Pornographic internet websites: consent.

The definition of 'pornographic internet website' was expanded to cover websites where the owner or operator 'holds out as featuring sexually explicit content or invites users to upload, or solicits from users, sexually explicit content,' not just sites where the owner knowingly uploads or allows others to upload such content. This captures more types of platforms.

The operator's duty of care in Section 22606 was changed from covering content 'uploaded' to covering content 'uploaded displayed on' the website, slightly broadening the scope of what the operator must monitor.

The user's pre-upload statement is no longer made 'under penalty of perjury.' Instead, it is now a 'statement certifying' and knowingly providing false information in that statement is a new infraction punishable by a $1,000 fine. This shifts from the general perjury framework to a specific, lower-level offense.

A new rebuttable presumption defense was added: an operator who fails to obtain the required statement is presumed to have violated the law, but may rebut that presumption by showing by a preponderance of the evidence that it took other verification steps consistent with its duty of care.

Operators must now verify a user's email address before permitting the user to upload sexually explicit content. This is a new affirmative obligation not present in the Assembly version.

The contact information requirement was tightened to specify that it must include 'at a minimum, an email address,' rather than just 'information sufficient to enable the operator to contact the user.'

A new provision allows operators to require users to submit the required statement and information through a specific mechanism or medium of their choosing.

The bill was restructured: the old version combined operator and user requirements in Section 22606 with a separate Section 22607 for additional user requirements. The new version separates them cleanly, with Section 22606 covering only operator duty of care and Section 22607 consolidating all user-facing requirements including the new email verification and submission mechanism provisions.

The bill text was reformatted from a plain-text legislative document into a web page layout that includes navigation elements (home, accessibility, FAQ, feedback, sitemap, login), search functionality, version history links, a published date stamp, and share options. The underlying statutory language of Sections 22605 through 22609 is unchanged.

The operator's standard of care was lowered from 'take reasonable steps to ensure' to 'exercise ordinary care and reasonable diligence to ensure,' referencing the negligence standard in Civil Code Section 1714. This makes it easier for operators to comply but potentially weaker protection for depicted individuals.

New Section 22608 requires operators to establish a clear and conspicuous takedown request mechanism that is prominently accessible on any page where sexually explicit content is available. The section specifies what a valid takedown request must contain, requires written acknowledgment within 24 hours, requires notification of blocking within 24 hours of blocking, and allows response via phone or email if chosen by the depicted individual.

The takedown obligation was strengthened from simply 'remove the sexually explicit content' to 'remove and permanently block the sexually explicit content and any substantially identical content, or the portion of the content showing the depicted individual.' This prevents re-uploading of the same or similar material.

New Section 22607 creates a standalone section for user obligations, including a new requirement that operators retain perjury statements and contact information in a readily available format for at least seven years after submission.

The definition of 'sexually explicit content' was expanded to include imagery generated by artificial intelligence 'or through digitization,' broadening coverage beyond AI-generated content to also encompass digitized material.

Three new definitions were added: 'clear and conspicuous' (by reference to Section 17601), 'takedown request' (a request made through the mechanism in Section 22608), and 'user' (a person or entity that uploads or otherwise provides sexually explicit content).

A new provision in Section 22609(d) clarifies that each full calendar day that content subject to removal remains accessible beyond the 48-hour window constitutes a separate violation, making it easier to accumulate penalties for prolonged non-compliance.

The civil action provision was changed from 'brings a civil action' to 'prevails in a civil action' for obtaining relief, and now references violations of both Section 22606 and the new Section 22607.

The operator's duty changed from 'shall not knowingly allow a user to upload sexually explicit content unless the user has submitted' verification statements to 'shall take reasonable steps to ensure that any sexually explicit content uploaded does not include a depicted individual.' This lowers the standard from a strict compliance requirement to a reasonableness standard.

The age criterion in the user's perjury statement changed from 'the individual is at least 18 years of age' (present tense, current age) to 'the individual was not a minor at the time the sexually explicit content was created' (past tense, age at time of creation). This narrows the requirement to focus on whether the person was an adult when the content was made rather than their current age.

A new provision was added stating that each day an operator remains in violation of the 48-hour takedown requirement constitutes a separate violation, which multiplies potential penalties for continued non-compliance.

The civil remedy for depicted individuals changed from 'statutory damages not greater than $75,000 per violation' to 'actual damages or statutory damages in an amount not greater than $75,000 per violation, whichever amount is greater.' This allows victims to recover actual damages that exceed the $75,000 cap.

New definition of 'depicted individual' added: a person shown in sexually explicit content who did not consent to being depicted, was a minor when the content was created, or did not consent to the uploading.

The definition of 'sexually explicit content' now explicitly includes imagery generated by artificial intelligence, broadening what content falls under the bill.

Operator obligation changed from a prohibition on 'knowingly allowing' non-consensual uploads to an affirmative duty to 'take reasonable steps to ensure' uploaded content does not include a depicted individual. A presumption of violation is created if the operator failed to obtain the required consent statement.

New 48-hour takedown requirement: if a depicted individual notifies the operator that they did not consent or were a minor, the operator must remove the content within 48 hours.

User consent requirements expanded from two prongs (age 18 and consent to upload) to three prongs: was not a minor at time of creation, consents to uploading, AND consented to being depicted in the content.

Entirely new Section 22607 creates civil enforcement mechanisms: depicted individuals may sue operators and users for statutory damages up to $75,000 per violation, punitive damages, attorney's fees, and injunctive relief. Public prosecutors may also bring civil actions for $25,000 per violation penalties plus equitable relief.

New Section 22608 clarifies that the bill's remedies are cumulative and do not restrict remedies available under other laws.