AB 1008: California Consumer Privacy Act of 2018: personal information.
- Session Year: 2023-2024
- House: Assembly
- Latest Version Date: 2024-09-28
Current Status:
Passed
(2024-09-28: Chaptered by Secretary of State - Chapter 802, Statutes of 2024.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
What does this bill do?
The bill changes California law for consumers and businesses that collect consumer data by clarifying that "personal information" can exist in many formats — physical (paper, tapes), digital (text, images, audio, video), or abstract digital forms (compressed or encrypted files, metadata, or outputs from AI systems). It also adds "neural data" — information generated by measuring activity of a person’s brain or nervous system — to the list of sensitive personal information.
The summary is provided by generative AI which can make mistakes. For original language, please view the details in the table below.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including by requiring a business that controls the collection of a consumers personal information to, at or before the point of collection, make certain disclosures to the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA.
This bill would specify that personal information can exist in various formats.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by SB 1223 to be operative only if this bill and SB 1223 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including by requiring a business that controls the collection of a consumers personal information to, at or before the point of collection, make certain disclosures to the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA.
This bill would specify that personal information can exist in various formats.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by SB 1223 to be operative only if this bill and SB 1223 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including by requiring a business that controls the collection of a consumers personal information to, at or before the point of collection, make certain disclosures to the consumer. The CCPA excludes from the definition of personal information publicly available information or lawfully obtained, truthful information that is a matter of public concern and defines publicly available for that purpose to mean, among other things, information that is lawfully made available from federal, state, or local government records or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, except as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA.
This bill would specify that personal information can exist in various formats.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by SB 1223 to be operative only if this bill and SB 1223 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including by requiring a business that controls the collection of a consumers personal information to, at or before the point of collection, make certain disclosures to the consumer. The CCPA excludes from the definition of personal information publicly available information or lawfully obtained, truthful information that is a matter of public concern and defines publicly available for that purpose to mean, among other things, information that is lawfully made available from federal, state, or local government records or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, except as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA.
This bill would specify that publicly available does not include information gathered from internet websites using automated mass data extraction techniques and would specify that personal information can exist in various formats.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including by requiring a business that controls the collection of a consumers personal information to, at or before the point of collection, make certain disclosures to the consumer. The CCPA excludes from the definition of personal information publicly available information or lawfully obtained, truthful information that is a matter of public concern and defines publicly available for that purpose to mean, among other things, information that is lawfully made available from federal, state, or local government records or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, except as prescribed. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The CCPA establishes the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA.
This bill would specify that publicly available does not include information gathered from internet websites using automated mass data extraction techniques and would specify that personal information can exist in various formats.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Under existing law, the Department of Fish and Wildlife (department) has jurisdiction over the conservation, protection, and management of fish, wildlife, native plants, and habitat necessary for biologically sustainable populations of those species. Existing law, the California Endangered Species Act, requires the Fish and Game Commission (commission) to establish a list of endangered species and a list of threatened species and to add or remove species from either list if it finds, upon the receipt of sufficient scientific information, as specified, that the action is warranted. The act prohibits the taking of an endangered or threatened species, except in certain situations. Under the act, the department may authorize the taking of listed species pursuant to an incidental take permit if the taking is incidental to an otherwise lawful activity, the impacts are minimized and fully mitigated, and the issuance of the permit would not jeopardize the continued existence of the species. A violation of the provisions of the Fish and Game Code is a crime.This bill, the Western Joshua Tree Conservation Act, would prohibit any person or public agency from importing into the state, exporting out of the state, or taking, possessing, purchasing, or selling within the state, a western Joshua tree or any part or product of the tree, except as provided pursuant to existing law or by paying a specified fee. The bill would also specify certain take authorizations during any period in which the western Joshua tree has been designated by the commission as a candidate for listing under the California Endangered Species Act (CESA), if the commission lists the western Joshua tree as endangered or threatened pursuant to the CESA, and upon the approval of a natural community conservation plan in which the western Joshua tree is a covered species, as provided. Because a violation of these provisions would be a crime, this bill would impose a state-mandated local program.This bill, among other things, would authorize the department to authorize, by permit, the taking of a western Joshua tree if specified conditions are met, including, but not limited to, that the permittee mitigates all impacts to, and taking of, the western Joshua tree. The bill would authorize, in lieu of completing the mitigation measures on its own, a permittee to elect to satisfy the mitigation obligation by paying a fee pursuant to a specified fee schedule. The bill would require all fees remitted to the department pursuant to these provisions to be deposited into the Western Joshua Tree Conservation Fund, as provided. The bill would require the moneys in the fund, upon appropriation by the Legislature, to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree. The bill would authorize the department to enter into an agreement with any county or city to delegate to the county or city the ability to authorize the taking of a western Joshua tree associated with developing single-family residences, accessory structures, and public works projects, as defined, concurrent with its approval of the project. The bill would authorize the department to issue a permit to authorize the removal or trimming of a dead western Joshua tree or the trimming of a live western Joshua tree, as provided.This bill would require the department to develop and implement a western Joshua tree conservation plan in collaboration with governmental agencies, California Native American tribes, and the public. The bill would require the department to present the final conservation plan at a public meeting of the commission, for its review and approval, by December 31, 2024, and would require the commission to take final action on the plan by June 30, 2025. The bill would require the department to submit an annual report to the commission and the Legislature addressing the conservation status of the western Joshua tree, as provided.This bill would require the commission, beginning in 2026, and at least every 4 years thereafter, to, at a public meeting, review the status of the western Joshua tree and the effectiveness of the conservation plan, as specified. The bill would also make its provisions severable.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Under existing law, the Department of Fish and Wildlife (department) has jurisdiction over the conservation, protection, and management of fish, wildlife, native plants, and habitat necessary for biologically sustainable populations of those species. Existing law, the California Endangered Species Act, requires the Fish and Game Commission (commission) to establish a list of endangered species and a list of threatened species and to add or remove species from either list if it finds, upon the receipt of sufficient scientific information, as specified, that the action is warranted. The act prohibits the taking of an endangered or threatened species, except in certain situations. Under the act, the department may authorize the taking of listed species pursuant to an incidental take permit if the taking is incidental to an otherwise lawful activity, the impacts are minimized and fully mitigated, and the issuance of the permit would not jeopardize the continued existence of the species. A violation of the provisions of the Fish and Game Code is a crime.
This bill, the Western Joshua Tree Conservation Act, would prohibit any person or public agency from importing into the state, exporting out of the state, or taking, possessing, purchasing, or selling within the state, a western Joshua tree or any part or product of the tree, except as provided pursuant to existing law or by paying a specified fee. The bill would also specify certain take authorizations during any period in which the western Joshua tree has been designated by the commission as a candidate for listing under the California Endangered Species Act (CESA), if the commission lists the western Joshua tree as endangered or threatened pursuant to the CESA, and upon the approval of a natural community conservation plan in which the western Joshua tree is a covered species, as provided. Because a violation of these provisions would be a crime, this bill would impose a state-mandated local program.
This bill, among other things, would authorize the department to authorize, by permit, the taking of a western Joshua tree if specified conditions are met, including, but not limited to, that the permittee mitigates all impacts to, and taking of, the western Joshua tree. The bill would authorize, in lieu of completing the mitigation measures on its own, a permittee to elect to satisfy the mitigation obligation by paying a fee pursuant to a specified fee schedule. The bill would require all fees remitted to the department pursuant to these provisions to be deposited into the Western Joshua Tree Conservation Fund, as provided. The bill would require the moneys in the fund, upon appropriation by the Legislature, to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree. The bill would authorize the department to enter into an agreement with any county or city to delegate to the county or city the ability to authorize the taking of a western Joshua tree associated with developing single-family residences, accessory structures, and public works projects, as defined, concurrent with its approval of the project. The bill would authorize the department to issue a permit to authorize the removal or trimming of a dead western Joshua tree or the trimming of a live western Joshua tree, as provided.
This bill would require the department to develop and implement a western Joshua tree conservation plan in collaboration with governmental agencies, California Native American tribes, and the public. The bill would require the department to present the final conservation plan at a public meeting of the commission, for its review and approval, by December 31, 2024, and would require the commission to take final action on the plan by June 30, 2025. The bill would require the department to submit an annual report to the commission and the Legislature addressing the conservation status of the western Joshua tree, as provided.
This bill would require the commission, beginning in 2026, and at least every 4 years thereafter, to, at a public meeting, review the status of the western Joshua tree and the effectiveness of the conservation plan, as specified. The bill would also make its provisions severable.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Existing law requires the Fish and Game Commission, in cooperation with the Department of Food and Agriculture, to adopt regulations governing both the entry, importation, possession, transportation, keeping, confinement, or release of any and all wild animals that will be or that have been imported into this state, and the possession of all other wild animals, and requires that those regulations be designed, among other things, to provide for the welfare of wild animals. Existing law requires that the regulations also include criteria for specified administrative acts, including the receiving, processing, and issuing of permits. Under existing regulations, these permits are issued by the Department of Fish and Wildlife.This bill would require the commission to include in these regulations provisions requiring that the permits be renewed at least every 5 years and that permit applicants show proof of current liability insurance and a surety bond, as specified.Existing law makes it unlawful to submit, or to conspire to submit, any false, inaccurate, or otherwise misleading information on any application offered or otherwise presented to the Department of Fish and Wildlife. Under existing law, a violation of any regulation made or adopted under the Fish and Game Code is a misdemeanor, except as specified. Because submitting, or conspiring to submit, false, inaccurate, or otherwise misleading information to the department in these permit applications would be a crime, and because failing to renew these permits every 5 years would be a crime, as provided, this bill would impose a state-mandated local program.The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.This bill would provide that no reimbursement is required by this act for a specified reason.Existing law requires the Fish and Game Commission, in cooperation with the Department of Food and Agriculture, to adopt regulations governing both the entry, importation, possession, transportation, keeping, confinement, or release of any and all wild animals that will be or that have been imported into this state, and the possession of all other wild animals, and requires that those regulations be designed, among other things, to provide for the welfare of wild animals. Existing law requires that the regulations also include criteria for specified administrative acts, including the receiving, processing, and issuing of permits. Under existing regulations, these permits are issued by the Department of Fish and Wildlife.
This bill would require the commission to include in these regulations provisions requiring that the permits be renewed at least every 5 years and that permit applicants show proof of current liability insurance and a surety bond, as specified.
Existing law makes it unlawful to submit, or to conspire to submit, any false, inaccurate, or otherwise misleading information on any application offered or otherwise presented to the Department of Fish and Wildlife. Under existing law, a violation of any regulation made or adopted under the Fish and Game Code is a misdemeanor, except as specified. Because submitting, or conspiring to submit, false, inaccurate, or otherwise misleading information to the department in these permit applications would be a crime, and because failing to renew these permits every 5 years would be a crime, as provided, this bill would impose a state-mandated local program.
The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.
This bill would provide that no reimbursement is required by this act for a specified reason.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and SB 1223. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after SB 1223, in which case Section 1 of this bill shall not become operative.
SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and SB 1223. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after SB 1223, in which case Section 1 of this bill shall not become operative.
SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and SB 1223. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after SB 1223, in which case Section 1 of this bill shall not become operative.
SEC. 2.SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (11) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean either of the following: biometric information collected by a business about a consumer without the consumers knowledge.
(I)Biometric information collected by a business about a consumer without the consumers knowledge.(II)Information gathered from internet websites using automated mass data extraction techniques.(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or the model weights of artificial neural networks. artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (11) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the Internet, internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean either of the following:
(I)Biometric information collected by a business about a consumer without the consumers knowledge.
(II)Information gathered from internet websites using automated mass data extraction techniques.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or the model weights of artificial neural networks.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
All matter omitted in this version of the bill appears in the bill as amended in the Assembly, April 13, 2023. (JR11)This chapter shall be known, and may be cited as, the Western Joshua Tree Conservation Act.
1927.1.For purposes of this chapter, the following definitions apply:
(a)Accessory structure means a subordinate structure, the use of which is incidental to an existing or contemporaneously constructed single-family residence, including an accessory dwelling unit, addition to an existing single-family residence, garage, carport, swimming pool, patio, greenhouse, storage shed, gazebo, septic tank, sewer connection, solar panels, fence, or gravel or paved driveway.
(b)California Endangered Species Act means the act established pursuant to Chapter 1.5 (commencing with Section 2050) of Division 3.
(c)Conserve or conservation means to use, and the use of, methods and procedures that are necessary to bring species listed pursuant to Chapter 1.5 (commencing with Section 2050) of Division 3 to the point at which the measures provided pursuant to Chapter 1.5 (commencing with Section 2050) of Division 3 are no longer necessary, and for species that are not listed to maintain or enhance the condition of the species so that listing will not become necessary.
(d)Dead western Joshua tree means a western Joshua tree that is dead or has been damaged beyond repair or where not enough live tissue, green leaves, limbs, or branches exist to sustain the trees life.
(e)Desert native plant specialist means an arborist certified by the International Society of Arborists, or an individual with at least five years of professional experience with relocation or restoration of native California desert vegetation.
(f)Fund means the Western Joshua Tree Conservation Fund as described in Section 1927.5.
(g)Fee means the elective fee described in subdivisions (d) and (e) of Section 1927.3, which is to be deposited into the fund.
(h)Public works project means a project involving the erection, construction, alteration, repair, or improvement of any public structure, building, road, or other public improvement of any kind.
(i)Relocated or relocation means the removal of a living western Joshua tree and a sufficient portion of its root mass from the ground and transplanting it.
(j)Single-family residence means a single detached building that has been, or will be, constructed and used as living facilities, including provisions for sleeping, eating, cooking, and sanitation, as required by the California Building Standards Code, for not more than one household.
(k)Western Joshua tree means Yucca brevifolia, an evergreen, tree-like plant that has been treated as a member of the asparagus family (Asparagaceae).
1927.2.(a)No person or public agency shall import into this state, export out of this state, or take, possess, purchase, or sell within this state, a western Joshua tree or any part or product of the tree, except as authorized pursuant to this chapter, Chapter 1.5 (commencing with Section 2050) of Division 3, or Chapter 10 (commencing with Section 2800) of Division 3.
(b)During any period in which the western Joshua tree has been designated by the commission as a candidate for listing under the California Endangered Species Act, any person or public agency seeking a take authorization for the western Joshua tree may obtain a take authorization as provided by Sections 2081 and 2084, or by electing to pay the fees set forth in Section 1927.3.
(c)If the commission lists the western Joshua tree as endangered or threatened pursuant to the California Endangered Species Act, the authorization of take of a western Joshua tree shall only be under Chapter 1.5 (commencing with Section 2050) of Division 3 or pursuant to subdivision (d).
(d)Upon the approval of a natural community conservation plan in which the western Joshua tree is a covered species, the authorization of take of a western Joshua tree shall only be under Chapter 10 (commencing with Section 2800) of Division 3.
(e)The provisions of the Native Plant Protection Act (Chapter 10 (commencing with Section 1900)), and the California Desert Native Plants Act (Division 23 (commencing with Section 80001) of the Food and Agricultural Code), shall not apply to the western Joshua tree.
(f)This section shall not preclude the department from authorizing, by permit or memorandum of understanding, the taking, possession, purchase, or sale within the state of a western Joshua tree to aid the conservation and recovery of the western Joshua tree, or entering into memoranda of understanding with California Native American tribes to provide for the taking and possession of western Joshua trees for tribal cultural purposes, or as otherwise required by applicable law.
(g)Any authorization issued by the department pursuant to Section 2081 or 2084, before the enactment of this chapter, to import, export, take, possess, purchase, or sell a western Joshua tree shall be valid and remain in effect for not more than five years after the enactment of this chapter.
1927.3.(a)The department may authorize, by permit, the taking of a western Joshua tree if all of the following conditions are met:
(1)The permittee submits to the department for its approval a census of all western Joshua trees on the project site, including size information and photographs, that categorize the western Joshua trees according to the following size classes:
(A)Less than one meter in height.
(B)One meter or greater but less than five meters in height.
(C)Five meters or greater in height.
(2)The permittee avoids and minimizes impacts to, and the taking of, the western Joshua tree to the maximum extent practicable. Minimization may include trimming, encroachment on root systems, relocation, or other actions that result in detrimental but nonlethal impacts to a western Joshua tree.
(3)The permittee mitigates all impacts to, and taking of, the western Joshua tree. When various measures are available to meet this obligation, the measures required shall maintain the permittees objectives to the greatest extent possible. All required measures shall be capable of successful implementation. The permittee shall ensure adequate funding to implement the mitigation measures. In lieu of completing the mitigation obligation on its own, the permittee may elect to satisfy this mitigation obligation by paying fees, pursuant to the fee schedule in subdivision (d) or (e), for deposit into the fund.
(4)(A)The department may require the permittee to relocate one or more of the western Joshua trees. The permittee shall implement measures to assist the survival of relocated trees and shall comply with any other reasonable measures required by the department to facilitate the successful relocation and survival of the western Joshua trees, including, but not limited to:
(i)A requirement that the relocated western Joshua tree is placed in a location and with proper orientation to improve its survival.
(ii)A requirement that western Joshua trees are relocated between October and March.
(iii)Adherence to performance criteria to ensure that relocated trees have at least an 80-percent survivability rate.
(iv)A requirement that a desert native plant specialist be on site to oversee relocation.
(B)The department may limit relocation to certain size classes of trees.
(b)For purposes of this section, each western Joshua tree stem or trunk arising from the ground shall be considered an individual tree requiring mitigation, regardless of its proximity to any other western Joshua tree stem or trunk.
(c)The department may enter into an agreement with any county or city to delegate to the county or city the ability to authorize the taking of a western Joshua tree associated with developing single-family residences, accessory structures, and public works projects concurrent with its approval of the project, if all of the following conditions are met:
(1)The county or city adopts an ordinance that requires as a condition of any approval or permit issued under the authority of an agreement entered into pursuant to this subdivision satisfaction of the requirements of this chapter.
(2)Except as provided otherwise in this subdivision, the county or city ensures that the permittee satisfies all of the requirements of subdivision (a) of this section.
(3)The project will take no more than 10 individual western Joshua trees or 10 percent of the individual western Joshua trees, whichever is less, on the project site where the project proponent proposes to construct a single-family residence or accessory structure, or no more than 40 individual western Joshua trees or 10 percent of the individual western Joshua trees, whichever is less, on the project site on which a public agency proposes to undertake a public works project.
(4)The county or city shall collect any fees for permits issued and remit them quarterly to the fund as directed by the department.
(5)The county or city entering into an agreement pursuant to this subdivision may impose a reasonable fee to cover the administrative costs of issuing the permit.
(6)The department retains express authority to suspend or revoke the county or citys take authorization in the event the department determines the county or city has violated the terms of the agreement or this chapter, the county or city fails to implement or enforce the terms of the agreement or this chapter, or the department determines that the local population of western Joshua trees within, or in the vicinity of, that county or city needs further protection. The city or county shall conduct an annual assessment of the status of the local population within the city or county and submit the assessment to the department. The department shall determine if the population needs further protection in order to provide for the conservation of the species.
(7)The county or city shall be required to submit to the department quarterly reports documenting the number of permits issued, the number and size class of western Joshua trees authorized to be taken, the number of western Joshua trees encroached upon, the number of western Joshua trees lethally removed, the number and location of western Joshua trees relocated, the amount of fees collected, and other information required by the department in the agreement.
(d)The department may approve any person or public agency receiving a take authorization pursuant to this chapter for a project that meets the criteria set forth in paragraph (1) to satisfy the mitigation obligation provided for in paragraph (3) of subdivision (a), by paying the fees in the amounts provided in paragraph (2) for deposit into the fund.
(1)Any project in the area bounded by the intersection of Highway 58 and Interstate 5, then east along Highway 58 to the intersection of Interstate 15, then north along Interstate 15 to the intersection of Highway 247, then south along Highway 247 to the intersection of Highway 18, then west along Highway 18 to the intersection of Highway 138, then west and north along Highway 138 to the intersection of Interstate 5, then north along Interstate 5 to Highway 58.
(2)(A)One thousand dollars ($1,000) for each western Joshua tree five meters or greater in height.
(B)Three hundred dollars ($300) for each western Joshua tree less than five meters in height.
(e)The department may approve any person or public agency receiving a take authorization pursuant to this chapter for a project that meets the criteria set forth in paragraph (1) to satisfy the mitigation obligation provided for in paragraph (3) of subdivision (a), by paying the fees in the amounts provided in paragraph (2) for deposit into the fund.
(1)(A)Notwithstanding paragraph (1) of subdivision (d), any project within two miles of Joshua Tree National Park, or any unit of the state park system.
(B)Any project that does not meet the criteria set forth in paragraph (1) of subdivision (d).
(2)(A)Two thousand five hundred dollars ($2,500) for each western Joshua tree five meters or greater in height.
(B)Five hundred dollars ($500) for each western Joshua tree less than five meters in height.
(f)Upon request, the department may authorize a reduction in the amount of the fees prescribed by subdivisions (d) and (e) for any western Joshua tree conserved by a project proponent through the acquisition of compensatory habitat mitigation land otherwise required by law for the project.
(g)(1)The permittee shall bear responsibility for implementing measures to assist the survival of trees relocated pursuant to paragraph (4) of subdivision (a).
(2)Unless specifically required by written agreement, a landowner that agrees in writing to allow western Joshua trees to be relocated onto land it owns shall not be liable for the continued survival of the western Joshua trees, shall not be required to manage or maintain the translocated western Joshua trees, and shall not be required to change existing land use practices, provided that the land use practices do not result in the taking, possession, sale, or further translocation of the western Joshua trees.
1927.4.(a)The department may issue a permit to authorize either the removal or trimming of dead western Joshua trees or the trimming of live western Joshua trees.
(1)Upon receipt of a permit and payment of any applicable administrative fees, a property owner or its agent may remove a detached dead western Joshua tree or the detached limb of a western Joshua tree. All other removals and all trimming of western Joshua trees authorized by permits issued pursuant to this subdivision shall be completed by a desert native plant specialist.
(2)The department may issue permits pursuant to this section, without payment of fees or other mitigation, provided that the dead western Joshua trees or any limbs to be removed meet one of the following:
(A)Have fallen over and are within 30 feet of a structure.
(B)Are leaning against an existing structure.
(C)Create an imminent threat to public health or safety.
(3)A property owner seeking a permit pursuant to this subdivision shall submit a permit request to the department on a form to be provided by the department that requires the following information:
(A)The name, telephone number, mailing address, and email address of the property owner seeking the permit.
(B)The street address of the property on which the western Joshua trees to be removed or trimmed are located. If no street address is available, the property owner shall include the assessors parcel number.
(C)Photographs of the western Joshua trees that visually depict the dead trees or the trees to be trimmed and that demonstrate that the western Joshua tree meets one or more of the requirements of paragraph (2).
(D)A signed attestation from the property owner or signed certification by a desert native plant specialist that the tree meets the definition of a dead western Joshua tree.
(4)(A)Within 30 days of receipt of a request for a permit pursuant to subparagraph (A) or (B) of paragraph (2), the department shall either issue a permit allowing for the removal or trimming, or deny the request if the request does not demonstrate a permit can be issued pursuant to this section.
(B)Within 10 days of receipt of a request for a permit pursuant to subparagraph (C) of paragraph (2), the department shall either issue a permit allowing for the removal or trimming, or deny the request if the request does not demonstrate a permit can be issued pursuant to this section.
(C)If the department issues a permit, it shall provide the property owner 60 days in which to complete the removal or trimming. The department may extend this 60-day period in writing at its discretion.
(D)If the department denies the permit request, the property owner may resubmit the request with additional information and photographs. Resubmissions pursuant to this subdivision shall be processed as new permit requests.
(5)Within 30 days of completing the removal or trimming of one or more western Joshua trees in accordance with a permit issued pursuant to this section, the property owner shall submit, by mail or email, photographs of the site at which the western Joshua trees were removed or trimmed pursuant to the permit.
(b)The department may enter into an agreement with any county or city to delegate to the county or city the ability to authorize the removal or trimming of dead western Joshua trees or the trimming of live western Joshua trees, provided that the county or city ensures that all permits issued satisfy the requirements of subdivision (a). The county or city shall be required to submit to the department quarterly reports documenting the number of permits issued, the number and size class of western Joshua trees authorized to be removed or trimmed, and any other information specified in the agreement with the department. A county or city entering into an agreement pursuant to this subdivision may impose a reasonable fee to cover the administrative costs of issuing the permit.
(c)The department retains express authority to suspend or revoke an agreement with any county or city to delegate to the county or city the ability to authorize the removal or trimming of dead western Joshua trees or the trimming of live western Joshua trees in the event the department determines the county or city has violated the terms of the agreement or this chapter, the county or city fails to implement or enforce the terms of the agreement or this chapter, or the department determines that the local population of western Joshua trees within, or in the vicinity of, that county or city needs further protection. A city or county that has entered into an agreement with the department shall conduct an annual assessment of the status of the local population within the city or county and submit the assessment to the department. The department shall determine if the population needs further protection in order to provide for the conservation of the species.
1927.5.(a)The Western Joshua Tree Mitigation Fund, created by the commission pursuant to Section 749.10 of Title 14 of the California Code of Regulations, is hereby continued in existence by this chapter and is renamed the Western Joshua Tree Conservation Fund. Upon appropriation by the Legislature, any moneys in the fund shall be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree.
(b)All fees remitted to the department pursuant to this chapter shall be deposited into the fund.
(c)The fund may also receive other funding to support the conservation of the western Joshua tree.
1927.6.(a)The department shall develop and implement a western Joshua tree conservation plan in collaboration with the commission, governmental agencies, California Native American tribes, and the public. The conservation plan shall incorporate a description of management actions necessary to conserve the western Joshua tree and objective, measurable criteria to assess the effectiveness of such actions. The conservation plan shall also include guidance for the avoidance and minimization of impacts to western Joshua trees and protocols for the successful relocation of western Joshua trees. The department shall present a complete draft conservation plan at a public meeting of the commission, for its review and approval, by December 31, 2024. The commission shall take final action on the conservation plan by June 30, 2025. The department and commission shall, if necessary, periodically update the conservation plan to ensure the conservation of the species.
(b)When developing the conservation plan, the department shall consult with California Native American tribes, include co-management principles in the plan, provide for the relocation of western Joshua trees to tribal lands upon a request from a tribe, and ensure traditional ecological knowledge is incorporated into the plan.
(c)The department, pursuant to Section 1927.5, shall use any fees deposited into the fund for the purpose of addressing threats to the western Joshua tree, including, but not limited to, acquiring, conserving, and managing western Joshua tree conservation lands. The department shall prioritize actions and acquiring and managing lands that are identified as appropriate for western Joshua tree conservation in any department-approved conservation plan, including, but not limited to, the conservation plan required by subdivision (a), a regional conservation assessment, a regional conservation investment strategy, or a conceptual area protection plan.
(d)(1)The department may retain one or more consultants to assist in locating, acquiring, conserving, and managing conservation lands and completing other mitigation actions to implement subdivision (c).
(2)Chapter 1 (commencing with Section 10100) of Part 2 of Division 2 of the Public Contract Code, Chapter 2 (commencing with Section 10290) of Part 2 of Division 2 of the Public Contract Code, Chapter 10 (commencing with Section 4525) of Division 5 of Title 1 of the Government Code, and Part 5.5 (commencing with Section 14600) of Division 3 of Title 2 of the Government Code, Division 13 (commencing with Section 21000) of the Public Resources Code shall not apply to any action by the department to implement subdivision (c).
1927.7.(a)Beginning in 2025, by January 31 of each calendar year, the department shall submit an annual report to the commission and the Legislature assessing the conservation status of the western Joshua tree, including, but not limited to, by detailing the number of permits issued, the number and size class of western Joshua trees authorized to be taken, the number of western Joshua trees lethally removed, the number and location of western Joshua trees relocated, the type, scope, and scale of mitigation measures undertaken by permittees, the amount of fees paid, the amount of all expenditures from the fund, the projects and actions funded by expenditures from the fund, the adequacy of the fees to conserve the western Joshua tree, actions taken pursuant to the conservation plan, and other relevant information. The departments annual report shall summarize the information provided by counties and cities pursuant to agreements entered into pursuant to subdivision (c) of Section 1927.3 and subdivision (b) of Section 1927.4.
(b)The report to the Legislature shall be submitted in accordance with Section 9795 of the Government Code.
1927.8.(a)Beginning in 2026, and at least every four years thereafter, the commission shall review the status of the western Joshua tree and the effectiveness of the conservation plan in conserving the species at a public meeting to be held prior to August 31. Concurrent with each review conducted pursuant to this section, the department shall make recommendations to the commission, as necessary, for amendments to the conservation plan to ensure the conservation of the western Joshua tree.
(b)The department shall annually adjust the fees provided for in Section 1927.3 pursuant to Section 713. By December 31, 2026, and every four years thereafter, the department shall adopt and subsequently amend regulations pursuant to Section 702 adjusting the fees as necessary to ensure the conservation of the species.
1927.9.This chapter is not intended to be construed as, or to be a general project approval. It shall be the responsibility of each project proponent receiving approval from the department under this chapter to obtain all necessary permits and approvals and to comply with all applicable federal, state, and local laws.
1927.10.This chapter does not preclude a county or city from adopting and enforcing ordinances that require as a condition of approving a project more protective measures designed to conserve the western Joshua tree.
SEC. 2.The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
SEC. 3.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
SECTION 1.Section 2120 of the Fish and Game Code is amended to read:2120.(a)The commission, in cooperation with the Department of Food and Agriculture, shall adopt regulations governing both (1) the entry, importation, possession, transportation, keeping, confinement, or release of any and all wild animals that will be or that have been imported into this state pursuant to this chapter, and (2) the possession of all other wild animals. The regulations shall be designed to prevent damage to the native wildlife or agricultural interests of this state resulting from the existence at large of these wild animals, and to provide for the welfare of wild animals and the safety of the public.(b)The regulations shall also include criteria for all of the following:(1)The receiving, processing, and issuing of a permit and conducting inspections.(2)Contracting out inspection activities.(3)Responding to public reports and complaints.(4)The notification of the revocation, termination, or denial of permits, and related appeals.(5)The method by which the department determines that the breeding of wild animals pursuant to a single event breeding permit for exhibitor or a breeding permit is necessary and will not result in unneeded or uncared for animals, and the means by which the criteria will be implemented and enforced.(6)How a responding agency will respond to an escape of a wild animal. This shall include, but not be limited to, the establishment of guidelines for the safe recapture of the wild animal and procedures outlining when lethal force would be used to recapture the wild animal.(c)The regulations shall require permit applicants to show proof of current liability insurance and a surety bond. The commission may determine the appropriate amounts for the insurance and the bond.(d)The regulations shall require permits to be renewed at least every five years.SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.(a)The commission, in cooperation with the Department of Food and Agriculture, shall adopt regulations governing both (1) the entry, importation, possession, transportation, keeping, confinement, or release of any and all wild animals that will be or that have been imported into this state pursuant to this chapter, and (2) the possession of all other wild animals. The regulations shall be designed to prevent damage to the native wildlife or agricultural interests of this state resulting from the existence at large of these wild animals, and to provide for the welfare of wild animals and the safety of the public.
(b)The regulations shall also include criteria for all of the following:
(1)The receiving, processing, and issuing of a permit and conducting inspections.
(2)Contracting out inspection activities.
(3)Responding to public reports and complaints.
(4)The notification of the revocation, termination, or denial of permits, and related appeals.
(5)The method by which the department determines that the breeding of wild animals pursuant to a single event breeding permit for exhibitor or a breeding permit is necessary and will not result in unneeded or uncared for animals, and the means by which the criteria will be implemented and enforced.
(6)How a responding agency will respond to an escape of a wild animal. This shall include, but not be limited to, the establishment of guidelines for the safe recapture of the wild animal and procedures outlining when lethal force would be used to recapture the wild animal.
(c)These regulations shall be developed and adopted by the commission on or before January 1, 2007.(c)The regulations shall require permit applicants to show proof of current liability insurance and a surety bond. The commission may determine the appropriate amounts for the insurance and the bond.
(d)The regulations shall require permits to be renewed at least every five years.
SEC. 2.No reimbursement is required by this act pursuant to Section 6 of Article XIIIB of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIIIB of the California Constitution.
|
Date
|
Status
|
|---|---|
| Sep 28, 2024 | Chaptered by Secretary of State - Chapter 802, Statutes of 2024. |
| Sep 28, 2024 | Approved by the Governor. |
| Sep 12, 2024 | Enrolled and presented to the Governor at 4 p.m. |
| Aug 31, 2024 | Senate amendments concurred in. To Engrossing and Enrolling. (Ayes 55. Noes 15.). |
| Aug 31, 2024 | In Assembly. Concurrence in Senate amendments pending. |
| Aug 30, 2024 | Read third time. Passed. Ordered to the Assembly. (Ayes 29. Noes 9.). |
| Aug 26, 2024 | Read second time. Ordered to third reading. |
| Aug 23, 2024 | Read third time and amended. Ordered to second reading. |
| Aug 6, 2024 | Read second time. Ordered to third reading. |
| Aug 5, 2024 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8. |
| Jul 3, 2024 | Read second time and amended. Re-referred to Com. on APPR. |
| Jul 3, 2024 | From committee: Amend, and do pass as amended and re-refer to Com. on APPR. (Ayes 9. Noes 2.) (July 2). |
| Jun 12, 2024 | Re-referred to Com. on JUD. |
| Jun 11, 2024 | Re-referred to Com. on RLS. |
| Jun 11, 2024 | Withdrawn from committee. |
| Jun 10, 2024 | From committee chair, with author's amendments: Amend, and re-refer to committee. Read second time, amended, and re-referred to Com. on N.R. & W. |
| Jun 29, 2023 | In committee: Set, first hearing. Hearing canceled at the request of author. |
| Jun 14, 2023 | Referred to Com. on N.R. & W. |
| Jun 1, 2023 | In Senate. Read first time. To Com. on RLS. for assignment. |
| May 31, 2023 | Read third time. Passed. Ordered to the Senate. (Ayes 61. Noes 15. Page 2076.) |
| May 18, 2023 | Read second time. Ordered to third reading. |
| May 18, 2023 | Joint Rule 62(a), file notice suspended. (Page 1580.) |
| May 18, 2023 | From committee: Do pass. (Ayes 11. Noes 3.) (May 18). |
| May 17, 2023 | In committee: Set, first hearing. Referred to APPR. suspense file. |
| Apr 24, 2023 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 11. Noes 0.) (April 24). Re-referred to Com. on APPR. |
| Apr 17, 2023 | Re-referred to Com. on W., P., & W. |
| Apr 13, 2023 | From committee chair, with author's amendments: Amend, and re-refer to Com. on W., P., & W. Read second time and amended. |
| Feb 23, 2023 | Referred to Com. on W., P., & W. |
| Feb 16, 2023 | From printer. May be heard in committee March 18. |
| Feb 15, 2023 | Read first time. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2024 | AB 1008 Bauer-Kahan Concurrence in Senate Amendments | Assembly Floor |
Passed |
|
| Aug 30, 2024 | Assembly 3rd Reading AB1008 Bauer-Kahan By Umberg | Senate Floor |
Passed |
|
| Jul 2, 2024 | Do pass as amended, but first amend, and re-refer to the Committee on [Appropriations] | Senate Standing Committee on Judiciary |
Passed |
|
| May 31, 2023 | AB 1008 Bauer-Kahan Assembly Third Reading | Assembly Floor |
Passed |
|
| May 18, 2023 | Do pass. | Assembly Standing Committee on Appropriations |
Passed |
|
| Apr 24, 2023 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Water, Parks, and Wildlife |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| Actum Ca Opco LLC | * Indeterminate | Apr 24, 2023 |
| American Association Of Advertising Agencies | ** Against | |
| American Council Of Life Insurers | ** Against | |
| American Property Casualty Insurance Association | ** Against | |
| Association Of California Life & Health Insurance Companies | ** Against | |
| Association of National Advertisers | ** Against | |
| Axiom Advisors | * Support | Apr 24, 2023 |
| California Association Of Realtors | ** Against | |
| California Chamber Of Commerce | ** Against | |
| California Land Title Association | ** Against | |
| California Native Plant Society | * Support | Apr 24, 2023 |
| California Privacy Protection Agency | ** Support | |
| California Wind Energy Association | * Support | Apr 24, 2023 |
| Center for Biological Diversity | * Support | Apr 24, 2023 |
| coalition for sensible public records access | ** Against | |
| Computer & Communications Industry Association | ** Against | |
| Consumer Data Industry Association | ** Against | |
| Defenders of Wildlife California | * Support | Apr 24, 2023 |
| Insights Association | ** Against | |
| Mojave Desert Land Trust | * Support | Apr 24, 2023 |
| Natural Resources Defense Council (NRDC) | * Support | Apr 24, 2023 |
| Planning And Conservation League | * Support | Apr 24, 2023 |
| Professional Background Screening Association | ** Against | |
| San Bernadino County | * Against | Apr 24, 2023 |
| Sierra Club | * Support | Apr 24, 2023 |
| Software & Information Industry Association | ** Against | |
| State Privacy and Security Coalition, Inc. | ** Against | |
| Techca | ** Against | |
| Technet | ** Against |
CONCURRENCE IN SENATE AMENDMENTS
CSA1 Bill Id:AB 1008
Author:(Bauer-Kahan)
As Amended Ver:August 23, 2024
Majority vote
SUMMARY
Clarifies that the California Consumer Privacy Act of 2018 (CCPA) applies to personal information regardless of its format.
Senate Amendments
Replaced the bill's contents with its current provisions.
COMMENTS
Artificial intelligence. The development of artificial intelligence (AI) and generative artificial intelligence (GenAI) has created exciting opportunities to grow California's economy and improve the lives of its residents. "Artificial intelligence" refers to the mimicking of human intelligence by artificial systems, such as computers. AI uses algorithms – sets of rules – to transform inputs into outputs. These inputs and outputs can be anything a computer is capable of processing, including numbers, text, audio, video, and movement. At its core, AI is not fundamentally different from other computer functions – its novelty lies in its application. Unlike traditional computer functions, AI is able to accomplish tasks that are normally performed by humans.
The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). In 2018, the Legislature enacted the CCPA (AB 375 (Chau, Chap. 55, Stats. 2018)), which gives consumers certain rights regarding their personal information, such as the right to: (1) know what personal information about them is collected and sold; (2) request the categories and specific pieces of personal information the business collects about them; and (3) opt out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.
Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has the most comprehensive laws in the country when it comes to protecting consumers' rights to privacy.
In addition, Proposition 24 created the California Privacy Protection Agency in California, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA and the CPRA. The Privacy Agency's responsibilities include updating existing regulations, and adopting new regulations.
This bill. This bill would clarify that the CCPA applies to personal information regardless of its format – including, but not limited to, physical formats (e.g. paper documents), digital formats (e.g. Excel spreadsheets), and abstract digital formats (e.g. compressed Excel spreadsheets, and artificial intelligence systems that are capable of outputting personal information.) The California Privacy Protection Agency, which supports this bill, states that it is "consistent with and reflective of existing law."
Physical formats, such as handwritten documents, and digital formats, such as Excel spreadsheets, are clearly covered by the CCPA. Certain abstract digital formats are also clearly covered; for example, compressed and encrypted digital files are treated as if they contain personal information, even if that information is not immediately accessible to a human observer.
This bill specifically lists "artificial intelligence systems that are capable of outputting personal information" as an abstract digital format for personal information. The bolded qualification is important: the Merriam-Webster dictionary defines "information" as "the communication or reception of knowledge or intelligence." If an artificial intelligence system is incapable of communicating personal information, then by definition it does not contain "information." An operator of a GenAI system containing personal information that receives a deletion request from a consumer can therefore comply with a deletion request by preventing their system from outputting the consumer's information. There are several ways to accomplish this:
- Filtering the system's inputs and outputs.[1]
- Excluding the consumer's personal information from the system's training data.[2]
- Fine-tuning the system's model in order to prevent the system from outputting personal information.[3]
- Directly manipulating model parameters in order to prevent the system from outputting personal information.[4]
Finally, while this bill does not actually expand existing law, it serves as a necessary clarification in light of emerging technologies. Exempting artificial intelligence systems that are capable of outputting personal information from California's data privacy laws would create a major loophole: in the future, instead of selling personal information directly, a business could train a GenAI model using personal information and sell access to that model. If the model is not considered to contain personal information, then the business would not be required to register as a data broker with the California Privacy Protection Agency. Tools could be created to quickly and easily package personal information into large language models, as well as to extract that information on the other side of the transaction. In order to avoid interpretations of the CCPA that would create such a loophole, the CCPA should be clarified to apply to artificial intelligence systems that are capable of outputting personal information.
According to the Author
While the development of generative artificial intelligence (GenAI) is creating exciting opportunities to grow California's economy and improve the lives of its residents, this novel technology also carries significant risks for consumer privacy. Over the past decade, massive data breaches have resulted in Californians' sensitive personal information being posted to the internet without consent. Today, advanced GenAI systems are frequently trained using data obtained through the untargeted and automated scraping of internet websites. Once trained, these systems are capable of accurately reproducing their training data, including Californians' personal information. This bill protects Californians' privacy by clarifying that personal information, as defined in the CCPA, is still considered to be personal information regardless of how it is transmitted or stored.
Arguments in Support
The California Privacy Protection Agency writes:
AI systems typically are trained on data that can include personal information as defined by the CCPA. The use of personal information to train AI could pose novel challenges to consumer privacy. Researchers at Indiana University recently found that by providing ChatGPT's application programming interface with names and email addresses of New York Times reporters, subsequent querying of ChatGPT could result in outputs that included those names and addresses.
Thus, this bill seeks to underscore that personal information that exists in AI systems is still personal information, and therefore subject to existing CCPA obligations on businesses, such as data minimization, and the requirement to respond to consumer requests to access, delete, correct, and stop the sale/sharing of their personal information. The bill is also consistent with and reflective of existing law.
Arguments in Opposition
The California Chamber of Commerce writes on behalf of a coalition of industry associations:
Including the model weights of artificial neural networks as personal information is not accurate, or even technically actionable, making it challenging or impossible to handle DSARs (data subject access requests), deletion requests, etc. Model weights are mathematical values assigned to connections within an AI model. They do not contain personal data and are not extractable/returnable in a way that is identifiable or can be linked to an individual. A developer therefore could not "delete" personal data from a model weight. It is also unclear to us, at this time, the impact that this will have on the carveouts from "personal information" for "deidentified information" or "aggregate consumer information."
FISCAL COMMENTS
The Senate Appropriations Committee waived the bill pursuant to Senate Rule 28.8.
VOTES:
ASM WATER, PARKS, AND WILDLIFE: 11-0-4
YES: Bauer-Kahan, Bennett, Friedman, Hart, Kalra, Pellerin, Blanca Rubio, Schiavo, Villapudua, Ward, Weber
ABS, ABST OR NV: Mathis, Alanis, Joe Patterson, Davies
ASM APPROPRIATIONS: 11-3-2
YES: Holden, Bryan, Calderon, Wendy Carrillo, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega
NO: Megan Dahle, Dixon, Sanchez
ABS, ABST OR NV: Mathis, Robert Rivas
ASSEMBLY FLOOR: 61-15-4
YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Valencia, Villapudua, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NO: Alanis, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Gallagher, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
ABS, ABST OR NV: Hoover, Lackey, Soria, Wallis
SENATE FLOOR: 29-9-2
YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dodd, Durazo, Eggman, Gonzalez, Hurtado, Laird, Limón, McGuire, Menjivar, Min, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener
NO: Alvarado-Gil, Dahle, Grove, Jones, Nguyen, Niello, Ochoa Bogh, Seyarto, Wilk
ABS, ABST OR NV: Glazer, Newman
UPDATED
VERSION: August 23, 2024
CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0005072
OpenAI, "New and improved content moderation tooling," Aug. 10, 2022, https://openai.com/index/new-and-improved-content-moderation-tooling/. ↑
Stefano Fratta, "Building AI Technology for Europeans in a Transparent and Responsible Way," Meta, Jun. 10, 2024, https://about.fb.com/news/2024/06/building-ai-technology-for-europeans-in-a-transparent-and-responsible-way/. ↑
Meta, "To fine-tune or not to fine-tune," Aug. 7, 2024, https://ai.meta.com/blog/when-to-fine-tune-llms-vs-other-techniques/. ↑
Anthropic, "Mapping the Mind of a Large Language Model," May 21, 2024, https://www.anthropic.com/news/mapping-mind-language-model. ↑
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 1008 |
THIRD READING
Bill No: AB 1008
Author: Bauer-Kahan (D)
Amended: 8/23/24 in Senate
Vote: 21
SENATE JUDICIARY COMMITTEE: 9-2, 7/2/24
AYES: Umberg, Allen, Ashby, Caballero, Durazo, Laird, Roth, Stern, Wahab
NOES: Wilk, Niello
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 61-15, 5/31/23 - See last page for vote
SUBJECT: California Consumer Privacy Act of 2018: personal information
SOURCE: Author
DIGEST:
This bill clarifies that personal information under the California Consumer Privacy Act (CCPA) can exist in various formats, including specified examples.
Senate Floor amendments of 8/23/24 address potential chaptering out issues.
ANALYSIS:
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
- Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
- Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Provides that “personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. “Publicly available” means information that is:
- Lawfully made available from federal, state, or local government records.
- Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
- Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Civ. Code § 1798.140(v)(2).)
- Provides that “publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (Civ. Code § 1798.140(v)(2).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Clarifies that “personal information” can exist in various formats, including:
- Physical formats, including paper documents, printed images, vinyl records, or video tapes.
- Digital formats, including text, image, audio, or video files.
- Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
- States that the Legislature finds and declares that the provisions of this bill further the purposes and intent of the California Privacy Rights Act of 2020.
Background
The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CCPA defines personal information broadly, but does not make clear how it applies to information in various formats. This bill seeks to address the manner in which new technology is gathering and deploying personal information, especially with respect to the training and deployment of large language models. This bill clarifies that “personal information” can exist in various formats and provides examples, including physical, digital, and abstract formats.
This bill is author-sponsored. It is supported by the PPA. This bill is opposed by a variety of industry associations, including the Consumer Data Industry Association and TechNet.
Comments
According to the author:
While the development of generative artificial intelligence (GenAI) is creating exciting opportunities to grow California’s economy and improve the lives of its residents, this novel technology also carries significant risks for consumer privacy. Over the past decade, massive data breaches have resulted in Californians’ sensitive personal information of being posted to the internet without consent. Today, advanced GenAI systems are frequently trained using data obtained through the untargeted and automated scraping of internet websites. Once trained, these systems are capable of accurately reproducing their training data, including Californians’ personal information. This bill protects Californians’ privacy by clarifying that personal information, as defined in the CCPA, is still considered to be personal information regardless of how it is transmitted or stored.
Clarifying and updating what is “personal information” pursuant to the CCPA
“Personal information” is defined under the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The law provides a series of examples of information that, if they identify, relate to, describe, are reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household, are considered personal information. This includes geolocation data, online activity, and inferences drawn from this information to create a consumer profile.
This bill clarifies that this personal information can exist in various formats. This includes physical, digital, and abstract digital formats.
The author argues that new generative AI models are generally capable of reciting large segments of their training data. Therefore, the personal information included within these systems should clearly still be considered personal information, and this bill simply clarifies that.
The author points to ongoing litigation between the New York Times and OpenAI, which stems from the argument that the data being used to train OpenAI’s model violates the newspaper’s rights with respect to that data. The corollary here is that when these large models are trained on consumers’ personal information, it does not suddenly render it no longer personal information.
The author also asserts that text-based generative AI systems are effectively a form of data compression, similar to .zip files. A research paper put out by experts at Google DeepMind and Meta AI entitled “Language Modeling Is Compression” explicitly lay this connection out. The author asserts: “As a result, a business could conceivably use a language model (like ChatGPT or LLAMA) to compress personal information and transfer it to a buyer. This business should be subject to CCPA, just as if they had sent a compressed spreadsheet containing the same information.”
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT: (Verified 8/23/24)
California Privacy Protection Agency
OPPOSITION: (Verified 8/23/24)
American Association of Advertising Agencies
American Council of Life Insurers
American Property Casualty Insurance Association
Association of California Life & Health Insurance Companies
Association of National Advertisers
California Association of Realtors
California Chamber of Commerce
California Land Title Association
Coalition for Sensible Public Records Access
Computer & Communications Industry Association
Consumer Data Industry Association
Insights Association
Professional Background Screening Association
Software & Information Industry Association
State Privacy and Security Coalition, INC.
TechCA
Technet
ARGUMENTS IN SUPPORT: The California Privacy Protection Agency writes:
AI systems typically are trained on data that can include personal information as defined by the CCPA. The use of personal information to train AI could pose novel challenges to consumer privacy. Researchers at Indiana University recently found that by providing ChatGPT’s application programming interface with names and email addresses of New York Times reporters, subsequent querying of ChatGPT could result in outputs that included those names and addresses.
Thus, this bill seeks to underscore that personal information that exists in AI systems is still personal information, and therefore subject to existing CCPA obligations on businesses, such as data minimization, and the requirement to respond to consumer requests to access, delete, correct, and stop the sale/sharing of their personal information.
AB 1008 is consistent with and reflective of existing law. The Agency is working to clarify through regulations how AI training must align with certain rights under the CCPA.
ARGUMENTS IN OPPOSITION: A large coalition of industry associations, including the Consumer Data Industry Association, writes:
Including the model weights of artificial neural networks as personal information is not accurate, or even technically actionable, making it challenging or impossible to handle DSARs (data subject access requests), deletion requests, etc. Model weights are mathematical values assigned to connections within an AI model. They do not contain personal data and are not extractable/returnable in a way that is identifiable or can be linked to an individual.
ASSEMBLY FLOOR: 61-15, 5/31/23
AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Valencia, Villapudua, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NOES: Alanis, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Gallagher, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
NO VOTE RECORDED: Hoover, Lackey, Soria, Wallis
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
8/26/24 11:53:08
**** END ****
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | AB 1008 |
THIRD READING
Bill No: AB 1008
Author: Bauer-Kahan (D)
Amended: 7/3/24 in Senate
Vote: 21
SENATE JUDICIARY COMMITTEE: 9-2, 7/2/24
AYES: Umberg, Allen, Ashby, Caballero, Durazo, Laird, Roth, Stern, Wahab
NOES: Wilk, Niello
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
ASSEMBLY FLOOR: 61-15, 5/31/23 - See last page for vote
SUBJECT: California Consumer Privacy Act of 2018: personal information
SOURCE: Author
DIGEST:
This bill clarifies that personal information under the California Consumer Privacy Act (CCPA) can exist in various formats, including specified examples.
ANALYSIS:
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
- Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
- Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Provides that “personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. “Publicly available” means information that is:
- Lawfully made available from federal, state, or local government records.
- Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
- Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Civ. Code § 1798.140(v)(2).)
- Provides that “publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (Civ. Code § 1798.140(v)(2).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Clarifies that “personal information” can exist in various formats, including:
- Physical formats, including paper documents, printed images, vinyl records, or video tapes.
- Digital formats, including text, image, audio, or video files.
- Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
- States that the Legislature finds and declares that the provisions of this bill further the purposes and intent of the California Privacy Rights Act of 2020.
Background
The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CCPA defines personal information broadly, but does not make clear how it applies to information in various formats. This bill seeks to address the manner in which new technology is gathering and deploying personal information, especially with respect to the training and deployment of large language models. This bill clarifies that “personal information” can exist in various formats and provides examples, including physical, digital, and abstract formats.
This bill is author-sponsored. It is supported by the PPA. This bill is opposed by a variety of industry associations, including the Consumer Data Industry Association and TechNet.
Comments
According to the author:
While the development of generative artificial intelligence (GenAI) is creating exciting opportunities to grow California’s economy and improve the lives of its residents, this novel technology also carries significant risks for consumer privacy. Over the past decade, massive data breaches have resulted in Californians’ sensitive personal information of being posted to the internet without consent. Today, advanced GenAI systems are frequently trained using data obtained through the untargeted and automated scraping of internet websites. Once trained, these systems are capable of accurately reproducing their training data, including Californians’ personal information. This bill protects Californians’ privacy by clarifying that personal information, as defined in the CCPA, is still considered to be personal information regardless of how it is transmitted or stored.
Clarifying and updating what is “personal information” pursuant to the CCPA
“Personal information” is defined under the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The law provides a series of examples of information that, if they identify, relate to, describe, are reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household, are considered personal information. This includes geolocation data, online activity, and inferences drawn from this information to create a consumer profile.
This bill clarifies that this personal information can exist in various formats. This includes physical, digital, and abstract digital formats.
The author argues that new generative AI models are generally capable of reciting large segments of their training data. Therefore, the personal information included within these systems should clearly still be considered personal information, and this bill simply clarifies that.
The author points to ongoing litigation between the New York Times and OpenAI, which stems from the argument that the data being used to train OpenAI’s model violates the newspaper’s rights with respect to that data. The corollary here is that when these large models are trained on consumers’ personal information, it does not suddenly render it no longer personal information.
The author also asserts that text-based generative AI systems are effectively a form of data compression, similar to .zip files. A research paper put out by experts at Google DeepMind and Meta AI entitled “Language Modeling Is Compression” explicitly lay this connection out. The author asserts: “As a result, a business could conceivably use a language model (like ChatGPT or LLAMA) to compress personal information and transfer it to a buyer. This business should be subject to CCPA, just as if they had sent a compressed spreadsheet containing the same information.”
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT: (Verified 8/6/24)
California Privacy Protection Agency
OPPOSITION: (Verified 8/6/24)
American Association of Advertising Agencies
American Council of Life Insurers
American Property Casualty Insurance Association
Association of California Life & Health Insurance Companies
Association of National Advertisers
California Association of Realtors
California Chamber of Commerce
California Land Title Association
Coalition for Sensible Public Records Access
Computer & Communications Industry Association
Consumer Data Industry Association
Insights Association
Professional Background Screening Association
Software & Information Industry Association
State Privacy and Security Coalition, INC.
TechCA
Technet
ARGUMENTS IN SUPPORT: The California Privacy Protection Agency writes:
AI systems typically are trained on data that can include personal information as defined by the CCPA. The use of personal information to train AI could pose novel challenges to consumer privacy. Researchers at Indiana University recently found that by providing ChatGPT’s application programming interface with names and email addresses of New York Times reporters, subsequent querying of ChatGPT could result in outputs that included those names and addresses.
Thus, this bill seeks to underscore that personal information that exists in AI systems is still personal information, and therefore subject to existing CCPA obligations on businesses, such as data minimization, and the requirement to respond to consumer requests to access, delete, correct, and stop the sale/sharing of their personal information.
AB 1008 is consistent with and reflective of existing law. The Agency is working to clarify through regulations how AI training must align with certain rights under the CCPA.
ARGUMENTS IN OPPOSITION: A large coalition of industry associations, including the Consumer Data Industry Association, writes:
Including the model weights of artificial neural networks as personal information is not accurate, or even technically actionable, making it challenging or impossible to handle DSARs (data subject access requests), deletion requests, etc. Model weights are mathematical values assigned to connections within an AI model. They do not contain personal data and are not extractable/returnable in a way that is identifiable or can be linked to an individual.
ASSEMBLY FLOOR: 61-15, 5/31/23
AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Valencia, Villapudua, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon
NOES: Alanis, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Gallagher, Mathis, Jim Patterson, Joe Patterson, Sanchez, Ta, Waldron
NO VOTE RECORDED: Hoover, Lackey, Soria, Wallis
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
8/7/24 14:34:34
**** END ****
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: AB 1008 (Author:Bauer-Kahan)
Version: June 10, 2024
Hearing Date: July 2, 2024
Fiscal: Yes
Urgency: No
Consultant: CK
SUBJECT
California Consumer Privacy Act of 2018: personal information
DIGEST
This bill excludes information gathered from internet websites using automated mass data extraction techniques from the definition of “publicly available” in the California Consumer Privacy Act (CCPA). The bill clarifies that personal information under the CCPA can exist in various formats, including specified examples.
EXECUTIVE SUMMARY
The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CCPA defines personal information broadly, but includes an expansive carve out for “publicly available” information. The law also does not make clear how it applies to information in various formats. This bill seeks to address the manner in which new technology is gathering and deploying personal information, especially with respect to the training and deployment of large language models. The bill carves out of the “publicly available” exception information gathered from websites using automated extraction techniques. The bill also clarifies that “personal information” can exist in various formats and provides examples, including physical, digital, and abstract formats.
This bill is author-sponsored. No timely support was received by the Committee. The bill is opposed by a variety of industry associations, including the Consumer Data Industry Association and TechNet.
PROPOSED CHANGES TO THE LAW
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
- Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
- Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Provides that “personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. “Publicly available” means information that is:
- Lawfully made available from federal, state, or local government records.
- Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
- Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Civ. Code § 1798.140(v)(2).)
- Provides that “publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (Civ. Code § 1798.140(v)(2).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Provides that information gathered from websites using automated mass data extraction techniques are not considered “publicly available” pursuant to the CCPA.
- Clarifies that “personal information” can exist in various formats, including:
- Physical formats, including paper documents, printed images, vinyl records, or video tapes.
- Digital formats, including text, image, audio, or video files.
- Abstract digital formats, including compressed or encrypted files, metadata, or the model weights of artificial neural networks.
- States that the Legislature finds and declares that the provisions of this bill further the purposes and intent of the California Privacy Rights Act of 2020.
COMMENTS
- California’s landmark privacy protection law
As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct. The CPRA added a new category of information, sensitive information, which includes data such as precise geolocation and genetic information. Consumers are additionally empowered to limit businesses’ use of such information. A business that sells or shares personal information to third parties is required to notify consumers that this information may be sold or shared and that they have the right to opt out of such sales. (Civ. Code § 1798.120(b).)
- Stated intent of the bill
According to the author:
While the development of generative artificial intelligence (GenAI) is creating exciting opportunities to grow California’s economy and improve the lives of its residents, this novel technology also carries significant risks for consumer privacy. Over the past decade, massive data breaches have resulted in Californians’ sensitive personal information of being posted to the internet without consent. Today, advanced GenAI systems are frequently trained using data obtained through the untargeted and automated scraping of internet websites. Once trained, these systems are capable of accurately reproducing their training data, including Californians’ personal information. This bill protects Californians’ privacy by clarifying that personal information, as defined in the CCPA, is still considered to be personal information regardless of how it is transmitted or stored.
- Clarifying and updating what is “personal information” pursuant to the CCPA
“Personal information” is defined under the CCPA as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The law provides a series of examples of information that, if they identify, relate to, describe, are reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household, are considered personal information. This includes geolocation data, online activity, and inferences drawn from this information to create a consumer profile.
This bill clarifies that this personal information can exist in various formats. This includes physical, digital, and abstract digital formats. This latter category includes compressed or encrypted files, metadata, or the model weights of artificial neural networks.
A large coalition of industry associations, including the Consumer Data Industry Association, write in opposition:
Including the model weights of artificial neural networks as personal information is not accurate, or even technically actionable, making it challenging or impossible to handle DSARs (data subject access requests), deletion requests, etc. Model weights are mathematical values assigned to connections within an AI model. They do not contain personal data and are not extractable/returnable in a way that is identifiable or can be linked to an individual.
The author argues that new generative AI models are generally capable of reciting large segments of their training data. Therefore, the personal information included within these systems should clearly still be considered personal information, and the bill simply clarifies that.
The author points to ongoing litigation between the New York Times and OpenAI, which stems from the argument that the data being used to train OpenAI’s model violates the newspaper’s rights with respect to that data. The corollary here is that when these large models are trained on consumers’ personal information, it does not suddenly render it no longer personal information.
The author also asserts that text-based generative AI systems are effectively a form of data compression, similar to .zip files. A research paper put out by experts at Google DeepMind and Meta AI entitled “Language Modeling Is Compression” explicitly lay this connection out. The author asserts: “As a result, a business could conceivably use a language model (like ChatGPT or LLAMA) to compress personal information and transfer it to a buyer. This business should be subject to CCPA, just as if they had sent a compressed spreadsheet containing the same information.”
In order to make this provision clearer, in response to confusion from opposition, the author has agreed to the following amendment:
Amendment
Amend Section 1798.140(v)(4)(C) to read: “Abstract digital formats, including compressed or encrypted files, metadata, or the model weights of artificial neural networks artificial intelligence systems that are capable of outputting personal information.”
The second component of this bill alters the definition of “publicly available.” The CCPA provides that “personal information” does not include publicly available information, which is defined to include:
- Lawfully made available from federal, state, or local government records.
- Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
- Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
The law makes clear that “publicly available” does not include biometric information collected by a business about a consumer without the consumer’s knowledge. This bill further provides that information gathered from websites using automated mass data extraction techniques is also excluded from what is considered “publicly available.” The impetus for such a change is explained by the author:
In January of 2024, a massive data breach known as the “Mother of all Breaches” exposed more than 26 billion records online. The leak included user data from LinkedIn, Twitter, and other heavily trafficked websites. This was not the first major breach to occur in the past decade: In 2017, Equifax suffered a breach that exposed the personal information – including social security numbers, birth dates, and addresses – of 147 million people. In 2016, Yahoo revealed that the data of all 3 billion of its users had been compromised. Target suffered a data breach in 2013 that affected 40 million credit and debit card accounts and 70 million customer records. Much of this information subsequently appeared online. Most modern GenAI systems are trained using text data sourced from the internet. The ability of GenAI systems to output training data, combined with vast quantities of personal information known to be hosted on the internet, allows GenAI to transmit personal information between individuals without the knowledge or consent of affected consumers.
The coalition in opposition, which includes the American Property Casualty Insurance Association, writes:
Information in the public domain does not suddenly become nonpublic by virtue of how a person accesses that information—whether it is accessed in person, on paper, using a video tape, electronic copy, or “automated mass data extraction technique,” or any number of lawful methods or technologies. AB 1008 would change that, declaring information in the public domain to no longer be public information based on how an entity accessed it, causing any number of unintended or illogical consequences and running afoul of well-established First Amendment rights in receiving and disseminating information. The consequences of doing so range from unintended, to illogical, ill-advised, and harmful, disrupting many industries that legitimately rely on public information to provide services more accurately and efficiently, and potentially even causing great harm by interfering with research or public safety efforts.
The author has agreed to amendments that remove this portion of the bill.
- Furthering the purpose and intent of the CPRA
Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:
- consumers should know who is collecting their personal information;
- consumers should have control over how their personal information is used; and
- consumers should benefit from businesses’ use of their personal information.
Section 3 also includes a series of responsibilities that businesses should have. These include:
- businesses should specifically and clearly inform consumers about how they use personal information; and
- businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.
Section 3 also lays out various guiding principles about how the law should be implemented.
The bill helps clarify what is to be considered “personal information” under the CCPA. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”
SUPPORT
None received
OPPOSITION
American Association of Advertising Agencies
American Council of Life Insurers
American Property Casualty Insurance Association
Association of California Life & Health Insurance Companies
Association of National Advertisers
California Association of Realtors
California Chamber of Commerce
California Land Title Association
Coalition for Sensible Public Records Access
Computer & Communications Industry Association
Consumer Data Industry Association
Insights Association
Software & Information Industry Association
State Privacy and Security Coalition, INC.
TechCA
Technet
RELATED LEGISLATION
Pending Legislation:
SB 1223 (Becker, 2024) includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the CCPA. SB 1223 is currently in the Assembly Privacy and Consumer Protection Committee.
AB 1824 (Valencia, 2024) requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the CCPA. AB 1824 is currently on the Senate Floor.
AB 1949 (Wick, 2024) prohibits the collection, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. The bill provides for regulations to be promulgated by the PPA. AB 1949 is currently in this Committee.
AB 2013 (Irwin, 2024) requires developers of AI systems or services that are made available for Californians to use to post on their website documentation regarding the data used to train the system or service, including high-level summaries of the datasets used. AB 2013 is currently on the Senate Floor.
AB 2877 (Bauer-Kahan, 2024) prohibits CCPA covered-businesses that are the developers of AI systems or tools from using the personal information of consumers under the age of 16 to train AI systems or services without first obtaining affirmative authorization, and even with such authorization the data must be de-identified and aggregated before it is used to train. AB 2877 is currently in the Senate Appropriations Committee.
Prior Legislation:
AB 947 (Gabriel, Ch. 551, Stats. 2023) included personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.
AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provided stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.
AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.
PRIOR VOTES:
PRIOR VOTES NOT RELEVANT
Assembly Floor (Ayes 61, Noes 15)
Assembly Appropriations Committee (Ayes 11, Noes 3)
Assembly Water, Parks and Wildlife Committee (Ayes 11, Noes 0)
**************
ASSEMBLY THIRD READING
ATR Bill Id:AB 1008
Author:(Bauer-Kahan)
As Amended Ver:April 13, 2023
Majority vote
SUMMARY
Enacts the Western Joshua Tree Conservation Act, which provides for the protection and conservation of the western Joshua tree (Yucca brevifolia).
Major Provisions
- Prohibits any person or public agency from importing into the state, exporting out of the state, or taking, possessing, purchasing, or selling within the state, a western Joshua tree or any part or product of the tree, except as provided pursuant to existing law or by paying a specified fee.
- Specifies that certain take authorizations apply during any period in which the western Joshua tree has been designated by the Fish and Game Commission (Commission) as a candidate for listing under the California Endangered Species Act (CESA), if the Commission lists the western Joshua tree as endangered or threatened pursuant to the CESA, and upon the approval of a natural community conservation plan in which the western Joshua tree is a covered species, as provided.
- Authorizes the Department of Fish and Wildlife (DFW) to issue a permit for the taking of a western Joshua tree if specified conditions are met, including, but not limited to, that the permittee mitigates all impacts to, and taking of, the western Joshua tree.
- Authorizes a permittee, in lieu of completing the mitigation measures on its own, to elect to satisfy the mitigation obligation by paying a fee pursuant to a specified fee schedule.
- Requires all fees remitted to DFW to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree.
- Authorizes DFW to enter into an agreement with any county or city to delegate to the county or city the ability to authorize the taking of a western Joshua tree associated with developing single-family residences, accessory structures, and public works projects, as defined, concurrent with the city’s or county’s approval of the project.
- Authorizes DFW or its designee to issue a permit to authorize the removal or trimming of a dead western Joshua tree or the trimming of a live western Joshua tree, as provided.
- Requires DFW to develop and implement a western Joshua tree conservation plan in collaboration with governmental agencies, California Native American tribes, and the public. Specifies that DFW shall present the final conservation plan at a public meeting of the Commission, for its review and approval, by December 31, 2024, and requires the Commission to take final action on the plan by June 30, 2025.
- Requires DFW to submit an annual report to the Commission and the Legislature addressing the conservation status of the western Joshua tree and requires the Commission, beginning in 2026, and at least every four years thereafter, to review the status of the western Joshua tree and the effectiveness of the conservation plan, as specified.
COMMENTS
Habitat loss, wildfires, aridification, and other climate change effects are major threats to the western Joshua tree. For example, in 2020, the Dome Fire incinerated 1.3 million Joshua trees in a part of the Mojave National Preserve called the Cima Dome. While potentially less immediate than other threats, climate change could represent an existential threat to the western Joshua tree. The Mojave Desert and other regions of California where western Joshua trees grow are expected to become significantly hotter by the end of the 21st century.
DFW expects that some of the effects of climate change (e.g., increased temperatures and decreased total water availability locally) will likely contribute to a decline in populations of western Joshua trees within California through the end of the 21st century; however, the extent to which the negative effects of climate change will impact the species’ range, distribution, density, abundance, life history, and demographics in this timeframe is less clear.
Areas in California with climate conditions that supported western Joshua trees during the 20th century are expected to contract substantially by 2100, especially in the southern and lower elevation portions of the species’ range. Areas with historical 20th century suitable climate conditions for the species will also expand to the north and into higher elevation areas in some parts of eastern California, but most substantially in Nevada. The western Joshua tree is only likely to colonize areas with newly suitable climate conditions very slowly.
Currently, western Joshua trees are widely distributed in the Mojave Desert region of California. According to DFW’s Status Review of the species, estimates indicate that the current abundance of the western Joshua tree is relatively high, but there is high uncertainty in estimates of population size due to both the uncertainty of density estimates, and uncertainty regarding how much area is occupied by the species. The Status Review concludes that there could be between 4.3 million and 9.8 million western Joshua trees in California.
Proposed CESA listing. The western Joshua tree was proposed for listing as threatened under CESA at the Commission in late 2019. The Commission accepted the western Joshua tree as a candidate species in 2020 and has not made a final decision on the listing yet. While a candidate for listing, the western Joshua tree has similar protections to those of a listed species. This includes take prohibitions and take authorization through permits obtained from DFW. Since becoming a candidate, take permits were issued under Fish and Game Code §§ 2081 and 2084.
At this point, it is unclear what decision the Commission will make. This bill would provide protections to western Joshua trees in the absence of a listing, and expressly leaves CESA as a regulatory backstop by specifying that the fees proposed by this bill are only in effect if the species is not listed under CESA. The other provisions of the bill would remain in effect, including the conservation plan and the delegation of permitting for tree trimming and dead tree removal, even if the species is listed under CESA.
According to the Author
"This bill provides for the conservation of the western Joshua tree, an iconic California plant species, and allows important infrastructure and clean energy projects to move forward with certainty."
Arguments in Support
A coalition of conservation and environmental organizations write with a support if amended position. While these organizations are generally supportive of protections for the western Joshua tree and preserving the ability to list under CESA if needed, their letter highlights several suggested improvements to this bill, including: valuing small trees higher than large trees; assessing the value of the habitat around trees; ensuring mitigation fee amounts provide adequate funding to allow for the conservation and management of western Joshua tree habitat; and requiring the monitoring of relocated trees for a period of 10 years to ensure survival, among other suggestions.
Arguments in Opposition
The County of San Bernardino writes with an oppose unless amended position, stating that "San Bernardino County would like to see the Western Joshua tree preserved for generations to come and fully supports protecting the species. However, protection of this important tree must be balanced with the need for public services and vital infrastructure development. We believe that [this bill] requires additional clarifications and substantive changes to address significant concerns with the bill."
The county suggests amendments to do the following: provide additional permitting delegation to local governments; clarify the definition of what constitutes an individual tree; allow more take under delegated permitting authority for public works projects; and toll the pending CESA listing petition for a period of ten years to allow the proposed protections to be evaluated.
FISCAL COMMENTS
According to the Assembly Appropriations Committee:
- Staff costs of an unknown amount for DFW to issue permits for the taking of a western Joshua tree during any period in which the western Joshua tree has been designated by the Commission as a candidate for listing under CESA (General Fund or special fund). DFW has been issuing take permits for western Joshua trees under its existing authorities in the Fish and Game Code since the species was accepted by the Commission as a candidate species in 2020. Therefore, it is not clear if, and how much, additional workload this bill creates for DFW with respect to issuing take permits.
- Revenue of an unknown, but likely significant, amount to DFW from the collection of in-lieu fees paid by permittees to satisfy their mitigation obligations. The fees are established at $1,000 for each western Joshua tree five meters or greater in height and $300 for each western Joshua tree less than five meters in height. All fees remitted to DFW are required to be deposited into the Western Joshua Tree Conservation Fund (Fund), and upon appropriation by the Legislature, any moneys in the Fund are required to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree.
- Potential minimal cost savings to DFW from the authority granted to it by this bill to enter into agreements with and delegate to cities and counties the ability to authorize the taking of a western Joshua tree for limited types of projects. This bill authorizes cities and counties entering into agreements to impose a reasonable fee to cover the administrative costs of issuing the permit.
- Costs of an unknown amount for DFW to develop, implement, review the effectiveness of, and make necessary amendments to a western Joshua tree conservation plan; submit annual reports assessing the conservation status of the western Joshua tree; and annually adjust fees.
VOTES
ASM WATER, PARKS, AND WILDLIFE: 11-0-4
YES: Bauer-Kahan, Bennett, Friedman, Hart, Kalra, Pellerin, Blanca Rubio, Schiavo, Villapudua, Ward, Weber
ABS, ABST OR NV: Mathis, Alanis, Joe Patterson, Davies
ASM APPROPRIATIONS: 11-3-2
YES: Holden, Bryan, Calderon, Wendy Carrillo, Mike Fong, Hart, Lowenthal, Papan, Pellerin, Weber, Ortega
NO: Megan Dahle, Dixon, Sanchez
ABS, ABST OR NV: Mathis, Robert Rivas
UPDATED
VERSION: April 13, 2023
CONSULTANT: Keith Cialino / W., P., & W. / (916) 319-2096 FN: 0000502
Date of Hearing: May 17, 2023
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Chris Holden, Chair
ABPCA Bill Id:AB 1008
Author:(Bauer-Kahan) – As Amended Ver:April 13, 2023
Policy Committee: | Water, Parks and Wildlife | Vote: | 11 - 0 |
|
| ||
|
|
Urgency: No State Mandated Local Program: Yes Reimbursable: No
SUMMARY:
This bill enacts the Western Joshua Tree Conservation Act, which provides for the conservation of the western Joshua tree, as specified.
Specifically, this bill, among other things:
- Prohibits any person or public agency from importing into the state, exporting out of the state, or taking, possessing, purchasing, or selling within the state, a western Joshua tree or any part or product of the tree, except as provided or by paying a specified fee.
- Specifies that certain take authorizations apply during any period in which the western Joshua tree has been designated by the Fish and Game Commission (Commission) as a candidate for listing under the California Endangered Species Act (CESA), if the Commission lists the western Joshua tree as endangered or threatened pursuant to the CESA, and upon the approval of a natural community conservation plan in which the western Joshua tree is a covered species, as provided.
- Authorizes the Department of Fish and Wildlife (DFW) to issue a permit for the taking of a western Joshua tree if specified conditions are met, including, but not limited to, that the permittee mitigates all impacts to, and taking of, the western Joshua tree.
- Authorizes a permittee, in lieu of completing the mitigation measures on its own, to elect to satisfy the mitigation obligation by paying a fee pursuant to a specified fee schedule.
- Requires DFW to annually adjust the fees for inflation, and to review the fees by December 31, 2026, and every four years thereafter, to ensure the conservation of western Joshua tree.
- Requires all fees remitted to DFW to be deposited into the western Joshua tree Conservation Fund (Fund), as provided, and requires the moneys in the Fund, upon appropriation by the Legislature, to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree.
- Authorizes DFW to enter into an agreement with any county or city to delegate to the county or city the ability to authorize the taking of a western Joshua tree associated with developing single-family residences, accessory structures, and public works projects, as specified.
- Requires the county or city to collect permit fees and remit them quarterly to the Fund as directed by DFW, and authorizes the city or county entering into an agreement to impose a reasonable fee to cover the administrative costs of issuing the permits.
- Authorizes DFW or its designee to issue a permit to authorize the removal or trimming of a dead western Joshua tree or the trimming of a live western Joshua tree, as provided.
- Requires DFW to develop and implement a western Joshua tree conservation plan in collaboration with governmental agencies, California Native American tribes, and the public. Specifies that DFW shall present the final conservation plan at a public meeting of the Commission, for its review and approval, by December 31, 2024, and requires the Commission to take final action on the plan by June 30, 2025.
- Requires DFW to submit an annual report to the Commission and the Legislature addressing the conservation status of the western Joshua tree, and requires the Commission, beginning in 2026, and at least every 4 years thereafter, to, at a public meeting, review the status of the western Joshua tree and the effectiveness of the conservation plan, as specified.
FISCAL EFFECT:
1) Staff costs of an unknown amount for DFW to issue permits for the taking of a western Joshua tree during any period in which the western Joshua tree has been designated by the Commission as a candidate for listing under CESA (General Fund or special fund). DFW has been issuing take permits for western Joshua trees under its existing authorities in the Fish and Game Code since the species was accepted by the Commission as a candidate species in 2020. Therefore, it is not clear if, and how much, additional workload this bill creates for DFW with respect to issuing take permits.
2) Revenue of an unknown, but likely significant, amount to DFW from the collection of in-lieu fees paid by permittees to satisfy their mitigation obligations. The fees are established at $1,000 for each western Joshua tree five meters or greater in height and $300 for each western Joshua tree less than five meters in height. All fees remitted to DFW are required to be deposited into the Fund, and upon appropriation by the Legislature, any moneys in the Fund are required to be used solely for the purposes of acquiring, conserving, and managing western Joshua tree conservation lands and completing other activities to conserve the western Joshua tree.
3) Potential minimal cost savings to DFW from the authority granted to it by this bill to enter into agreements with and delegate to cities and counties the ability to authorize the taking of a western Joshua tree for limited types of projects. This bill authorizes cities and counties entering into agreements to impose a reasonable fee to cover the administrative costs of issuing the permit.
4) Costs an unknown amount for DFW to develop, implement, review the effectiveness of, and make necessary amendments to a western Joshua tree conservation plan; submit annual reports assessing the conservation status of the western Joshua tree; and annually adjust fees.
COMMENTS:
1) Purpose. According to the author, “This bill provides for the conservation of the western Joshua tree, an iconic California plant species, and allows important infrastructure and clean energy projects to move forward with certainty.”
2) Background.
Western Joshua Trees. Western Joshua trees are widely distributed in the Mojave Desert region of California. According to DFW’s status review of the species, estimates indicate that the abundance of the western Joshua tree is currently relatively high, but there is high uncertainty in estimates of population size due to both the uncertainty of density estimates and uncertainty regarding how much area is occupied by the species. Depending on the analysis, there could be between 4.3 million and 10.6 million western Joshua trees. DFW estimates that approximately 30% of the habitat occupied by western Joshua trees in California may have been modified between European settlement and the present, in part due to habitat loss and degradation related to agricultural conversion and development. Habitat loss, wildfires, aridification, and other climate change effects are major threats to the species. Several published species distribution models of western Joshua trees agree on a substantial climate-related decline in suitable area for the species across the Mojave Desert.
Proposed CESA Listing. The western Joshua tree was proposed for listing as threatened under CESA at the Commission in late 2019. The Commission accepted the western Joshua tree as a candidate species in 2020 and has not made a final decision on the listing yet. While a candidate for listing, the western Joshua tree has similar protections to those of a listed species. This includes take prohibitions and take authorization through permits obtained from DFW. At this point, it is unclear what decision the Commission will make. This bill expressly leaves CESA as a regulatory backstop by specifying that the fees proposed by this bill are only in effect if the species is not listed under CESA. The other provisions of the bill would remain in effect, including the conservation plan and the delegation of permitting for tree trimming and dead tree removal, even if the species is listed under CESA.
Federal Endangered Species Act (ESA). In March 2023, the U.S. Fish and Wildlife Service (U.S. FWS) declined to list Joshua trees under the federal ESA. While noting climate change, wildfires, drought, and invasive grasses as the biggest threats to Joshua trees, U.S. FWS concluded none of those factors will profoundly affect the population or range of the Joshua tree’s habitat by 2069.
Clean Energy and Housing Goals. California has a goal of 60% renewable electricity by 2030 and 100% carbon-free electricity by 2045. One of the key regions sought by renewable energy developers is the sparsely populated, but ecologically important, Mojave and Colorado Desert area in southeastern California – a vast area covering roughly 22.6 million acres. Currently, more than 10 gigawatts of solar projects are planned for construction in this general area. Additionally, California is experiencing an affordable housing crisis. The Antelope Valley of Los Angeles County, the Inland Empire (Riverside and San Bernardino Counties), and eastern Kern County are growing rapidly with residents migrating in search of affordable housing in Southern California. These areas also overlap with western Joshua tree habitat.
In February 2023, the Newsom administration released trailer bill language (TBL) related to the conservation of the western Joshua tree. There’s considerable overlap as well as some significant differences between the TBL and this bill. The TBL has not yet been heard in either of the budget committees.
Analysis Prepared by: Nikita Koraddi / APPR. / (916) 319-2081
Discussed in Hearing
1MIN
Assembly Floor
2MIN
Senate Floor
4MIN
Senate Standing Committee on Judiciary
16MIN
Assembly Standing Committee on Water, Parks, and Wildlife
Bill Author
Bill Co-Author(s):