentiality for Immigration Support Services Fund in the General Fund; money are available for program administration upon appropriation by the Legislature. § 6218.12(d).
• Term. Certification runs four years from filing, unless withdrawn or invalidated. Volunteers are certified only until six months from their last date of volunteering. A minor participant who turns 18 may renew as an adult. The Secretary of State establishes the renewal procedure by rule. § 6218.12(e).
• False application misdemeanor. A person who knowingly and falsely attests that disclosure of the address would endanger safety, or who knowingly provides false or incorrect information in an application, is guilty of a misdemeanor. A bold-type notice of this penalty must appear conspicuously on the application form. § 6218.12(f).

What the substitute address does (§ 6218.15)

• A participant may request that state and local agencies use the Secretary of State’s designated address. When creating a public record (§ 6218.15(a)) and when modifying or maintaining one (§ 6218.15(b)), agencies shall accept the substitute address, subject to an exception discussed.
• § 6218.15(b) expressly excludes records of birth, fetal death, death, or marriage registered under Division 102 of the Health and Safety Code. Vital records are outside the shield.
• A participant may use the designated address as the participant’s work address. § 6218.15(c).
• The Secretary of State forwards all first-class mail and all mail sent by a governmental agency, and may in its discretion refuse to handle or forward packages. § 6218.15(d).
• DMV records are not automatically suppressed. Section 6218.15(e) requires participants seeking suppression of DMV records to comply with Vehicle Code § 1808.21(d) and with all other Vehicle Code address-reporting obligations. There is no standalone DMV program created by this act; it is a cross-reference to the existing mechanism.

Confidential voter registration (§ 6218.16)

A participant otherwise qualified to vote may register and vote confidentially under Elections Code § 2166.5.

Disclosure by the Secretary of State, assistance agencies, and required notices (§ 6218.17)

• § 6218.17(a): the Secretary of State may not make a participant’s real address available for inspection or copying except: (1) if requested by a law enforcement agency, to that agency; (2) if directed by a court order, to a person identified in the order; or (3) if certification was terminated under § 6218.14(b)(2).
• § 6218.17(b): the Secretary of State designates state, local, and nonprofit agencies that may assist applicants, and provides that “any assistance and counseling rendered by the office of the Secretary of State or its designees to applicants shall in no way be construed as legal advice.”
• § 6218.17(d): the Secretary of State must give every participant a clear and conspicuous notice covering four things: (1) the right to use the designated address on real property deeds, change-of-ownership forms, and deeds of trust when buying or selling a home; (2) the option to create a revocable living trust to hold real property and keep the residential address out of real-property records; (3) the option to obtain a legal name change for anonymity; and (4) a referral list (county bar associations, legal aid societies, state and local agencies, and nonprofits) for help with trusts and name changes.
• § 6218.17(e): reporting. An annual report to the Legislature by January 10 of each year covering total applications, participants by county, and any allegations of election-related misuse. Applications open October 1, 2027. A one-time report by January 1, 2030 on mail volume, participant counts, average duration of participation, and recommended code changes.

Termination, cancellation, and appeal (§§ 6218.13, 6218.14)

• Mandatory cancellation. The Secretary of State shall cancel certification of a participant who fails to disclose a change in employment status, or termination as a provider or volunteer. § 6218.13(a).
• Records retention. After termination, records are held confidential and retained three years, then destroyed without further notice. § 6218.13(b).
• Voluntary withdrawal. A participant may withdraw by written notice plus return of the identification card; certification terminates on receipt. § 6218.14(a).
• Discretionary termination (§ 6218.14(b)) for: (1) expired certification not renewed; (2) false information used in the application, or use of the program “as a subterfuge to avoid detection of illegal or criminal activity or apprehension by law enforcement”; (3) no longer residing at the address on file without at least seven days’ prior written notice of the change; (4) forwarded process or mail returned as nondeliverable; (5) failure to disclose a change in employment or termination as volunteer or provider; (6) a participant who turns 18 and does not renew within 60 days.
• Abandoned domicile. The Secretary of State may refuse renewal if the participant or the guardian has abandoned California domicile. § 6218.14(c).
• Appeal. Written notice of intended termination, and 30 business days to appeal under procedures the Secretary of State develops. § 6218.14(d).
• Downstream notice. The Secretary of State notifies the county elections official, county clerk, and county recorder of any withdrawal, invalidation, expiration, or termination; those agencies transmit records back and are no longer responsible for maintaining confidentiality. § 6218.14(e)–(f).
• Disclosure after fraud-based termination. Following termination under § 6218.14(b)(2), the Secretary of State may disclose information contained in the participant’s application. § 6218.14(g).

What this program does not do

If a client or a colleague reads only one section of this article, we would want it to be this one. Address confidentiality programs are routinely oversold, and in an immigration practice the consequences of overselling one are severe.

The law firm is not the participant

This program protects natural persons. It does not protect the organization. Every operative provision is written in individual terms. Section 6218.12(a) opens the program to “[a]n adult person, a parent or guardian acting on behalf of a minor, or a guardian acting on behalf of an incapacitated person, who is domiciled in California”, and “domicile” is defined by reference to a place of habitation under Elections Code § 349 (§ 6218.11(e)). 6218.11(a) defines “address” as a residential, school, or work address “of an individual.” Section 6218.11(c) protects “a person who provides, assists in providing, or receives” services. A law firm, a nonprofit, or a DOJ-recognized entity cannot be domiciled, cannot apply, and cannot be certified.

The consequences are concrete:

• The firm’s office address is not protected by this statute. It remains fully public: in bar directories, on court filings, in Secretary of State business filings, on the firm’s own website, and everywhere else it already appears. Nothing in Chapter 3.26 changes that.
• The firm has no substitute address and no enrollment. The only address-related benefit at the office level is indirect: § 6218.15(c) permits an enrolled individual to use their own substitute address as their work address. That is the individual’s election about the individual’s records; it is not institutional protection.
• What the firm actually holds under this chapter are three roles, not a shield: certifier under § 6218.12(a)(1)(B)(i), documenter of employment and volunteer commitments under § 6218.12(a)(1)(A) and (a)(2), and potential plaintiff on behalf of a covered individual under § 6218.19(a)(2).

This distinction is worth keeping in mind because the best-documented harm in the legislative record cuts exactly across it. One San Francisco organization responded to a doxxing campaign by removing its own address and staff information from its website, and thereby became harder for clients to reach. AB 2624 would not have prevented that. The statute protects the home addresses of individuals; it does nothing about an organization’s decision to go dark to protect its people. Any firm reading this law as institutional cover has misread it.

The remaining limits

It is not confidential as against law enforcement. Section 6218.17(a)(1) permits the Secretary of State to release a participant’s real address to a law enforcement agency on request. There is no warrant requirement, no notice-to-participant requirement, and no judicial gatekeeping in the text. This is a limitation, not a loophole (the existing Safe at Home tracks work the same way), but it must be explained accurately to anyone considering enrollment.

It yields to a court order. Section 6218.17(a)(2) permits disclosure to a person identified in a court order. Enrollment is not a privilege and does not defeat a subpoena or a discovery order.

It is not a shield against federal immigration authorities. This is a California statute binding California state and local agencies. It does not bind U.S. Immigration and Customs Enforcement, U.S. Citizenship and Immigration Services, Customs and Border Protection, the Executive Office for Immigration Review, or any other federal agency. It does not change what appears on a Form G-28, an I-589, an EOIR-28, or a change-of-address filing. Nothing in Chapter 3.26 alters a noncitizen’s federal address-reporting obligations. Any advice suggesting otherwise would be seriously wrong.

Agencies can refuse the substitute address in defined circumstances. Sections 6218.15(a) and (b) both contain the same exception: an agency need not accept the substitute address where the Secretary of State determines both that (1) the agency has a bona fide statutory or administrative requirement for the real address, and (2) the address will be used only for those purposes and will not be publicly disseminated.

Vital records are carved out. Birth, fetal death, death, and marriage records registered under Division 102 of the Health and Safety Code are expressly excluded from § 6218.15(b).

DMV suppression is a separate process. § 6218.15(e); Veh. Code § 1808.21(d). Committee analyses during the bill’s passage described a companion DMV “Protected Records Program” estimated at roughly $325,000 annually against a strained Motor Vehicle Account. The chaptered text creates no such program. Section 6218.15(e) does nothing more than cross-reference the existing suppression mechanism and require participants to comply with it. That is a reminder that where the legislative summaries and the enacted statute diverge, the statute controls.

Misuse terminates the protection and unseals the file. If the Secretary of State determines the program is being used “as a subterfuge to avoid detection of illegal or criminal activity or apprehension by law enforcement,” certification is terminated under § 6218.14(b)(2), and § 6218.14(g) then permits disclosure of the information contained in the application. Anyone advising an enrollee should read those two provisions together.

It does not retroactively scrub existing records. The obligation in § 6218.15 runs to agencies creating, modifying, or maintaining public records going forward. It is not a right to have a historical record purged, and it has no effect at all on private data brokers, people-search sites, or previously published material, except to the extent a § 6218.19(b) written demand reaches a specific recipient.

It is not immunity from scrutiny. Address confidentiality protects a home address. It does not, and should not be presented as though it does, affect the ability of clients, State Bar regulators, opposing counsel, courts, funders, or journalists to examine a firm’s case handling, fee practices, competence, or compliance. Our own view is that the profession should say this out loud and often, precisely because the contrary suggestion is the core of the case against the statute.

Rights under AB 2624

§ 6218.18: Posting a program participant’s home address

A person, business, or association shall not knowingly post the home address of a program participant, or of the participant’s residing spouse or child, on the internet, knowing the person is a participant or a participant’s residing spouse or child, and specifically intending to incite a third person to cause imminent great bodily harm that is likely to occur imminently, or threatening to cause imminent great bodily harm. § 6218.18(a).

Section 6218.18(b) exempts an interactive computer service or access software provider as defined in 47 U.S.C. § 230(f) unless the service or provider itself acts with the specified intent.

Our observation. Section 6218.18 states a prohibition but attaches no remedy within the section. The causes of action in this chapter live in § 6218.19, and § 6218.19’s remedies are keyed to violations of § 6218.19’s own subdivisions. Whether § 6218.18 is enforced through § 6218.19, through a default misdemeanor, through negligence per se, or through injunctive relief on some other footing is not resolved on the face of the chapter. This is worth watching.

§ 6218.19(a): Publicly posting, displaying, disclosing, or distributing personal information

The prohibition. A person, business, or association shall not knowingly publicly post or publicly display, disclose, or distribute on the internet the personal information or image of any designated immigration support services provider, employee, or volunteer (remember, that defined term includes recipients) or other individuals residing at the same home address, with the specific intent to either:

• (A) incite a third person to cause imminent great bodily harm to that person or a coresident, where the third person is likely to commit this imminent harm; or
• (B) threaten that person or a coresident in a manner that places them in objectively reasonable fear for their personal safety.

The remedies (§ 6218.19(a)(2)). The covered individual, or any individual, entity, or organization authorized to act on their behalf, may do either or both of the following:

• (A) Bring an action for injunctive or declaratory relief. On a finding of violation, the court may grant that relief and shall award the successful plaintiff court costs and reasonable attorney’s fees. The fee-shift is mandatory and one-way in the plaintiff’s favor.
• (B) Bring an action for money damages. On a finding of violation, the court shall award damages up to a maximum of three times actual damages, but in no case less than $4,000.

Two features practitioners should note.

First, the § 6218.19(a) cause of action is not limited to enrolled program participants. It runs to anyone within the § 6218.11(c) definition. An Assembly Judiciary analysis during the bill’s passage recommended narrowing the private right of action to actual enrollees; the enacted text did not adopt that narrowing. The practical consequence is significant: on October 1, 2027, every attorney, paralegal, receptionist, interpreter, and volunteer at a covered facility (and, on the face of the definition, every client) has this cause of action without enrolling in anything.

Second, an organization authorized to act on the individual’s behalf may bring the action. A firm can litigate on behalf of a targeted staff member, subject to the ordinary rules on standing, real party in interest, and conflicts.

§ 6218.19(b): The written “do not disclose” demand

A program participant (this one is limited to enrollees) or an authorized representative may make a written demand to a person, business, or association not to publicly post, display, disclose, or distribute the participant’s personal information or image on the internet. § 6218.19(b)(1).

A recipient of such a demand shall not thereafter publish with the specific intent described in subdivision (a). § 6218.19(b)(2).

Required contents (§ 6218.19(b)(3)): a statement declaring that the participant is subject to the protection of this chapter, and describing the reasonable fear the participant or coresident has for their safety. The demand is effective for four years, regardless of whether the participant’s affiliation with the facility expires during that period.

Remedy (§ 6218.19(b)(4)): injunctive or declaratory relief, plus mandatory court costs and reasonable attorney’s fees to a successful plaintiff.

Read carefully: the demand does not convert protected speech into unprotected speech. Subdivision (b)(2) still requires the same specific intent as subdivision (a). What the demand adds is notice, and, realistically, evidentiary weight on the intent question. That is not nothing, but it is less than the phrase “do not disclose demand” suggests.

§ 6218.19(c): Soliciting, selling, or trading personal information

A person, business, or association shall not solicit, sell, or trade on the internet the personal information or image of a covered individual with the same specific intent. § 6218.19(c)(1). The remedy is damages: up to treble actual damages, minimum $4,000. § 6218.19(c)(2). Note this subdivision provides damages but does not carry the express fee-shift found in subdivision (a)(2)(A) and (b)(4).

§ 6218.19(d)–(e): Platform carve-out and non-exclusivity

An interactive computer service or access software provider under 47 U.S.C. § 230(f) is not liable under § 6218.19 unless it itself acts with the specified intent. § 6218.19(d). And the section “does not preclude punishment under any other provision of law.” § 6218.19(e).

§ 6218.20: Posting with intent that another commit a violent crime

“It is unlawful for a person to post on the internet, with the specific intent that another person imminently use that information to commit a crime involving violence or a threat of violence that is likely to occur against a designated immigration support services provider, employee, or volunteer, or other individuals residing at the same home address, the personal information or image of [such a person].”

Subdivision (b) provides that nothing in the section precludes prosecution under any other provision of law.

Is this a crime, and what is the penalty? The chaptered text says “unlawful” and specifies no penalty. Reconstructing the answer requires three steps:

1. The Legislative Counsel’s Digest for AB 2624 states that “by imposing new duties on local agencies and creating new crimes, this bill would create a state-mandated local program.”
2. Section 3 of the act declines mandate reimbursement in part because “this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code.”
3. Under California’s default rules, an act declared unlawful without a specified penalty is generally punishable as a misdemeanor. Those rules are Penal Code § 17’s residual definition of a misdemeanor and Penal Code § 19, which supplies up to six months in county jail and a $1,000 fine “except in cases where a different punishment is prescribed.”

We present that as a reconstruction, not a certainty, because the operative section itself is silent.

The only unambiguous criminal provisions in this chapter, §§ 6218.12(a)(1)(B)(i), (ii) and 6218.12(f), are misdemeanors that apply to applicants and to the people who sign facility certifications. In other words, the clearest criminal exposure created by this statute runs against immigration legal service providers themselves, not against publishers. That is not an argument for or against the law. It is a fact about the statute that every firm considering enrollment should absorb.

Responsibilities

As we explained, a firm cannot enroll itself. Only individuals can. But the statute still puts real obligations on the organization, because the individual application depends on the firm’s paperwork and, in most cases, on the firm’s signature. These are the duties we have identified from the text.

Certification is a sworn act with criminal exposure

Whoever signs a § 6218.12(a)(1)(B)(i) facility certification is attesting, on penalty of misdemeanor for willful false certification of a material matter, that the facility or one of its people was targeted by threats, harassment, or violence within the past year. That certification cannot be boilerplate. It requires:

• a documented factual basis: the specific incident, date, source, and nature of the threat;
• a retained record connecting the certification to that incident;
• a designated, authorized signatory, since the statute requires “a person authorized by the designated immigration support services facility”;
• a contemporaneous incident log, which is far easier to build prospectively than to reconstruct a year later.

Firms that want to be able to certify in October 2027 should be logging incidents now. A log entry costs nothing; reconstructing a year-old threat from memory to support a criminal-liability certification is a different exercise entirely.

Employment and volunteer documentation

Section 6218.12(a)(1)(A) puts the burden of employment or volunteer documentation on the applicant, which in practice means on the firm’s HR function. Section 6218.12(a)(2) additionally requires the facility to document the length of time a volunteer has committed to working there.

Offboarding becomes load-bearing

This is the compliance risk we would rank highest. Under § 6218.13(a), the Secretary of State shall cancel certification of a participant who fails to disclose a change in employment status or termination as a provider or volunteer. Under § 6218.14(b)(5), the same failure is grounds for termination.

That means a departing employee’s home-address confidentiality is contingent on a disclosure that must actually be made. A firm that enrolls staff and then processes a departure without prompting the disclosure has, functionally, created a trap for a former employee. Any firm that enrolls people should build the notification step into its offboarding checklist and should tell enrollees, in writing, that the obligation is theirs.

Related timing rules to track: volunteers lapse six months after their last date of volunteering (§ 6218.12(e)); certifications run four years and require renewal (§ 6218.12(e)); an address change requires seven days’ prior written notice (§ 6218.14(b)(3)); and a participant who turns 18 has 60 days to renew (§ 6218.14(b)(6)).

Helping someone apply is legal work

Section 6218.17(b) provides that assistance and counseling rendered by the Secretary of State or its designees “shall in no way be construed as legal advice.” That disclaimer covers the state and its designated assistance agencies. It does not cover a law firm.

When our firm, or yours, advises a staff member or a client on whether to enroll, what to certify, what the program does and does not protect, and what the immigration consequences of any of it might be, that is legal advice, with the ordinary consequences: engagement scope, fee arrangement, conflicts screening, competence, and malpractice exposure.

Two conflict issues deserve advance thought:

• Firm as employer, individual as applicant. The firm’s interest in what a certification says is not necessarily identical to the employee’s. A certification describing threats to the facility is also a statement about the firm.
• Advising a client on enrollment. Given that clients cannot enroll under § 6218.12 as we read it, the advice most clients need is what the statute does give them (the Tier 1 causes of action) and what it does not. Getting that backwards, in either direction, is a real risk.

Service of process

Enrolled staff are served through the Secretary of State under § 6218.12(a)(3), with a three-day forwarding requirement. Docketing and calendaring practices should account for the fact that the service date and the receipt date are not the same.

Public-facing accuracy

We would apply one more discipline, and we would apply it to ourselves. The strongest argument against this statute is that address confidentiality for a class of organizations can shade into insulation from accountability. The most effective answer available to the profession is not rhetorical. It is behavioral. Do not market Safe at Home enrollment as anything other than what it is: protection for a home address, subject to law enforcement access, court orders, and agency need.

What immigration clients should be told

Consolidating Parts 2 and 4, here is what we believe is accurate to tell clients today:

• This is a California state law. It takes effect October 1, 2027. Right now it changes nothing about your case.
• It does not change any federal immigration requirement. It does not alter what address you must give USCIS, EOIR, or any federal agency, and it does not affect your obligation to report address changes to them.
• It does not hide you from immigration enforcement. The Secretary of State may release a participant’s real address to a law enforcement agency on request and must release it on a court order.
• It may give you a legal remedy if you are doxxed. On the face of § 6218.11(c), a person who receives immigration support services at a covered facility is within the protected class, which would make §§ 6218.19(a), 6218.19(c), and 6218.20 available, including damages of up to three times actual damages with a $4,000 minimum, and attorney’s fees on a successful injunctive claim under § 6218.19(a)(2)(A). Whether that extends to a client served entirely remotely is unresolved.
• You cannot enroll in the address confidentiality program based on being a client. The application requires proof of employment or volunteer status.
• Other tools may already be available to you, and they are separate from this law. California has a general anti-doxxing provision at Civil Code § 1708.89 that is not limited to any profession, though it carries its own intent requirements that would have to be met. Ask counsel whether your situation fits it. The domestic violence, sexual assault, stalking, and human trafficking track of Safe at Home (Gov. Code § 6205 et seq.) may be available to some clients on entirely independent grounds and is open now, not in 2027. And the federal confidentiality protections for VAWA, T, and U applicants at 8 U.S.C. § 1367 operate on federal agencies and are neither expanded nor limited by this California statute.

Shirley v. Bonta

Complaint Background

Case: Shirley v. Bonta, No. 2:26-at-01477 (E.D. Cal., Sacramento Division), filed September 4, 2026.
Plaintiff: Nicholas (“Nick”) Shirley, described in the complaint as an investigative journalist and independent publisher.
Defendants: Attorney General Rob Bonta and Secretary of State Shirley N. Weber, in their official capacities only.
Counsel: America First Legal Foundation (applications for admission pro hac vice forthcoming per the caption) and JW Howard / Attorneys, Ltd.
Relief sought: declaratory judgment that Gov. Code §§ 6218.11 and 6218.18–6218.21 are unconstitutional; preliminary and permanent injunctions against enforcement “against Mr. Shirley or any other person”; fees under 42 U.S.C. § 1988. Jury trial demanded.

The complaint’s factual narrative

The complaint frames the statute as targeted legislation. Because these are pleaded allegations, sourced in part to news reports we have not independently verified, we set them out as allegations and not as findings:

• The complaint alleges the law “is most commonly known by its colloquial name, the Stop Nick Shirley Act, citing a Sacramento Bee article of August 25, 2026.
• It alleges the plaintiff has roughly 1.99 million YouTube subscribers, 1.7 million followers on X, 3.2 million on Instagram, and 1.6 million on TikTok, and that his reporting has included investigations into alleged fraud in Minnesota daycare programs and in California hospice and daycare operations.
• It alleges a sequence: reports in early 2026 of a federal anti-fraud task force focused on California; the plaintiff’s January 31, 2026 post announcing his arrival in California; a February 2, 2026 statement by Governor Newsom regarding “right-wing provocateurs”; a February 5, 2026 news conference at which Attorney General Bonta characterized California fraud allegations as “reckless,” “false,” “outrageous,” and “ridiculous”; the plaintiff’s February 16, 2026 video and responses from the Governor’s press office; and that on February 20, 2026, four days later, Assemblymember Mia Bonta, whom the complaint identifies as Attorney General Bonta’s wife, introduced AB 2624.
• It alleges the plaintiff has self-censored and refrained from reporting he otherwise would undertake.

The five counts

Count 1: Facial content- and viewpoint-based restriction (First Amendment). The complaint argues §§ 6218.18–6218.20 are content-based because liability turns on the subject matter of the speech (whether it concerns an immigration support services provider) and viewpoint-based because the statute protects one side of a contested political debate while leaving speech about immigration-enforcement organizations unregulated. It points to the § 6218.10(b) findings, which attribute harassment to “the current federal administration’s anti-immigration attitude and policies,” as confirmation. It argues the specific-intent element does not save the statute, because intent goes to purpose and not to whether the speech itself is a true threat or Brandenburg incitement, citing NAACP v. Claiborne Hardware Co., 458 U.S. 886 (1982), and Reed v. Town of Gilbert, 576 U.S. 155 (2015).

Count 2: As-applied (First Amendment). Built on Florida Star v. B.J.F., 491 U.S. 524 (1989), and the principle that publication of truthful, lawfully obtained information on a matter of public significance may be punished only under a rule narrowly tailored to a state interest of the highest order. The complaint argues AB 2624 fails all three Florida Star considerations: it reaches information already lawfully public; it is underinclusive because it covers internet dissemination only and not other media; and California has not imposed comparable liability for other classes of individuals who face harassment for their work.

Count 3: Overbreadth. Under Broadrick v. Oklahoma, 413 U.S. 601 (1973), the complaint argues the definitions of “personal information,” “harassment,” “designated immigration support services,” “provider,” “facility,” and “publicly post” reach a substantial amount of protected speech relative to the statute’s legitimate sweep. It identifies third-party speech it says is swept in: local reporting on nonprofit use of taxpayer funds; watchdog publication of salaries, funding sources, and government contracts; commentary using publicly available material such as LinkedIn profiles and campaign-finance disclosures; and whistleblower disclosures identifying individuals responsible for alleged fraud.

Count 4: Vagueness (Fourteenth Amendment). Citing United States v. Williams, 553 U.S. 285 (2008), and Village of Hoffman Estates v. Flipside, 455 U.S. 489 (1982), for the stricter vagueness standard where speech is implicated. The specific objections: the open-ended “including, but not limited to” definitions in §§ 6218.11(b) and (d), with “health care facilities” flagged as especially sweeping; the “unreasonable” and “unwelcome” terms in the § 6218.11(f) harassment definition; the “relates to,” “describes,” and “capable of being associated with” language in § 6218.11(h); and, the sharpest of them, the continuous-availability problem in § 6218.11(i): if “publicly post” means “to intentionally communicate or otherwise make available to the general public,” does content that remains online constitute a fresh posting each day it stays up?

Count 5: Ex Post Facto (Art. I, § 10). The complaint alleges that AB 2624 creates a new crime, that the plaintiff lawfully published covered content before enactment, and that because the statute reaches information “ma[d]e available to the general public,” it attaches new criminal consequences to completed pre-enactment publication.

Threshold questions the State is likely to raise

Independent of the merits, several gatekeeping issues will probably be litigated first:

• Ripeness. The complaint anticipates this, invoking Susan B. Anthony List v. Driehaus, 573 U.S. 149 (2014), and arguing that a fixed, chaptered statute presenting a purely legal question is reviewable before its operative date. The State will likely emphasize the October 1, 2027 operative date and argue the controversy is not yet fit for review.
• Traceability and the proper defendant. This is the harder problem for the plaintiff, and it is worth stating plainly. Sections 6218.19’s remedies are private causes of action. They are enforced by covered individuals, not by the Attorney General or the Secretary of State. Under Ex parte Young, an official-capacity defendant generally must have some enforcement connection to the challenged provision. The complaint addresses this by tying the Secretary of State to the certification function that determines who may invoke § 6218.19(b) and the Attorney General to his general constitutional duty and independent civil enforcement authority. Whether that suffices is a live question.
• The criminal predicate for Count 5. The Ex Post Facto Clause reaches criminal punishment. Count 5, therefore, depends on § 6218.20 being criminal notwithstanding its silence on penalty. The State’s likely response is that the civil provisions cannot support an ex post facto claim at all, and that keeping content online after the operative date is ongoing conduct rather than retroactive punishment of a completed act.
• Scope of relief. The prayer seeks an injunction barring enforcement “against Mr. Shirley or any other person.” Universal relief of that breadth is contested territory in federal courts.

The arguments for and against the “Stop Nick Shirley Act” AB 2624

We think a reader is better served by seeing each side’s strongest case than by a summary that splits the difference. Here is our best effort at both.

The case against AB 2624

1. It is content-based on its face. Whether § 6218.19 applies depends on who the speech is about. Publishing identical information about an immigration enforcement contractor, a sheriff’s deputy, or a landlord is unregulated; publishing it about a person connected to an immigration services facility is not. Under Reed, a law that “singles out specific subject matter for differential treatment” is content-based even absent viewpoint targeting, which triggers strict scrutiny.

2. The findings supply a viewpoint problem. Section 6218.10(b) does not describe harassment in neutral terms. It attributes the harassment to “the current federal administration’s anti-immigration attitude and policies.” A legislature’s own explanation of why a class needs protection from speech is admissible evidence of what the statute is for, and this one names a political actor.

3. It is underinclusive in a way that undercuts the stated interest. California already has a general anti-doxxing statute, Civil Code § 1708.89, that applies to everyone regardless of profession or politics. If the interest is preventing violence facilitated by published personal information, that interest does not depend on which side of the immigration debate the target works on. Underinclusiveness is evidence that the real purpose is something other than the stated one, and it also bears on narrow tailoring.

4. The internet-only limitation compounds the problem. Sections 6218.18, 6218.19, and 6218.20 all reach publication “on the internet.” The same information distributed by broadcast, print, mail, or handbill is untouched. Florida Star treated exactly that kind of medium-specific gap as fatal to the State’s asserted interest.

5. The law has no exception for the press, and that is the strongest point in the case. We went looking for one. There isn’t any. Nothing in the new chapter exempts news organizations, reporters, or anyone covered by California’s shield law for journalists (Evidence Code § 1070). The law does contain two exceptions, at §§ 6218.18(b) and 6218.19(d), but both cover websites and online services rather than people. So if a reporter posts a video to YouTube, YouTube is protected and the reporter is not. The law shields the pipe and leaves the person speaking through it exposed.

That is why we think this is the challenger’s best argument. Most of the other points in this case require untangling constitutional doctrine. This one only requires reading the statute. And the person suing is a journalist, so the missing exception lands squarely on him.

One thing we cannot resolve. A legislative committee summary of the April 20, 2026, describes a press exception being added, on top of a shield-law exception it says was already there. Neither one appears in the law the Governor signed. We do not know what happened in between. The exceptions may have been taken out. The summary may have been describing something that never made it into the bill. We are not claiming the Legislature stripped press protection out, because we cannot prove that from what we have. We can only report what the final text says, which is that no press exception is in it.

Here is why that matters. When a law restricts speech based on its subject, a court generally asks whether the state wrote it as narrowly as it could have. California has put press exceptions into other privacy laws, so it plainly knows how. A challenger will ask why this one does not have one. That is a real argument, though not a guaranteed winner.

6. Vagueness at the edges. “Including, but not limited to” appears in the definitions of the covered services, the covered facilities, and the covered personal information. “Health care facilities” as a category of immigration support services facility is very wide. And § 6218.11(i)’s continuous-availability question, whether content that stays online is posted anew each day, is a genuine textual gap with real consequences for anyone maintaining an archive.

7. Public money should carry public accountability. This was the objection the bill’s registered opponents pressed most consistently through the legislative process. Organizations receiving substantial government funding, they argued, should not obtain the same confidentiality the law extends to private citizens, because it removes a check on how taxpayer dollars are spent. The statute, in their words, “would serve as a powerful tool for organizations to hide their activities from public scrutiny, including from investigative journalists exposing fraud and abuse in California’s immigration sector.” The same theme runs through the overbreadth count in Shirley, which points to watchdog reporting on nonprofit use of taxpayer funds, salaries, funding sources, and government contracts.

The case for AB 2624

1. Every operative prohibition requires specific intent to incite imminent violence or to threaten. This is the State’s strongest answer, and it is a strong one. Section 6218.19(a)(1)(A) requires specific intent to incite a third person to cause imminent great bodily harm and that “the third person is likely to commit this imminent harm”. Those are both halves of Brandenburg v. Ohio, 395 U.S. 444 (1969): intent to incite imminent lawless action and likelihood of producing it. Section 6218.19(a)(1)(B) requires intent to threaten in a manner placing the target in objectively reasonable fear, the true-threats category of Virginia v. Black, 538 U.S. 343 (2003). Both categories are historically unprotected.

2. The mens rea exceeds what the Supreme Court requires. Counterman v. Colorado, 600 U.S. 66 (2023), held that true-threats liability requires proof the speaker had some subjective awareness of the threatening nature of the statement, with recklessness sufficing as the floor. AB 2624 demands specific intent, a materially higher standard. A statute that requires more mens rea than the Constitution’s floor is in a defensible position on that axis.

3. The practical effect on journalism is narrower than it sounds. A reporter who publishes an immigration nonprofit’s payroll, government contracts, or the identity of a person alleged to have committed fraud is not acting with specific intent to incite imminent great bodily harm. Hostile reporting, unfair reporting, and reporting that predictably generates public anger are not the same thing as intent to cause imminent violence. On its terms, the statute does not reach ordinary investigative journalism, and the plaintiff’s own pleading (describing reporting drawn from on-camera interviews, public records, government contracts, and public social media) describes conduct with no evident intent to incite anything.

4. The platform carve-outs show tailoring. Sections 6218.18(b) and 6218.19(d) both exclude § 230(f) interactive computer services absent the service’s own culpable intent. That is a deliberate limit.

5. The template has two decades of unbroken durability. The reproductive-health anti-doxxing statutes on which this chapter is modeled have existed since 2006, were expanded in 2021, and, as the legislative record put it, no court has held them unconstitutional. Legislative committee analyses conducted their own Brandenburg, Black, and Counterman review and concluded the civil provisions likely fall within unprotected categories. Two decades of survival is not a guarantee, but it is not nothing.

6. There is a real record of harm. The legislative record documents specific incidents, including a San Francisco immigration legal services organization that responded to a coordinated doxxing campaign by spending approximately $10,000 on data-protection services, hiring building security, and removing staff information and its address from its website, a step that made the organization harder for clients to reach. That last detail is the point: doxxing does not only endanger workers; it degrades access to legal services for the people who need them.

Practical Planning Between Now and October 1, 2027

Nothing in the Act is operative. No one can enroll. No cause of action under §§ 6218.18–6218.20 has accrued. A firm’s rights and obligations under this chapter begin October 1, 2027.

What we are doing and what we would suggest to colleagues:

1. Start an incident log now. Date, time, medium, content, source if known, people affected, and any response. This is the evidentiary foundation for a § 6218.12(a)(1)(B) certification and, if it ever comes to it, for proving intent under § 6218.19. Certifications carry misdemeanor exposure; a log built contemporaneously is the difference between a defensible certification and a guess.
2. Designate an authorized certifying signatory and make sure that person understands the criminal exposure attached to willfully false certification of a material matter.
3. Add the § 6218.13(a) disclosure step to your offboarding checklist, and tell any enrollee in writing that reporting an employment change is their obligation and that failure to do so results in mandatory cancellation.
4. Decide, in advance, whether assisting staff or clients with applications is inside or outside your engagement scope and write it down. Section 6218.17(b)’s “not legal advice” disclaimer covers the state’s designees. It does not cover you.
5. Correct the record with clients now. The most common misunderstanding we expect is that this law hides someone from immigration enforcement. It does not. Section 6218.17(a)(1) alone forecloses that reading.
6. Consider security investment on its own merits, not on this statute’s timeline. Nothing in AB 2624 prevents an incident. The protections it creates are, at their core, retrospective remedies.
7. Watch four things: (a) Secretary of State rulemaking under § 6218.17(c), the fee schedule, and the list of designated community-based assistance programs, without which no one can file in person; (b) the docket in Shirley v. Bonta; (c) any cleanup legislation addressing § 6218.20’s missing penalty, § 6218.18’s missing remedy, or the client-coverage gap; and (d) the § 6218.17(e) annual reports beginning January 10, 2028.
8. Think hard before sending a § 6218.19(b) demand to a journalist. This is a caution against our own interest, and we want to state it plainly. A firm that serves a written demand on a member of the press is invoking a statute with no press exemption against a press defendant while a facial First Amendment challenge to that statute is pending in federal court. Even a demand that is well-founded on its facts will be read against that backdrop, and a poorly founded one risks becoming the vehicle that makes bad law. The § 6218.19(a) causes of action against genuine doxxing campaigns are a different matter and do not carry the same freight.

Disclaimer

This article is for general informational purposes and is not legal advice. It does not create an attorney-client relationship. Anyone making decisions based on this statute should consult counsel about their specific circumstances.

Immigration Professional Association is a California law corporation practicing immigration law at visainamerica.com. Under the statute analyzed above, a “law office” is expressly named as a designated immigration support services facility, and our attorneys, paralegals, and volunteers might fall within the protected class. We are, in other words, a potential direct beneficiary of this law. We have written with that in mind, naming the provisions that constrain us as clearly as the ones that help us, presenting the constitutional challenge on its strongest terms rather than its weakest, and separating what the enacted text says from what commentary about it says.

AB 2624 is not operative until October 1, 2027. The Secretary of State rulemaking it depends on does not yet exist, and the statute is the subject of pending federal litigation whose outcome is unknown. Nothing in this article predicts how any court will rule.

Last updated: September 7, 2026. Statutory text current as published August 22, 2026. Litigation status current as of the complaint filed September 4, 2026; no subsequent docket activity was available to us at the time of writing.