Existing law requires the Department of Technology to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems (ADS) that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law establishes the Labor and Workforce Development Agency, which is composed of various departments responsible for protecting and promoting the rights and interests of workers in California, including the Division of Labor Standards Enforcement, led by the Labor Commissioner, within the Department of Industrial Relations. This bill would require an employer to provide a written notice that an ADS, for the purpose of making employment-related decisions, not including hiring, is in use at the workplace to all workers that will foreseeably be directly affected by the ADS, as specified. The bill would require the employer to maintain an updated list of all ADS currently in use. The bill would require an employer to notify, as provided, a job applicant that the employer utilizes an ADS when making hiring decisions, if the employer will use the ADS in making decisions for that position. The bill would prohibit an employer from using an ADS that does certain functions and would limit the purposes and manner in which an ADS may be used to make decisions. The bill would authorize a worker to request, and require an employer to provide, a copy of the most recent 12 months of the worker's own data primarily used by an ADS to make a discipline, termination, or deactivation decision, as specified. The bill would require an employer that primarily relied on an ADS to make a discipline, termination, or deactivation decision to provide the affected worker with a written notice, as specified. This bill would prohibit an employer from discharging, threatening to discharge, demoting, suspending, or in any manner discriminating or retaliating against any worker for taking certain actions asserting their rights under the bill. The bill would require the Labor Commissioner to enforce the bill's provisions, as specified, and would authorize a public prosecutor to bring a civil action. The bill would set forth specified types of relief that a plaintiff may seek and specified penalties that an employer that violates these provisions is subject to, including a $500 civil penalty. The bill would also provide that an employer who complies with the requirements related to notice in this bill is not required to comply with any substantially similar provisions under any other state law, except as specified. The bill would not apply to parties covered by a valid collective bargaining agreement if the agreement contains specified information, including an explicit waiver of the bill's provisions. The bill would declare that its provisions do not prohibit any employer from complying with regulatory or contractual requirements in the provision of products or services to the federal government, as defined. This bill would declare that its provisions are severable.
Existing law generally regulates social media platforms, including by requiring a social media company to post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service, as prescribed. Existing law generally prohibits a person from using violence or intimidation to interfere with another person's enjoyment of certain rights or because of certain attributes of that person, including the person's political affiliation, race, or sexual orientation, and punishes violations of that law with certain civil penalties or as misdemeanors, as prescribed. This bill would make a social media platform, as defined, that violates the above-referenced provisions of law relating to personal rights through its algorithms that relay content to users or aids, abets, acts in concert, or conspires in violation of those laws, or is a joint tortfeasor in an action alleging a violation of those laws, liable for specified civil penalties. The bill would declare its provisions to be severable and would declare attempted waiver of its provisions to be void and unenforceable. This bill would become operative on January 1, 2027.
Existing law requires a law enforcement agency, as defined, to obtain specific approval of a governing body prior to acquiring military equipment, as specified. Existing law defines "military equipment" to include an unmanned, remotely piloted, powered aerial or ground vehicle. This bill would prohibit a law enforcement agency from purchasing, on or after January 1, 2027, an uncrewed, remotely piloted, powered aerial or ground vehicle unless the vehicle contains an option to turn off any data collection programs that are not necessary for the vehicle to function and the law enforcement agency uses an American data storage company, as defined, to house all data collected, including, but not limited to, video and photographic images, as specified, or both. For uncrewed, remotely piloted, powered aerial or ground vehicles purchased on or after January 1, 2026, and before January 1, 2027, the bill would require a law enforcement agency to use an American data storage company. For uncrewed aerial or ground vehicles owned or possessed by a law enforcement agency prior to January 1, 2026, the bill would require the law enforcement agency to use an American data storage company after the current contract to house the data expires. The bill would require contracts entered into pursuant to these provisions with an American data storage company to prohibit the American data storage company from using, selling, renting, trading, or otherwise sharing this data with any other entity.
Existing law establishes the Division of Labor Standards Enforcement within the Department of Industrial Relations. Existing law authorizes the division, which is headed by the Labor Commissioner, to enforce the Labor Code and all labor laws of the state, the enforcement of which is not specifically vested in any other officer, board, or commission. This bill would generally regulate the use of workplace surveillance tools and an employer's use of worker data. The bill would, among other things, require an employer, at least 30 days before introducing a workplace surveillance tool, to provide a worker who will be affected a written notice that includes, among other things, a description of the worker data to be collected, the intended purpose of the workplace surveillance tool, and how this form of worker surveillance is necessary to meet that purpose. The bill would define "employer" to include public employers, as specified. The bill would prohibit an employer from transferring, selling, disclosing, or licensing worker data to a vendor, unless the vendor is under contract to analyze or interpret the worker data and the contract includes certain terms. The bill would prohibit an employer from using certain workplace surveillance tools, including a workplace surveillance tool that incorporates facial, gait, or emotion recognition technology, except as specified. The bill would also prohibit an employer from using a workplace surveillance tool to infer specified categories of information about a worker, including, among others, their immigration status, veteran status, ancestral history, religious or political beliefs, disability status, criminal record, or credit history. The bill would require the Labor Commissioner to enforce the bill's provisions, would authorize an employee to bring a civil action for specified remedies for a violation of the bill's provisions, and would authorize a public prosecutor to enforce the provisions. The bill would subject an employer who violates the bill's provisions to a civil penalty of $500 for each violation. The bill would define various terms for purposes of its provisions.
(1) Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use, as prescribed. Existing law defines "sensitive personal information" to mean, among other things, personal information that reveals a consumer's precise geolocation. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would prohibit a covered entity from collecting or processing the location information of an individual unless doing so is necessary to provide goods or services requested by that individual. The bill would impose various other restrictions on covered entities with regard to location information. The bill would define various terms for purposes of these provisions, including "location information" to mean information that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device, as specified. This bill would require a covered entity to prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information. The bill would require a covered entity to maintain and make available to the data subject a location privacy policy that includes specified information on data usage and management and is subject to a specified notice procedure. This bill would make a covered entity that violates these provisions liable for actual or statutory damages and other specified relief. The bill would authorize the Attorney General or other public prosecutors to bring an action to recover a civil penalty against a covered entity that violates these provisions. This bill would require a business, as defined by the CCPA, to comply with the above-described provisions. (2) Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. This bill would prohibit a state or local agency, including an agency as defined under the Information Practices Act, from monetizing, as defined, location information. By imposing new requirements on local agencies, this bill would impose a state-mandated local program. (3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. (4) The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law requires that a local agency that maintains an internet website for use by the public to ensure that the internet website uses a ".gov" top-level domain or a ".ca.gov" second-level domain no later than January 1, 2029. Existing law requires that a local agency that maintains public email addresses to ensure that each email address provided to its employees uses a ".gov" domain name or a ".ca.gov" domain name no later than January 1, 2029. Existing law defines "local agency" for these purposes as a city, county, or city and county. This bill would recast these provisions by instead requiring a city, county, or city and county to comply with the above-described domain requirements and by deleting the term "local agency" from the above-described provisions. The bill would also require a special district, joint powers authority, or other political subdivision to comply with similar domain requirements no later than January 1, 2031. The bill would allow a community college district or community college to use a ".edu" domain to satisfy these requirements, and would specify that these requirements do not apply to a K–12 public school district. By adding to the duties of local officials, the bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
The California AI Transparency Act requires a person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state to make available an AI detection tool at no cost to the user that, among other things, allows a user to assess whether image, video, or audio content, or content that is any combination thereof, was created or altered by the covered provider's generative artificial intelligence system. The California Consumer Privacy Act of 2018 prohibits certain businesses from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, if the consumer is at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, if the consumer is less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer's personal information. This bill, the Leading Ethical AI Development (LEAD) for Kids Act, would, among other things related to the use of certain artificial intelligence systems by children, prohibit a person, partnership, corporation, business entity, or state or local government agency that makes a companion chatbot available to users from making a companion chatbot available to a child unless the companion chatbot is not foreseeably capable of doing certain things that could harm a child, including encouraging the child to engage in self-harm, suicidal ideation, violence, consumption of drugs or alcohol, or disordered eating. The act would authorize the Attorney General to recover a certain civil penalty for a violation of the bill, as prescribed. The act would authorize a child who suffers actual harm as a result of a violation of the bill, or a parent or guardian acting on behalf of that child, to bring a civil action to recover, among other relief, actual damages. This bill would provide that its provisions are severable.
Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections. This bill, beginning January 1, 2027, would require, among other things related to age verification with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. This bill would prohibit an operating system provider or a covered application store from using data collected from a third party in an anticompetitive manner, as specified. This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed. This bill would declare its provisions to be severable.
Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order. Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure. This bill would authorize a survivor, as defined, or a designated representative of a survivor, to submit a device protection request to an account manager, as defined, seeking to terminate a perpetrator's access to a connected device or associated user account. The bill would define "survivor" for these purposes to mean an individual who has had specified criminal acts committed or allegedly committed against them or who cares for another individual against whom those criminal acts have been committed or allegedly committed, as provided. The bill would require an account manager, within 2 business days of receiving a complete device protection request, to terminate or disable the perpetrator's access to the connected device or user account, or to inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or a similar state that removes all account holders, as provided. The bill would specify the requirements for a device protection request and would impose certain requirements on an account manager in processing a request. By providing that a device protection request may include a copy of a signed affidavit, the bill would expand the crime of perjury, and thus impose a state-mandated local program. This bill would require the account manager to clearly describe the process to submit a device protection request on their internet website or mobile application and would prohibit the account manager from providing specified information to the perpetrator. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a survivor or a designated representative of a survivor as confidential and securely dispose of the information, as provided. This bill would authorize enforcement of these provisions by injunction or civil penalty in any court action by any person injured by a violation of those provisions, the Attorney General, a district attorney, county counsel, a city attorney, or a city prosecutor, against an account manager or perpetrator, as provided. The bill would prohibit a waiver of these prohibitions and would declare that these provisions are severable. Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law establishes the Medi-Cal program, which is administered by the State Department of Health Care Services and under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid program provisions. Existing law generally imposes penalties on a person who negligently, willfully, or maliciously discloses the results of a human immunodeficiency virus (HIV) test to a third party in a manner that identifies or provides identifying characteristics of the person to whom the test results apply, as specified. Existing law, notwithstanding the above-described restrictions, authorizes the recording of the HIV test results by the physician who ordered the test in the test subject's medical record and authorizes other disclosure of the results without written authorization of the test subject, or the subject's representative, to the test subject's providers of health care, excluding a regulated health care service plan, for purposes of diagnosis, care, or treatment of the patient. This bill would authorize a provider of health care to disclose the results of an HIV test that identifies or provides identifying characteristics of a Medi-Cal beneficiary without written authorization of the test subject, or the subject's representative, to the Medi-Cal managed care plan to which the beneficiary is assigned, if applicable, and to external quality review organizations conducting external quality reviews of Medi-Cal managed care plans, for the purpose of administering quality improvement programs, including, but not limited to, value-based payment programs and healthy behavior incentive programs, designed to improve HIV care for Medi-Cal beneficiaries. Under the bill, HIV test results that do not identify or provide identifying characteristics of the test subjects would be authorized for disclosure without written authorization by the Medi-Cal managed care plan to departmental staff for the above-described purpose. The bill would make certain clarifying or declaratory statements with regard to related provisions.
