The California Consumer Privacy Act of 2018 grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. The California Financial Information Privacy Act prohibits a financial institution from selling, sharing, transferring, or otherwise disclosing nonpublic personal information to or with any nonaffiliated third parties without the explicit prior consent of the consumer to whom the nonpublic personal information relates, as prescribed. This bill would prohibit a person from selling to a third party personal information of a mortgage applicant that was collected by the person during the mortgage application process.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The CCPA law makes a business, service provider, contractor, or other person that violates the CCPA liable for an administrative fine, as provided. The CCPA creates the Consumer Privacy Fund in the State Treasury and makes moneys in the fund available upon appropriation by the Legislature. Existing law requires 95% of any administrative fine assessed, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Subfund, which is created within the Consumer Privacy Fund. The CCPA law requires the funds to be used exclusively by the agency in carrying out its duties under the CCPA. The CCPA requires the other 5% of any administrative fine, and of the proceeds of any settlement, to be deposited into the Consumer Privacy Grant Subfund, also within the Consumer Privacy Fund, to be used exclusively by the agency to administer and distribute grants to promote and protect consumer privacy, as provided. This bill would authorize a person to submit to the agency, a whistleblower complaint, as defined, and would make the whistleblower eligible for an award if the agency designates a complaint for administrative enforcement and certain requirements are met. The bill would require an eligible whistleblower to receive at least 15% but not more than 33% of the fines collected through an administrative enforcement action or settlement, calculated after the allocation to Consumer Privacy Grant Subfund described above. The bill would require the agency to consider certain factors in determining the amount of the award. The bill would additionally authorize the agency to assess an administrative penalty against a person who violates the CCPA in an amount to cover the reasonable attorney's fees of the whistleblower. This bill would create the Consumer Privacy Whistleblower Subfund within the Consumer Privacy Fund and would require the funds awarded by the agency to a whistleblower or for attorney's fees to be deposited into the Consumer Privacy Whistleblower Subfund. The bill would make those funds available, upon appropriation by the Legislature, for payment to the whistleblower or the whistleblower's attorney, as appropriate. This bill would require the whistleblower, in order to be eligible for a whistleblower award, to meet certain requirements, including that the whistleblower be represented by an attorney and declare under penalty of perjury that the information submitted with the whistleblower complaint is true and correct to the best of the whistleblower's knowledge and belief. The bill would authorize a person to submit a whistleblower complaint anonymously, subject to certain conditions, including that the whistleblower's attorney certify, under penalty of perjury, that the attorney has taken certain actions, including verifying the whistleblower's identity. The bill would make a whistleblower's identify confidential, except as provided, and would exempt disclosure of the whistleblower's identify from the California Public Records Act. By requiring the declarations under penalty of perjury described above, the bill would create new crimes and, thus, impose a state-mandated local program. Under the bill, an employee, contractor, or agent would be entitled to bring a civil action to seek specified relief and damages if the employee, contractor, or agent is subject to specified forms of discrimination in the terms and conditions of their employment because of lawful acts done by the employee, contractor, agent, or associated others in furtherance of a whistleblower complaint or administrative enforcement action under the bill or other efforts to stop one or more violations of the CCPA. The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified. This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business that collects personal information about the consumer disclose to the consumer certain information about that personal information, including the categories of personal information it has collected about that consumer and the specific pieces of personal information it has collected about that consumer. This bill, the Digital Choice Act, would require a social media company or a person that makes an artificial intelligence model available to a third party for use, modification, copying, or combination with other software, defined as a deployer, to allow a consumer to request a copy of the consumer's personal information, contextual data, and social graph and would require the social media company or deployer to respond to that request within five business days in a format that is, among other things, portable to the extent technically feasible. The bill would define "contextual data" to mean information provided by a user to an artificial intelligence model and any context or derivative data associated with the user's interactions with the artificial intelligence model, as specified, and any model-generated or inferred data linked to or generated from those interactions. The bill would define "social graph" to mean data that represents a person's connections and interactions within a social media platform, as specified. This bill would require, among other things, a social media company to implement a transparent, third-party-accessible interoperability interface that allows a user to choose to share a covered user's social graph or user-selected parts of the social graph to a social media platform designated by the user and enable a third party to, with the user's permission, access a social graph created by the user and be notified when a new or updated social graph is available, as prescribed. The bill would require a deployer to implement a third-party-accessible interoperability interface to allow a user to share the user's contextual data directly with other artificial intelligence models as the user designates and enable those artificial intelligence models to be notified when new or updated data is available, as prescribed. This bill would authorize the Attorney General to adopt specified regulations, as provided, and require the Attorney General to enforce the bill's provisions by bringing an administrative action, as specified.
Existing law requires the operator of a private detention facility, as defined, to comply with, and adhere to, the detention standards of care and confinement agreed upon in the facility's contract for operations, as specified. Existing law requires a private detention facility operator to comply with, and adhere to, all local and state public health orders and occupational safety and health regulations. This bill, the Protecting Vulnerable Immigrant Detainees Model Act, would require the Attorney General, on or before December 31, 2027, to submit to the Legislature a report including a proposed oversight plan for private civil detention facilities that protects the health, safety, and welfare of persons detained in those facilities, as specified. The bill would require the Governor to direct the appropriate state entity to cooperate with the Attorney General for the purposes of developing the oversight plan, as specified. The bill would make related findings and declarations. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
Existing law prohibits a public agency, which includes the state, a city, a county, a city and county, or any agency or political subdivision of the state, a city, a county, or a city and county, including, but not limited to, a law enforcement agency, from selling, sharing, or transferring automated license plate recognition (ALPR) information, except to another public agency, and only as otherwise permitted by law. Existing law defines ALPR information as information or data collected through the use of an ALPR system. This bill would provide that "public agency" does not include a transportation agency, a public transit operator, department of transportation, public works department, or campus transportation agency, as specified, a public agency or contracted parking operator when engaging in specified activities in a parking facility, a state agency operating specified parking facilities, or the State Air Resources Board. The bill would require a public agency that accesses or provides access to ALPR information to maintain a record of that access, as provided. The bill would, beginning January 1, 2027, require new, updated, renewed, extended, expansions of, or addendums of contractual agreements with ALPR vendors, manufacturers, or suppliers to mandate that no default access is provided to any national ALPR database and that an agency's collected scans are by default not accessible to any other agency, except as specified, and would impose new requirements on sharing between California state law enforcement agencies. This bill would authorize a law enforcement agency to use ALPR information only for purposes of locating vehicles or persons when either are reasonably suspected of being involved in the commission of a public offense or locating an individual who has been reported as missing to a law enforcement agency. The bill, as of January 1, 2028, would require a public agency to archive all ALPR information that has been held for more than 60 days within 14 days, unless that ALPR information is retained in the evidence file of an active investigation or criminal proceeding or matches information on an authorized hot list, as defined, and retain ALPR information that becomes part of an investigation or criminal proceeding in the evidence file as long as the evidence file is required to be held by state law or court order. The bill would prohibit a public agency from querying any archived information except pursuant to a warrant, as specified. By imposing new requirements on public agencies, which include local agencies, this bill would impose a state-mandated local program. Existing law defines an ALPR operator as a person that operates an ALPR system, which does not include a transportation agency. Existing law defines an ALPR end-user as a person that accesses or uses an ALPR system, which does not include, among other things, a transportation agency. This bill would additionally exclude from the definitions of "ALPR operator" and "ALPR end-user" a public transit operator, department of transportation, public works department, campus transportation agency, or an airport or airport operator, as provided. The bill would also exclude from the definition of "ALPR operator" the Department of General Services and its operators when engaging in specified activities in a parking facility and would exclude from the definition of "ALPR end-user" a state agency operating specified parking facilities and the State Air Resources Board. Existing law requires an ALPR operator and ALPR end-user to maintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure. This bill would require those security procedures and practices to include safeguards for managing which employees can see the data from their systems, as specified, and requiring data security training and data privacy training for all employees that access ALPR information. Existing law requires an ALPR operator and ALPR end-user to implement a usage and privacy policy that includes, among other things, a description of the job title or other designation of the employees and independent contractors who are authorized to access and use ALPR information. This bill would require the usage and privacy policy to identify what purpose employees and independent contractors access and use ALPR information for. The bill would also require the Department of Justice to, beginning October 1, 2029, and contingent upon an appropriation of sufficient funds, conduct annual random audits on a public agency that is an ALPR operator or ALPR end-user to determine whether they have implemented and are adhering to that usage and privacy policy. Existing law requires an ALPR operator that accesses or provides access to ALPR information to require that ALPR information only be used for the authorized purposes described in the usage and privacy policy and to maintain a record of that access that includes, among other things, the purpose for accessing the information. This bill would instead require that record of access maintained by the ALPR operator to include a brief, accurate, specific, and plain language statement describing the purpose for accessing ALPR information. The bill would include findings that changes proposed by this bill address a matter of statewide concern rather than a municipal affair and, therefore, apply to all cities, including charter cities. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law establishes various privacy protections relating to the collection, use, sale, or distribution of personal information, images, or video recordings, including restrictions relating to the retention, access, use, sale, or sharing of images or video recordings collected through the operation of an in-vehicle camera. This bill would prohibit a security surveillance company, as defined, from distributing, selling, or otherwise authorizing a third party to access, use, or distribute content obtained from a consumer's security surveillance system without first obtaining the express consent of the consumer and the adult residents of a residential rental property or upon receipt of an order of a court or arbitrator.
Existing law requires the Attorney General to establish and maintain various databases and information centers relating to the identification, apprehension, and prevention of crimes, including the Violent Crime Information Center and the Automated Firearms System, among others. Existing law requires a business that controls the collection of a consumer's personal information to delete that information upon the request of the consumer and provides for administrative penalties if the business fails to act on the consumer's request. This bill would, beginning January 1, 2029, require the Department of Justice to establish the Nonconsensual Intimate Image Clearinghouse to allow individuals who were exploited in California to submit a request for the removal of nonconsensual intimate images from covered platforms. The bill would define nonconsensual intimate images to include an authentic image depicting a person nude or engaging in sexual conduct distributed without consent or an image digitally altered or generated by artificial intelligence realistically depicting a person nude or engaged in sexual conduct without consent. The bill would require the department to transmit verified identifiers of images to covered platforms and require those platforms to remove verified matches within 48 hours of receipt and to prevent the images from being uploaded again. The bill would require the department to enforce these provisions and would impose civil penalties for violations. The bill would require a peace officer in the investigation of a specified offense to advise a victim that they may make a request to the clearinghouse pursuant to these provisions and would require a peace officer to provide certain information to the clearinghouse, as specified. By increasing duties for peace officers, this bill would impose a state-mandated local program. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law, the California Age-Appropriate Design Code Act, requires a business that provides an online service, product, or feature likely to be accessed by children to comply with certain requirements, including, among other things, prohibiting the business from collecting, selling, sharing, or retaining any personal information that is not necessary to provide the online service, product, or feature, except as specified. Existing law imposes specified civil penalties upon a business that violates these provisions. This bill would repeal the above-described act and would instead impose similar provisions without the above-referenced exceptions and would impose civil penalties for a violation of these provisions. The bill would require a business that provides an online product or service likely to be accessed by children to take reasonable steps to prevent specified risks of harm to children. The bill would authorize a child to void any provision of a contract that was entered into by the child or their parent or guardian as a result of a design feature of the online product or service. The bill would authorize the Attorney General or a public prosecutor to bring a civil action for a violation of these provisions, as specified.
Existing law prohibits the false impersonation of another person in either that person's personal or official capacity with the intent to steal or defraud, as specified. Existing law protects all people from defamation, including libel and slander, as provided. Existing law makes any person who knowingly uses another's name, voice, signature, photograph, or likeness for commercial purposes, as specified, without that person's prior consent liable for damages, as specified. Existing law provides that a party seeking relief pursuant to those provisions may also seek an injunction or temporary restraining order according to specified procedures. This bill would enact the Digital Dignity Act. The act would subject to specified liability a person who, by distributing content with actual knowledge that the content includes a digital replica, is found guilty of violating a criminal provision for which false impersonation of another is a required element, as prescribed, or is found liable in a civil action arising from the use or portrayal through a digital replica, as provided. The Digital Dignity Act would require a large online platform that includes a generative AI tool, as defined, that provides users with the functionality to create a digital replica of other individuals to provide a mechanism for individuals to report content that violates the platform's terms of service or a provision of law relating to the individual's digital replica and to submit to the large online platform any certified court order or judgment ordering the removal of any content involving the individual's digital replica on the platform or finding that content involving the individual's digital replica was defamatory, fraudulent, or any other form of image appropriation not permitted by law, as prescribed. Upon receipt of the court order or judgment, the act would require the large online platform to remove the digital replica and make reasonable efforts to identify and remove any known identical copies. The act would authorize a city attorney or the Attorney General to bring a civil action to enforce these provisions and to seek a specified civil penalty and injunctive relief. The act would require a generative AI tool provider to maintain, for no less than 90 days, records sufficient to allow compliance with a court order issued pursuant to a civil action by the city attorney or Attorney General, as prescribed.
Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants to a consumer various rights with respect to personal information that is collected by a business. Existing law, the California Privacy Rights Act of 2020 (CPRA) , an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines "data broker" to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. This bill would define a "direct relationship" as, among other things, when a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business's products or services. The bill would specify circumstances when a data broker does not have a "direct relationship," including if it sells personal information outside of a "first-party" interaction with the consumer. The bill would define a "first party" as a consumer-facing business with which the consumer intends and expects to interact. Existing law requires a data broker, in registering with the agency, to provide specified information, including, among other things, whether the data broker collects the personal information of minors or a consumer's reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor. This bill would require a data broker to provide additional information to the agency regarding whether the data broker sells inferences about the attributes of the consumer based on their analysis of specified data, including the personal information of minors and a consumer's reproductive health care data. Existing law establishes the Office of Data and Innovation (office) within the Government Operations Agency with a mission to deliver better government services to the people of California through technology and service innovation, data, and design. This bill would require the office to establish a privacy preference tool to enable a consumer to define and store a privacy preference profile regarding data broker data collection and use practices, among other things. The bill would require the tool to, among other things, evaluate relevant privacy, data management, and practice and policies against the consumer's preference profile. The bill would require the office to make the online tool available to other state agencies, including the agency. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
