Reporting mechanism: child sexual abuse material.

The definition of 'identifiable individual' was changed from a state-defined two-part test (individual appears in whole or in part AND face/likeness/distinguishing characteristic is displayed) to simply incorporating the federal definition from Section 223(h)(1)(C) of Title 47 U.S.C. by reference.

The definition of 'child sexual abuse material' was revised to remove the phrase 'reasonably appears to be' a minor and instead requires the individual actually be a minor, with 'identifiable individual' now cross-referenced to Section 6851 of Title 15 U.S.C.

The deadline for platforms to provide written confirmation to reporting users was extended from 36 hours to 72 hours after material is first reported.

The extended compliance deadline for circumstances beyond the platform's reasonable control was increased from 5 days to 10 days after material was first reported.

The requirement for regular written updates every 7 days until a final determination was replaced with a single final written determination to be provided within 7 days of when material is first reported.

To qualify for the safe harbor exemption from the commercial sexual exploitation prohibition, platforms must now submit their biannual audits to the Attorney General (and to other public officials if requested), in addition to providing them to board members. Submitted audits are designated confidential and exempt from disclosure under the California Public Records Act.

The hash-matching process requirement was restructured: rather than being a standalone obligation, natural person review is now triggered specifically when there is no established or known hash match AND the reported material is not otherwise blocked.

A new tiered civil penalty structure was created: a first violation of communication requirements (subdivisions e through g) not involving a depicted individual carries a flat penalty of up to $75,000, while subsequent violations or those continuing past 5 calendar days carry up to $250,000 per day. Violations of core reporting and blocking requirements remain at up to $250,000 per day.

The requirement that material be reported for 4 consecutive months before a social media platform is deemed to have knowledge (for purposes of the commercial sexual exploitation prohibition) was removed. A platform can now be deemed to have knowledge upon a single qualifying report.

The definition of 'child pornography' is expanded to include obscene visual representations of the sexual abuse of children as provided in Section 1466A of Title 18 of the United States Code, broadening what material qualifies beyond the existing Section 2256 reference.

The definition of 'identifiable individual' is replaced with a reference to Section 223(h)(1)(C) of Title 47 of the United States Code, replacing the previous two-part state-level definition that required both appearance in an intimate visual depiction and display of face or distinguishing characteristic.

The second prong of 'child sexual abuse material' now references Section 6851 of Title 15 of the United States Code for the definition of identifiable individual, incorporating a federal standard into the state definition.

A new 48-hour deadline is added requiring social media platforms to permanently block reported material within 48 hours of receiving a report, if the material meets the specified criteria. Previously no specific blocking deadline was stated in this subdivision.

The written confirmation requirement is changed from confirming receipt within 36 hours to providing a substantive update within 72 hours stating the actions taken on the report, including whether hash matching was performed and whether a natural person reviewed the material.

The final written determination timeline is shortened. Previously platforms provided updates every 7 days until a final determination (with no hard deadline for the final determination itself). Now the final written determination must be provided within 7 days of when the material was first reported.

The extension period for circumstances beyond reasonable control is doubled from 5 days to 10 days for compliance with subdivisions (c) through (g).

Civil penalties are restructured into a tiered system: violations of core reporting obligations (subdivisions a-d and h) carry up to $250,000 per day; a first violation of procedural notification requirements (subdivisions e-g) carries up to $75,000 unless the report was made by or on behalf of a depicted individual; subsequent violations or noncompliance lasting more than 5 calendar days escalate to $250,000 per day.

The reporting mechanism requirement is clarified to apply to direct messaging systems that do not use end-to-end encrypted communication, making the exclusion of encrypted communications explicit in the operative text rather than only in the platform definition.

Penalty trigger broadened from 'reporting mechanism is unavailable or nonfunctional' to 'reporting mechanism is in violation of Section 3273.66,' meaning platforms can now be penalized for any failure to meet the section's requirements, not just when the reporting tool is completely down.

Depicted individuals who are not reporting users can now bring a civil action on their own behalf, in addition to through a parent, legal guardian, or other authorized representative. Previously they could only file through a representative.

New requirement that social media platforms submit biannual audits to the Attorney General and, if requested, to a district attorney, city attorney, or county counsel. Audits submitted this way are confidential and exempt from disclosure under the California Public Records Act.

Removed the 4-consecutive-months reporting requirement for deeming a platform to have knowledge of commercial sexual exploitation. A platform is now deemed to have knowledge if material was reported using the required mechanism and meets the criteria in Section 3273.66(a), with no waiting period.

Added legislative findings required by the California Constitution for statutes that limit access to public records, demonstrating the interest protected and the need for protecting that interest.

Fixed duplicated text in the bill summary: 'as defined, and defined' corrected to 'defined,' and 'would, would remove' corrected to 'would remove.'

The Attorney General's authority to adopt regulations defining 'clear and conspicuous' for purposes of this title was removed. The term now simply incorporates the existing definition from Section 17601 of the Business and Professions Code without any additional regulatory flexibility.

A new subdivision (i) in Section 3273.66 requires a social media platform to restore availability or functionality of its reporting mechanism if the mechanism is unavailable or nonfunctional. This creates an affirmative duty to fix a broken reporting system, not just a penalty for leaving it broken.

Penalty provisions in Section 3273.67(a) now explicitly state that the $250,000-per-day civil penalty applies when the reporting mechanism is unavailable or nonfunctional 'in violation of Section 3273.66,' narrowing and clarifying the scope of when penalties accrue.

The 'four consecutive months' knowledge presumption in Section 3345.1(g)(4) was removed. Previously, a platform could avoid being deemed to have 'knowledge' that it was facilitating commercial sexual exploitation unless material had been reported through the reporting mechanism for four consecutive months (and met other criteria including being displayed after January 1, 2025). Removing this threshold means platforms can be found to have acted knowingly based on shorter reporting periods or other evidence.

Removed the requirement that a depicted individual must also be the reporting user to recover actual and statutory damages. Now any depicted individual can recover regardless of whether they filed the report.

Expanded the civil action available to depicted individuals who are not reporting users from covering only violations of subdivision (d) (blocking) to covering violations of all of Section 3273.66. Added that such actions must be filed by a parent, legal guardian, or other authorized representative, and clarified that damages are awarded to the depicted individual.

Removed the word 'solely' from the safe harbor provision for when a reporting mechanism is unavailable or nonfunctional. Previously the platform had to prove the unavailability was caused solely by circumstances beyond its reasonable control; now it only needs to show it was caused by such circumstances (and not by the company's own acts or omissions).

Corrected a redundant cross-reference in Section 3345.1(g)(4)(B) from 'paragraphs (1) to (3), inclusive, and (2)' to simply 'paragraphs (1) and (2)' of subdivision (a) of Section 3273.66.

Fixed a duplicated word in Section 3345.1(g)(3)(D): 'Attorney General, and General and' corrected to 'Attorney General and.'

The reporting mechanism under Section 3273.66(a)(2) no longer requires that 'the reporting user is an identifiable minor depicted in the reported material.' It now only requires that 'the reported material is displayed, stored, or hosted on the social media platform.' This means any California resident can report suspected CSAM, not just the victim.

The definition of 'child sexual abuse material' in Section 3273.65(c)(2) was changed from 'obscene matter that depicts a minor personally engaging in, or personally simulating, sexual conduct' to 'an intimate visual depiction involving an identifiable individual who is, or reasonably appears to be, a minor.' This removes the obscenity requirement and broadens coverage to any intimate visual depiction.

Multiple new definitions were formally added or restructured in Section 3273.65, including 'depicted individual,' 'digital forgery,' 'hash,' 'hash-matching process,' 'identifiable individual,' 'intimate visual depiction,' 'minor,' 'obscene matter,' 'reporting user,' and 'sexually explicit conduct.' The definition of 'social media platform' explicitly excludes stand-alone end-to-end encrypted direct messaging services and 501(c)(3) nonprofit-operated services.

The compliance deadline for platforms to complete all required actions (contacting the reporter, blocking material, providing updates, and issuing a final determination) was shortened from 30 days to 48 hours. The extension period for circumstances beyond the platform's control was shortened from 60 days to 5 days.

A new requirement was added in Section 3273.66(b)(2) mandating that all reports be reviewed through a hash-matching process, and that a natural person must review the report if there is no established or known hash match to CSAM and the material has not been otherwise blocked.

The prior version's increase in statutory damages for commercial sexual exploitation (from $1,000,000-$4,000,000 to $1,500,000-$4,500,000 per act) was removed from the bill. The April 27 version does not include this increase.

The bill title was corrected to reflect that it amends Sections 3273.65, 3273.66, 3273.67, and 3345.1 of the Civil Code (the prior version's title only referenced Section 3345.1). The fiscal committee designation changed from 'no' to 'yes,' indicating the bill now carries fiscal implications requiring committee review.

Section 3273.67(b) now states the company is liable to 'a reporting user who is the depicted individual' (reworded from 'a depicted individual who is the reporting user'). Subdivision (c) clarifies that for failure-to-block violations specifically, a depicted individual may bring an action even if they are not the reporting user.

The bill now amends four sections of the Civil Code (3273.65, 3273.66, 3273.67, and 3345.1) instead of just two, adding an entirely new definitions section and a new enforcement/liability section that did not exist in the prior version.

A new Section 3273.65 adds definitions for 'child sexual abuse material' (now including intimate visual depictions involving identifiable individuals who appear to be minors, covering AI-generated content), 'digital forgery,' 'hash-matching process,' 'depicted individual,' 'dark pattern,' 'intimate visual depiction,' and 'social media company.' The definition of 'social media platform' excludes end-to-end encrypted messaging services and 501(c)(3) nonprofit services.

The reporting mechanism under Section 3273.66 must now be 'clear and conspicuous' and must not use dark patterns. Reports must include material sent or received through direct messaging systems. All reports must be reviewed through a hash-matching process, and if there is no known hash match and the material is not otherwise blocked, a natural person must review the report.

The compliance deadline for platforms to act on reports was shortened from 30 days to 48 hours, with an extension to 5 days only for circumstances beyond the platform's reasonable control. Platforms must provide written confirmation to reporters within 36 hours and written status updates every 7 days until a final determination is issued.

A new Section 3273.67 imposes a civil penalty of up to $250,000 per day on social media companies whose reporting mechanism is unavailable or nonfunctional, enforceable by the Attorney General, district attorneys, city attorneys, or county counsel. Injunctive relief is also available. Penalties collected by the Attorney General are deposited into the Survivor Support Fund.

To qualify for the safe harbor exemption from the commercial sexual exploitation prohibition, platforms must now submit their biannual safety audits to the Attorney General and, if requested, to district attorneys, city attorneys, or county counsel. Previously, only providing audits to the board of directors was required.

Statutory damages for a social media platform that facilitates, aids, or abets commercial sexual exploitation were increased from $1,000,000 to $4,000,000 per act to $1,500,000 to $4,500,000 per act.

Liability under the new Section 3273.67 is owed to a 'depicted individual' (a person depicted as a minor in child sexual abuse material on the platform) rather than to the 'reporting user.' A depicted individual who is not the reporting user may bring a civil action for violations of the blocking requirement. Statutory damages are capped at $250,000 per violation, reduced to $125,000 if the material was blocked before a complaint is filed, and further reduced to $75,000 if the platform participates in NCMEC's Take It Down service and meets specified hash-matching and reporting requirements.

The fiscal committee designation changed from 'no' to 'yes,' indicating the bill now has a state fiscal impact due to the new penalty provisions and fund deposits. Coauthors Aguiar-Curry, Bauer-Kahan, Macedo, and Petrie-Norris were added.

The bill now amends Section 3345.1 of the Civil Code in addition to Section 3273.69, expanding its scope from a minor severability fix to a comprehensive civil liability regime for social media platforms that facilitate commercial sexual exploitation.

Statutory damages of $1,500,000 to $4,500,000 per act of commercial sexual exploitation facilitated, aided, or abetted by a social media platform are established (the digest indicates these are increases from prior amounts of $1,000,000 to $4,000,000).

A safe harbor is created: a platform avoids liability if it conducts at least biannual audits of its designs, algorithms, and features; takes mitigation action within 30 days of an audit finding; and provides each board member a copy of the audit with a description of actions taken within 90 days.

If the victim is under 18, the court may order that penalties be held in trust exclusively for the victim's benefit until the victim reaches 18 or is emancipated, at which point any unspent remainder becomes the victim's sole property.

'Commercial sexual exploitation' is defined to include sex trafficking, pimping, pandering, procurement of a child under 16 for lewd acts, solicitation of a child, and other specified Penal Code violations. 'Nonminor dependent' is defined by reference to the Welfare and Institutions Code.

The definition of 'social media platform' excludes stand-alone end-to-end encrypted direct messaging services (and the encrypted portions of multiservice platforms) and internet-based services owned or operated by 501(c)(3) nonprofit organizations.

Constructive knowledge is imputed to a platform if material meeting certain reporting criteria was reported for four consecutive months and first displayed after January 1, 2025. A waiver of the section's provisions is declared void and unenforceable as contrary to public policy.

The original nonsubstantive amendment to Section 3273.69 (fixing 'If any a provision' to 'If a provision') is retained but moved to the end of the bill as a secondary section.