The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer's personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA) , approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines "data broker" to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law requires a data broker, in registering with the agency, to pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers' precise geolocation, or consumers' reproductive health care data. This bill would require a data broker to provide additional information to the agency, including whether the data broker collects consumers' names, dates of birth, ZIP Codes, email addresses, phone numbers, login or account information, various government identification numbers, mobile advertising, connected television, or vehicle identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, biometric data, and up to 3, but no fewer than one, of the most common types of personal information that the data broker collects, as provided. The bill would also require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers' data to a foreign actor, as defined, the federal government, other state governments, law enforcement, as provided, or a developer of a GenAI system, as defined. The bill would make changes to the administrative fines and costs that apply to data brokers who fail to register. Existing law requires, beginning January 1, 2026, the California Privacy Protection Agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, among other things, process a denied request to delete personal information as an opt-out of the sale or sharing of the consumer's personal information under the CCPA, as specified. This bill would require a data broker to process the above-described denied request within 45 days of receiving the request. Existing law requires the agency to create a page on its internet website where registration information provided by data brokers and the accessible deletion mechanism is accessible to the public. This bill would prohibit the agency from making accessible to the public on its internet website information regarding whether the data broker collects consumers' names, dates of birth, zip codes, email addresses, phone numbers, mobile advertising, connected television, or vehicle identification numbers, and the most common types of personal information that it collects. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.
Existing law establishes the Medi-Cal program, which is administered by the State Department of Health Care Services, under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid program provisions. Under existing law, in-person, face-to-face contact is not required under the Medi-Cal program when covered health care services are provided by video synchronous interaction, asynchronous store and forward, audio-only synchronous interaction, remote patient monitoring, or other permissible virtual communication modalities, when those services and settings meet certain criteria. Existing law required the department, on or before January 1, 2023, to develop a research and evaluation plan that, among other things, proposes strategies to analyze the relationship between telehealth and access to care, quality of care, and Medi-Cal program costs, utilization, and program integrity. The department created that plan in December of 2022 and published the Biennial Telehealth Utilization Report in April of 2024. This bill, the Telehealth for All Act of 2025, would require the department, commencing in 2028 and every 2 years thereafter, to use Medi-Cal data and other data sources available to the department to produce analyses in a publicly available Medi-Cal telehealth utilization report. The bill would authorize the department to include those analyses in each of the department's Biennial Telehealth Utilization Reports, as specified. The bill would require the analyses to address telehealth access and utilization data, including various metrics on telehealth visits and claims, disaggregated by geographic, demographic, and social determinants of health categories to identify disparities. The bill would require the department to identify additional data elements for inclusion in future reports to help to identify and address access-to-care issues or provide greater insight into utilization of telehealth modalities.
Existing law generally governs the transactions between a rental car company, also referred to as a rental company, and its customers, as provided. Existing law prohibits a rental company from using, accessing, or obtaining any information relating to the renter's use of the rental vehicle that was obtained using electronic surveillance technology, as defined, except under specified circumstances. Existing law permits a rental company and a renter to limit the responsibilities of a renter in specified events, including loss due to theft of the rented vehicle up to its fair market value, as provided. Existing law establishes, in the situation described in the previous sentence, a presumption that the renter has no liability for loss due to theft if specified conditions are met, including that an authorized driver has possession of the ignition key or establishes that the ignition key was not in the vehicle at the time of the theft, as provided. This bill would allow a rental company to use geofence technology, as specified, to detect rental vehicle movement in prescribed circumstances. The bill, with respect to the above-described provisions relating to the renter's liability for loss due to theft, would revise the presumption that the renter has no liability for loss due to theft to instead apply this presumption if an authorized driver returns the ignition key.
Existing law requires an individual or a business that conducts business in California, and that owns or licenses computerized data that includes personal information, to disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was compromised, as specified, and requires that disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. This bill would require that data breach disclosure to be made within 30 calendar days of discovery or notification of the data breach but would authorize an individual or business to delay the disclosure to accommodate the legitimate needs of law enforcement, as specified, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Existing law also requires an individual or business that is required to issue the security breach notification described above to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. This bill would require that submission to the Attorney General to be made within 15 calendar days of notifying affected consumers of the security breach.
Existing law establishes the Department of Health Care Access and Information to oversee and administer various health programs related to health care infrastructure, such as health policy and planning, health professions development, and facilities design review and construction, among others. Existing law requires the California Health and Human Services Agency to establish the California Health and Human Services Data Exchange Framework to require the exchange of health information among health care entities and government agencies in the state, among other things. Existing law requires the agency to convene a stakeholder advisory group to advise on the development, implementation, and administration of the California Health and Human Services Data Exchange Framework. This bill would require the Department of Health Care Access and Information, on or before January 1, 2026, to take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the agency. The bill would expand the entities that are specifically required to execute a data sharing agreement with the California Health and Human Services Data Exchange Framework. The bill would require the department, no later than July 1, 2026, to establish a process to designate qualified health information organizations as data sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. The bill would require the department, by July 1, 2027, and in collaboration with the stakeholder advisory group, to develop and submit a report to the Legislature on the California Health and Human Services Data Exchange Framework, including compliance with data sharing agreements. The bill would expand the membership of the stakeholder advisory group, as specified.
Under existing law, the residence address, telephone number, and email address of a registered voter is confidential, except that under certain circumstances a county elections official must provide that information to any candidate for federal, state, or local office, to any committee for or against any initiative or referendum measure, and to any person for election, scholarly, journalistic, political, or governmental purposes. This bill would exempt the residence address, telephone number, and email address of a federal, state, or local elected official or candidate from that disclosure requirement, except that the information may be disclosed for journalistic or governmental purposes under specified conditions. The bill would require the Secretary of State to provide each county elections official with a list identifying each federal and state elected official or candidate residing in the county, require the county elections official to add each local elected official or candidate to that list, and require the county elections official to make the elected official or candidate's information confidential within 5 business days. The bill would require the county elections official to exclude the elected official or candidate's confidential information when producing any list, roster, or index. The bill would require an elected official or candidate to contact their county elections official to ensure their voter registration record has been made confidential. The bill would authorize an elected official or candidate to opt out of making their residence address, telephone number, and email address confidential. By adding new duties for county elections officials, this bill would create a state-mandated local program. This bill would incorporate additional changes to Section 2194 of the Elections Code proposed by AB 827 to be operative only if this bill and AB 827 are enacted and this bill is enacted last. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The California Consumer Financial Protection Law requires the Commissioner of Financial Protection and Innovation to prepare and publish on the Department of Financial Protection and Innovation's internet website an annual report detailing actions taken during the prior year under the law and requires the report to include information on actions taken with respect to, among other things, the activities of the Financial Technology Innovation Office. This bill would additionally require the report to include information on actions taken with respect to the Office of the Ombuds.
Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered. This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes. This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program. Existing law, the Confidentiality of Medical Information Act (CMIA) , generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state's laws that interfere with a person's rights to choose or obtain an abortion or a foreign penal civil action. This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another state's laws that interfere with a person's rights to choose or obtain an abortion or a foreign penal civil action. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
(1) Existing law prohibits, except as required by state or federal law or as required to administer a state or federally supported educational program, school officials and employees of a school district, county office of education, or charter school from collecting information or documents regarding citizenship or immigration status of pupils or their family members. Existing law requires the superintendent of a school district, the superintendent of a county office of education, and the principal of a charter school, as applicable, to report to the respective governing board or body of the local educational agency in a timely manner any requests for information or access to a schoolsite by an officer or employee of a law enforcement agency for the purpose of enforcing the immigration laws in a manner that ensures the confidentiality and privacy of any potentially identifying information. This bill would prohibit school officials and employees of a local educational agency from allowing an officer or employee of an agency conducting immigration enforcement to enter a nonpublic area of a schoolsite, as defined, for any purpose without being presented with a valid judicial warrant, judicial subpoena, or a court order. The bill would require school officials and employees of a local educational agency, to the extent practicable, to request valid identification of any officer or employee of an agency conducting immigration enforcement seeking to enter a nonpublic area of a schoolsite. The bill would also prohibit a local educational agency and its personnel from disclosing or providing, in writing, verbally, or in any other manner, the education records of or any information about a pupil or a pupil's family and household without the pupil's parents' or guardians' written consent, a school employee, or a teacher to an officer or employee of an agency conducting immigration enforcement without a valid judicial warrant or judicial subpoena, or court order directing the local educational agency or its personnel to do so. By imposing additional duties on local educational agencies, the bill would impose a state-mandated local program. (2) Existing law requires the Attorney General, by April 1, 2018, in consultation with the appropriate stakeholders, to publish model policies limiting assistance with immigration enforcement at public schools, to the fullest extent possible consistent with federal and state law, and ensuring that public schools remain safe and accessible to all California residents, regardless of immigration status, as provided. Existing law requires local educational agencies, by July 1, 2018, to adopt those model policies developed by the Attorney General or equivalent policies. This bill would require the Attorney General, by December 1, 2025, to update those model policies to ensure that the policies align with the above-described prohibitions on school officials and employees of local educational agencies allowing an officer or employee of an agency conducting immigration enforcement to enter a nonpublic area of a schoolsite without a valid judicial warrant or judicial subpoena, or a court order and from disclosing or providing certain information to those officers or employees, as provided. The bill also would require a local educational agency to update its model policy by March 1, 2026, and to make the policy available to the State Department of Education upon request. By imposing additional duties on local educational agencies, the bill would impose a state-mandated local program. (3) This bill would make these provisions severable. (4) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. (5) This bill would declare that it is to take effect immediately as an urgency statute.
Existing law authorizes the operation of an autonomous vehicle on public roads for testing purposes by a driver who possesses the proper class of license for the type of vehicle operated if specified requirements are satisfied. Existing law prohibits the operation of an autonomous vehicle on public roads until the manufacturer submits an application to the Department of Motor Vehicles, as specified, and that application is approved. A violation of the Vehicle Code or a local ordinance adopted pursuant to that code is an infraction. This bill would prohibit the delivery of commercial goods, as defined, directly to a residence or to a business for its use or retail sale through the operation of an autonomous vehicle without a human safety operator on any highway within the State of California. The bill would make a first violation of this provision subject to a $10,000 administrative fine and a $25,000 administrative fine for subsequent violations. The bill would authorize the department to suspend or revoke the permit of an autonomous vehicle manufacturer for repeated violations of this provision. The bill would require the department to submit a report to the Legislature evaluating the performance of autonomous vehicle technology and its impact on public safety and employment, as specified. This bill would require all relevant state agencies, including, among others, the Department of Transportation and the State Air Resources Board, to provide information to the department to research this report. The bill would prohibit the department from issuing a deployment permit for the use of an autonomous vehicle to deliver commercial goods without a human safety operator until a later enacted statute authorizes the issuance of a permit for that purpose. The bill would also make certain findings and declarations related to these provisions.
