Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified. The CCPA grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law requires a social media company, as defined, to submit reports, as specified, starting no later than January 1, 2024, to the Attorney General, including, but not limited to, the current version of the terms of service for each social media platform owned or operated by the company, specified categories of content and what policies the social media company has for that platform to address that content, and data related to violations of the terms of service for each platform. Existing law requires the Attorney General to make all terms of service reports submitted pursuant to those provisions available to the public in a searchable repository on its official internet website.

This bill would add to those categories of content the distribution of controlled substances.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would delete the above-described exemption and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information and policies and procedures governing when a platform proactively shares relevant information pertaining to distribution of a controlled substance, as specified. The bill would require a social media platform to retain content it has taken down or removed for a violation of its policy related to controlled substances, as specified, for a period of 90 days, except when the platform has a good faith belief that the content is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law.

The bill would specify that it does not alter the rights or obligations established in any other law, including the Electronic Communications Privacy Act and the California Consumer Privacy Act.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified. The CCPA grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law requires a social media company, as defined, to submit reports, as specified, starting no later than January 1, 2024, to the Attorney General, including, but not limited to, the current version of the terms of service for each social media platform owned or operated by the company, specified categories of content and what policies the social media company has for that platform to address that content, and data related to violations of the terms of service for each platform. Existing law requires the Attorney General to make all terms of service reports submitted pursuant to those provisions available to the public in a searchable repository on its official internet website.

This bill would add to those categories of content the distribution of controlled substances.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would delete the above-described exemption and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information and policies and procedures governing when a platform proactively shares relevant information pertaining to distribution of a controlled substance, as specified. The bill would require a social media platform to retain content it has taken down or removed for a violation of its policy related to controlled substances, as specified, for a period of 90 days, except when the platform has a good faith belief that the content is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law.

The bill would specify that it does not alter the rights or obligations established in any other law, including the Electronic Communications Privacy Act and the California Consumer Privacy Act.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified. The CCPA grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law requires a social media company, as defined, to submit reports, as specified, starting no later than January 1, 2024, to the Attorney General, including, but not limited to, the current version of the terms of service for each social media platform owned or operated by the company, specified categories of content and what policies the social media company has for that platform to address that content, and data related to violations of the terms of service for each platform. Existing law requires the Attorney General to make all terms of service reports submitted pursuant to those provisions available to the public in a searchable repository on its official internet website.

This bill would add to those categories of content the distribution of controlled substances.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would delete the above-described exemption and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information and policies and procedures governing when a platform proactively shares relevant information pertaining to distribution of a controlled substance, as specified. The bill would require a social media platform to retain content it has taken down or removed for a violation of its policy related to controlled substances, as specified, for a period of 90 days. The bill would require the Attorney General to identify a point of contact for these reports. days, except when the platform has a good faith belief that the content is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law.

The bill would specify that it does not alter the rights or obligations established in any other law, including the Electronic Communications Privacy Act and the California Consumer Privacy Act.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified. The CCPA grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law requires a social media company, as defined, to submit reports, as specified, starting no later than January 1, 2024, to the Attorney General, including, but not limited to, the current version of the terms of service for each social media platform owned or operated by the company, specified categories of content and what policies the social media company has for that platform to address that content, and data related to violations of the terms of service for each platform. Existing law requires the Attorney General to make all terms of service reports submitted pursuant to those provisions available to the public in a searchable repository on its official internet website.

This bill would add to those categories of content the distribution of controlled substances.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would extend the above provisions indefinitely, delete the above described exemption, above-described exemption and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information and policies and procedures governing when a platform proactively shares relevant information pertaining to distribution of a controlled substance, as specified. The bill would require a social media platform to retain content it has taken down or removed for a violation of its policy related to controlled substances, as specified, for a period of 90 days. The bill would clarify that these provisions do not prohibit a platform from providing information to law enforcement under certain circumstances, and would require the Attorney General to identify a point of contact for these reports.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would delete the above-described exemption extend the above provisions indefinitely, delete the above described exemption, and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information, information and policies and procedures governing when a platform proactively shares relevant information pertaining to distribution of a controlled substance, as specified. The bill would require a social media platform to retain actioned content or electronic communication information, as defined, content it has taken down or removed for a violation of its policy related to controlled substances, as specified, for a period of 90 days and to report usernames, handles, or account or subscriber names that generated actioned content to the Attorney General monthly. The bill would impose a fine of up to $190,000 for an initial violation and up to $380,000 for a subsequent violation for a knowing and willful failure to report and would make the reports confidential, subject to certain exceptions. days. The bill would clarify that these provisions do not prohibit a platform from providing information to law enforcement under certain circumstances, and would require the Attorney General to identify a point of contact for these reports.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

Existing law, the Electronic Communications Privacy Act, generally prohibits a government entity from compelling the production of or access to electronic communication information or electronic device information, as defined, without a search warrant, wiretap order, order for electronic reader records, subpoena, or order for a pen register or trap and trace device, except for emergency situations, as specified.

Existing law, until January 1, 2028, requires a social media platform to create and post a policy statement regarding the use of the social media platform to illegally distribute controlled substances, including a general description of its policies and procedures for responding to law enforcement inquiries. Existing law exempts from these requirements a business that generated less than $100,000,000 in gross revenue during the preceding calendar year.

This bill would delete the above-described exemption and would require the policy statement to include a general description of the social media platforms policy on the retention of electronic communication information, as specified. The bill would require a social media platform to retain actioned content or electronic communication information, as defined, for a period of 90 days and to report usernames, handles, or account or subscriber names that generated actioned content to the Attorney General monthly. The bill would impose a fine of up to $190,000 for an initial violation and up to $380,000 for a subsequent violation for a knowing and willful failure to report and would make the reports confidential, subject to certain exceptions.

Existing law, the California Consumer Privacy Act of 2018 (CCPA) (CCPA), as amended by the California Privacy Rights Act of 2020, an initiative measure, grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. defined. The CCPA requires a business that controls the collection of a consumers personal information to inform consumers of the categories of personal information collected, the purposes for which the categories of personal information are collected or used, and the length of time the business intends to retain each category of personal information, as specified.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer.

This bill would require a social media platform, as defined, to maintain a record of, and the content of, a communication between users of the social media platform for at least 168 hours from the time the communication was made. The bill would exempt from that requirement information that is the subject of a consumer request to delete the information pursuant to the CCPA provision described above.

The bill would also provide that a social media platforms failure to maintain a record of the specified communications for at least 168 hours from the time of the communication would be subject to a civil penalty of up to $250,000, an injunction, and an award of litigation costs and attorneys fees. and reasonable costs and attorneys fees. The bill would further authorize a court to grant injunctive relief in an action brought for a violation of the above-described provisions. The bill would require these penalties only be recovered in a civil action brought by specified public prosecutors in a court of competent jurisdiction.

Existing law makes it a felony to possess for sale or purchase for sale certain controlled substances, including, among others, fentanyl.

This bill would make a technical, nonsubstantive change to those provisions.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1027

Author:(Petrie-Norris)

As Amended Ver:August 15, 2023

Majority vote

SUMMARY

Places various requirements on social media companies' and social media platforms' handling of content related to controlled substances.

Major Provisions

1. Requires a social media company that generated annual revenue in excess of $100 million in the previous year to include, in the semiannual report it is required to file with the Attorney General, information regarding its social media platforms' handling of content related to controlled substance distribution.
2. Requires a social media platform that operates in California to include in a policy statement that it publicly posts on its internet website the following:
   1. A general description of the social media platform's policy regarding the retention of electronic communication information, as that term is defined under the California Electronic Communications Privacy Act (CalECPA).
   2. How long the platform retains that information.
   3. A general description of the social media platform's policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.
3. Requires a social media platform to retain for 90 days content that it has taken action on to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or other proliferation of controlled substances and related paraphernalia, and the username of the violating account.
4. Clarifies that, notwithstanding 3), above, a social media platform is not required to retain violating content if there is a good faith belief that the content is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law.

Senate Amendments

Specify that reports to the Attorney General (already required to be submitted under law) must include information regarding platforms' handling of content related to controlled substance distribution; require public posting of platforms' policies and procedures regarding proactive sharing of information pertaining to illegal distribution of a controlled substance; require retention for 90 days of content removed for violation of platforms' social media policies, together with the account's username; clarify that retention is not required for content related to gender-affirming or reproductive health care.

COMMENTS

According the United States Centers for Disease Control and Prevention (CDC), fentanyl, a synthetic opioid up to 50 times stronger than heroin, is currently responsible for over 150 deaths a day in the United States due to overdoses. (CDC, Fentanyl Facts (Feb. 23, 2022), available at https://www.cdc.gov/stopoverdose/fentanyl/index.html.)

This epidemic of overdoses is exacerbated by the ability of interested parties to use social media platforms to connect with strangers or acquaintances who distribute and sell opioids, making illegal drugs easier and more convenient to purchase. Because the clientele of many social media platforms skews younger, this distribution channel has been especially harmful to teens and young adults. According to a 2021 Washington Post article:

DEA Administrator Anne Milgram specifically called out Snapchat and TikTok, two apps that are popular with teenagers and young adults, for not doing more to combat sales….

For years, illegal drug sales have been a scourge on Facebook, Snapchat, TikTok and other social media apps. Companies have repeatedly said they're working to rid their sites of drug deals by hiring extra moderators, using artificial-intelligence algorithms to root out illegal material and limiting searches for keywords related to drugs. But prescription and other drugs can still easily be found for sale. […]

The public health crisis is renewing calls from not just law enforcement groups but concerned parents and researchers for the social media companies to do more. They want the companies to be more transparent about what's happening on their platforms….

(Lerman & De Vynck, Snapchat, TikTok, Instagram face pressure to stop illegal drug sales as overdose deaths soar, Washington Post (Sep. 28, 2021), available at https://www.washingtonpost.com/technology/2021/09/28/tiktok-snapchat-fentanyl/.)

Last year's AB 587 (Gabriel), Chapter 269, Statutes of 2022 and AB 1628 (Ramos), Chapter 432, Statutes of 2022 were enacted in response to such calls for transparency in social media platforms' practices. AB 587 required each large social media company to file semiannual reports with the Attorney General (AG); the reports must include terms of service for every social media platform the company operates, including a detailed description of the platform's content moderation practices.

The current bill would require each large social media company to include, in its reports to the AG, information regarding its platforms' handling of content related to controlled substance distribution.

AB 1628 required each large social media platform to publicly post on its internet website a policy statement containing information such as 1) the platform's policy on the use of the platform to illegally distribute a controlled substance; 2) a description of the platform's moderation practices employed to prevent users from sharing content regarding illegal distribution of a controlled substance; and 3) the platform's policies and procedures for responding to law enforcement inquiries, including warrants, subpoenas, and other courts compelling production of electronic communications information.

The current bill would require a social media platform to post a general description of its policies regarding the retention of electronic communication information, including how long the platform retains that information. It would also require posting of a general description of the platform's policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.

Further, the current bill would require a social media platform to retain on content that it has acted to take down or remove for violation of a policy prohibiting the unlawful sale, distribution, amplification, or other proliferation of controlled substances and related paraphernalia. The violating content and the username of the violating account would have to be retained for 90 days. This bill clarifies that the platform is not required to retain violating content if there is a good faith belief that it is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law. Finally, this bill would delete the requirement in AB 1628 that applied the bill only to social media platforms that generated $100 million or more in gross revenue during the preceding calendar year.

According to the Author

Social media platforms currently post a policy statement that includes general information about their terms and usage. […]AB 1027 will provide law enforcement agencies with access to information that could be invaluable in their efforts to investigate online illicit drug transactions.

Arguments in Support

Peace Officers Research Association of California writes:

AB 1027 requires social media companies post policies regarding the sale of controlled substance on the platform to require information that violates the polices to be stored for 90 days and to provide for when that information can be shared with law enforcement. [This bill] aims to prevent fentanyl poisoning by enacting more stringent data collection and storage requirements for social media companies. This will offer important assistance to law enforcement to combat this epidemic.

Arguments in Opposition

Oakland Privacy writes:

As a matter of constitutional law, the Fourth Amendment protects us from the search and seizure of our personal "papers" and property without probable cause. Our electronic information has long been considered to be a 21st century version of our papers. When the government, in this case the State of California, compels our communications to be seized by a third party, the reason needs to be a particularized cause. A corporate policy, however well-intended, does not rise to probable cause under the law. [...] We strongly encourage [removal of] the government mandate to compel actioned content retention.

FISCAL COMMENTS

None.

VOTES:

ASM JUDICIARY: 9-0-2

YES: Maienschein, Connolly, Dixon, Haney, Kalra, Pacheco, Papan, Reyes, Robert Rivas

ABS, ABST OR NV: Essayli, Sanchez

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-1

YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Addis, Lowenthal, Papan, Pellerin, Robert Rivas, Sanchez, Weber, Wilson

ABS, ABST OR NV: Mathis

ASSEMBLY FLOOR: 77-0-3

YES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones‑Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon

ABS, ABST OR NV: Chen, Lackey, Quirk-Silva

SENATE FLOOR: 37-0-3

YES: Allen, Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Portantino, Roth, Rubio, Seyarto, Skinner, Stern, Umberg, Wahab, Wiener, Wilk

ABS, ABST OR NV: Gonzalez, Padilla, Smallwood-Cuevas

UPDATED

VERSION: August 15, 2023

CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0001813

 THIRD READING  

Bill No: AB 1027

Author: Petrie-Norris (D)

Amended: 8/15/23 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/6/23

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Stern, Wiener

SENATE PUBLIC SAFETY COMMITTEE: 4-0, 7/11/23

AYES: Bradford, Ochoa Bogh, Skinner, Wiener

NO VOTE RECORDED: Wahab

ASSEMBLY FLOOR: 77-0, 5/22/23 - See last page for vote

SUBJECT: Social media platforms: drug safety policies

SOURCE: Author

DIGEST:

This bill requires social media platforms to disclose their policies regarding retention of electronic communication information and sharing of information related to drug distribution. The bill adds controlled substance distribution as a category of content for required terms of service reporting. This bill also requires social media platforms to retain content that it has taken action on that violates specified controlled-substance related policies and the username of the relevant user for 90 days.

ANALYSIS:

Existing federal law:

1. Provides a right to free speech and expression. (U.S. Const., 1st amend; Cal. Const., art 1, § 2.)
2. Provides, in federal law, that a provider or user of an interactive computer service shall not be treated as the publisher or speaker of any information provided by another information content provider. (47 U.S.C. § 230(c)(2).)
3. Provides that a provider or user of an interactive computer service shall not be held liable on account of:
   1. any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or
   2. any action taken to enable or make available to information content providers or others the technical means to restrict access to such material. (47 U.S.C. § 230(c)(2).)

Existing state law:

1. Requires an operator of a commercial website or online service that collects personally identifiable information about consumers to conspicuously post its privacy policy on its website and include specified disclosures. (Bus. & Prof. Code § 22575.)
2. Defines “controlled substance” as a drug, substance, or immediate precursor which is listed in any schedule I through V. (Health & Saf. Code § 11007.)
3. Requires a social media platform to create, and publicly post on the platform’s website, a policy statement with specified information, including the social media platform’s policy on the use of the platform to illegally distribute a controlled substance. This does not apply to social media platforms that generated less than $100 million in gross revenue during the preceding calendar year. The law expires on January 1, 2028. (Bus. & Prof. Code § 22945.)
4. Requires a social media company to post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service. (Bus. & Prof. Code § 22676.)
5. Requires social media companies to submit a terms of service report, on a semiannual basis, starting January 1, 2024, to the Attorney General, who must make it available to the public in a searchable repository on its website. (Bus. & Prof. Code § 22677.)
6. Subjects companies in violation of the preceding statute to penalties of up to $15,000 per violation per day to be sought by specified public prosecutors. (Bus. & Prof. Code § 22678.)
7. Establishes the California Electronic Communications Privacy Act (CalECPA), which prohibits a government entity from compelling the production of or access to electronic communication information from a service provider, as defined, except as specified, including pursuant to a lawful warrant or wiretap order. (Pen. Code § 1546.1.)
8. Defines “electronic communication information,” for purposes of CalECPA, to mean any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. (Pen. Code § 1546.)
9. Requires, pursuant to the California Consumer Protection Act of 2018 (CCPA), businesses, as defined, to include specified information in their privacy policies, such as a description of consumer rights, the categories of personal information the business collects about consumers, and a list of the categories it has sold about consumers in the preceding 12 months. (Civ. Code § 1798.130.)
10. Grants, through the CCPA, consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.) Consumers also have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer. (Civ Code § 1798.105.)
11. Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
12. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. Amendment of the CPRA is permitted by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)

This bill:

1. Applies the law requiring platforms to issue policy statements about controlled substance policies to social media platforms with gross revenue below $100 million.
2. Requires a social media platform’s policy statement regarding controlled substance distribution to include a general description of the platform’s:
   1. policy on the retention of electronic communication information, as defined in CalECPA, including how long the platform retains that information; and
   2. policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.
3. Requires a social media platform to retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia. A social media platform shall retain the content that violated a policy and the username of the violating account at issue for a period of 90 days. However, a social media platform is not required to retain content removed in violation of the policy if there is a good faith belief that the content is related to the offering, seeking, or receiving of gender-affirming health care, gender-affirming mental health care, or reproductive health care that is lawful under California law.
4. Makes clear that nothing in the above chapter of law alters the rights or obligations established in any other law, including, but not limited to, CalECPA and the CCPA.
5. Adds controlled substance distribution to the categories of content that must be included in required terms of service reports.

Background

The scourge of drug sales involving minors online is given a face through the anecdotes of people who are active drug users and parents of people who have overdosed on fentanyl that cite social media as an often used platform to advertise and sell drugs. Evidence shows that social media platforms have in fact become an increasingly popular avenue for the distribution and sale of illegal drugs, especially to younger generations. This includes fentanyl, a synthetic opioid that is 50 to 100 times stronger than morphine.

Recent laws have required more transparency from social media platforms about their policies and required them to report quantitative data on their content moderation efforts. The author argues that drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth.

This bill requires social media platforms to include in their already required policy statements a general description of the platform’s policy on the retention of electronic communication information and sharing of specified information. In addition, the bill adds to existing terms of service reporting requirements an obligation to disclose policies on addressing the distribution of controlled substances on the platform and data on the number of times such content was flagged and actioned. The most controversial aspect of the bill mandates platforms to retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia. Both the content and the user’s name must be retained for 90 days. For a more thorough discussion, please see the Senate Judiciary Committee analysis of the bill.

Comments

According to the author:

Two disturbing trends have dramatically escalated the dangers of fentanyl: the deceptive use of fentanyl in counterfeit pills and the use of social media to traffic these drugs to young people. Drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth. These sites have chat settings designed to erase chat history after just a few hours, making it incredibly difficult for law enforcement to track and prosecute online fentanyl traffickers. By requiring social media platforms to enact more stringent data collection, reporting, and storage requirements, AB 1027 offers important assistance to law enforcement agencies as they continue to fight this deadly epidemic.

AB 1628 (Ramos, Chapter 432, Statutes of 2022) required social media platforms to create and post a policy statement that includes their policies regarding distribution of controlled substances and its prevention, reporting mechanisms, and resources. This bill seeks greater transparency from social media platforms by requiring these reports to also include a general description of the social media platform’s policy on the retention of electronic communication information, as defined in CalECPA, including how long the platform retains that information. In addition, it requires a general description of the platform’s policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.

This bill also bolsters reporting requirements established by AB 587 (Gabriel, Chapter 269, Statutes of 2022) by adding a new category of content to be reported on, controlled substance distribution. This will help provide more significant and quantitative evidence of the scope of the problem and what is being done about it. Just as with the existing law, any violations are subject to public enforcement.

The bill also requires a social media platform to retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia. A social media platform is required to retain the content that violated a policy and the user name of the violating account at issue for a period of 90 days. This forced retention of information raises some thorny legal issues and may interfere with existing consumer rights. However, the bill does make clear that it shall not be read to interfere with any other rights or obligations established in existing law, including CalECPA and the CCPA.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 8/17/23)

Arcadia Police Officers' Association

Burbank Police Officers' Association

California Coalition of School Safety Professionals

California District Attorneys Association

California Reserve Peace Officers Association

City of Garden Grove

City of Laguna Niguel

Claremont Police Officers Association

Corona Police Officers Association

Culver City Police Officers' Association

Deputy Sheriffs' Association of Monterey County

Fullerton Police Officers' Association

Los Angeles School Police Officers Association

Murrieta Police Officers' Association

Newport Beach Police Association

Novato Police Officers Association

Orange County District Attorney

Orange County Sheriff's Department

Palos Verdes Police Officers Association

Peace Officers’ Research Association of California

Placer County Deputy Sheriffs' Association

Pomona Police Officers' Association

Riverside Police Officers Association

Riverside Sheriffs' Association

Santa Ana Police Officers Association

TechNet

Upland Police Officers Association

OPPOSITION: (Verified 8/17/23)

ACLU California Action

Electronic Frontier Foundation

Oakland Privacy

ARGUMENTS IN SUPPORT: TechNet writes:

AB 1027 takes a significant step toward establishing greater collaboration between law enforcement and social media platforms in combatting the illegal sale of controlled substances online. This bill would require platforms to retain data on specified content related to a violation of its controlled substances policy and retain that data for a period of 90 days.

ARGUMENTS IN OPPOSITION: Oakland Privacy writes:

[T]he provision to retain actioned content for 90 days is problematic in several respects. As a matter of constitutional law, the Fourth Amendment protects us from the search and seizure of our personal “papers” and property without probable cause. Our electronic information has long been considered to be a 21st century version of our papers. When the government, in this case the State of California, compels our communications to be seized by a third party, the reason needs to be a particularized cause. A corporate policy, however well-intended, does not rise to probable cause under the law. . . .

We strongly encourage the committee to remove the government mandate to compel actioned content retention. It is unconstitutional, violates the CA Privacy Act ballot initiative, and is fundamentally impractical as written.

ASSEMBLY FLOOR: 77-0, 5/22/23

AYES: Addis, Aguiar-Curry, Alanis, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Megan Dahle, Davies, Dixon, Essayli, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Gallagher, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Petrie-Norris, Ramos, Reyes, Luz Rivas, Robert Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Rendon

NO VOTE RECORDED: Chen, Lackey, Quirk-Silva

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/18/23 11:36:47

**** END ****

SENATE COMMITTEE ON PUBLIC SAFETY

Senator Aisha Wahab, Chair

2023 - 2024 Regular

Bill No: AB 1027 Hearing Date: July 11, 2023

Subject: Social media platforms: drug safety policies

HISTORY

Source: The Alexander Neville Foundation

Prior Legislation: SB 178 (Leno), Chapter 651, Stats. 2015

Support: TechNet

Opposition: ACLU California Action; Electronic Frontier Foundation

Assembly Floor Vote: 77 - 0

PURPOSE

The purpose of this bill is to require social media companies post policies regarding the sale of controlled substance on the platform to require information that violates the polices to be stored for 90 days and to provide for when that information can be shared with law enforcement.

Existing law provides that, among other rights, all people have an inalienable right to pursue and obtain privacy. (California Constitution, Article I, Section 1.)

Existing law declares that the right to privacy is a personal and fundamental right protected by the California Constitution and that all individuals have a right of privacy in information pertaining to them. (Civil Code§ 1798.1, the Information Practices Act of 1977.)

Existing law requires, pursuant to the California Consumer Protection Act of 2018 (CCPA), businesses, as defined, to include specified information in their privacy policies, such as a description of consumer rights, the categories of personal information the business collects about consumers, and a list of the categories it has sold about consumers in the preceding 12 months. (Civil Code § 1798.130.)

Existing law requires an operator of a commercial website or online service that collects personally identifiable information about consumers to conspicuously post its privacy policy on its website and included specified disclosures. (Business and Professions Code § 22575.)

Existing law defines “social media platform” as a public or semipublic internet-based service or application that has users in California and meets specified criteria. (Business and Professions Code § 22945.)

Existing law provides that, except as otherwise provided, every person who possesses for sale or purchase for purposes of sale any specified controlled substance, as defined, shall be punished by imprisonment in a county jail for two, three, or four years pursuant to existing law pertaining to felony sentencing. (Health and Safety Code § 11351.)

Existing law provides that, except as otherwise provided, every person who transports, imports into this state, sells, furnishes, administers, or gives away, or offers to transport, import into this state, sell, furnish, administer, or give away, or attempts to import into this state or transport, any specified controlled substance shall be punished by imprisonment in a county jail for two, three, or four years pursuant to existing law pertaining to felony sentencing. (Health and Safety Code § 11352.)

Existing law defines “controlled substance,” unless otherwise specified, to mean a drug, substance, or immediate precursor which is listed in any schedule pursuant to the Uniform Controlled Substances Act, as specified. (Health and Safety Code Section 11007; §§ 11054-11058.)

Existing law pursuant to the federal Communications Decency Act of 1996, provides, that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” and affords broad protection from civil liability for the good faith content moderation decisions of interactive computer services. (47 U.S.C. §§ 230(c)(1) and (2).)

Existing law provides that the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (U.S. Const., 4th Amend.; Cal. Const. art. I, § 13.)

Existing law prohibits exclusion of relevant evidence in a criminal proceeding on the ground that the evidence was obtained unlawfully, unless the relevant evidence must be excluded because it was obtained in violation of the federal Constitution's Fourth Amendment. (Cal. Const., art. I, § 28(f)(2).)

Existing law requires a magistrate to issue a search warrant if they are satisfied of the existence of the grounds of the application, or that there is probable cause to believe their existence. (Penal Code § 1528 (a).)

Existing law provides for a process for a search warrant for records that are in the actual or constructive possession of a foreign corporation that provides electronic communication services or remote computing services to the general public, where the records would reveal the identity of the customers using those services, data stored by, or on behalf of, the customer, the customer’s usage of those services, the recipient or destination of communications sent or from those customers, or the content of those communications. (Penal Code, § 1524.2.)

Existing law requires a provider of electronic communication services or remote computing services to disclose to a governmental prosecuting or investigating agency the name, address, local and long distance telephone toll billing records, telephone number or other subscriber number or identity, and length of service of a subscriber to or customer of that service, and the types of services the subscriber or customer utilized, when the governmental entity is granted a search warrant. (Pen. Code, § 1524.3 (a).)

Existing law states that a governmental entity receiving subscriber records or information is not required to provide notice of the warrant to a subscriber or customer. (Penal Code § 1524.3 (b).)

Existing law authorizes a court issuing a search warrant, on a motion made promptly by the service provider, to quash or modify the warrant if the information or records requested are unusually voluminous in nature or compliance with the warrant otherwise would cause an undue burden on the provider. (Penal Code, § 1524.3 (c).)

Existing law requires a provider of wire or electronic communication services or a remote computing service, upon the request of a peace officer, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a search warrant or a request in writing and an affidavit declaring an intent to file a warrant to the provider. Records shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the peace officer. (Penal Code § 1524.3 (d).)

Existing law specifies that no cause of action shall be brought against any provider, its officers, employees, or agents for providing information, facilities, or assistance in good faith compliance with a search warrant. (Penal Code § 1524.3(e).)

Existing law creates the Electronic Communications Privacy Act. (Penal Code §§ 1546 et. seq.)

Existing law provides that except as provided, a government entity shall not do any of the following:

1. Compel the production of or access to electronic communication information from a service provider.
2. Compel the production of or access to electronic device information from any person or entity other than the authorized possessor of the device.
3. Access electronic device information by means of a physical interaction or electronic communication with the electronic device. (Penal Code § 1546.1(a))

Existing law provides that a government entity may compel the production of or access to electronic communication information from a service provider, or compel the production of or access to electronic device information from any person or entity other than the authorized processor of the device only under the following circumstances:

1. Pursuant to a warrant.
2. Pursuant to a wiretap order.
3. Pursuant to an order for electronic reader cards issued under the Civil Code
4. Pursuant to a subpoena issued pursuant to existing law, provided that the information is not sought for the purpose of investigating or prosecuting a criminal offense.
5. Pursuant to an order of a pen register or trap trace device. (Penal Code § 1546.1(b))

Existing law provides that a government entity may access electronic device information by means of a physical interaction or electronic communication device only: pursuant to a warrant; wiretap; with authorization of the possessor of the device; with consent of the owner of the device; in an emergency; if seized from an inmate. (Penal Code § 1546.1(c))

Existing law describes what a warrant for electronic information shall include. (Penal Code § 1546.1(d))

Existing law provides that if a government entity receives electronic communication voluntarily it shall destroy that information within 90 days except under specified circumstances. (Penal Code § 1546.1(g))

This bill provides that among the items that a social media company shall submit to the Attorney General regarding their terms of service report that they shall include whether their current terms of service defines controlled substance distribution.

This bill adds to the items that a social media platform shall create and publicly post on their websites the following:

• A general description of the social media platform’s policy on the retention of electronic communication information as defined in Section 1546 of the Penal Code.
• A general description of the social media platform’s policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.

This bill provides that a social media platform shall retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia.

This bill provides that social medial platform shall retain the content that violated a policy and the user name of the violating account for a period of 90 days.

This bill provides that it does not prohibit a social media platform from disclosing account and user information when request by law enforcement under the California Consumer Privacy Act.

This bill provides that the Attorney General shall identify a clear and designated point of contact within the Department of Justice to direct reports by a social media platform of actioned content or accounts that indicate an “eminent” threat to human life.

This bill provides that it does not authorize a governmental entity to compel production of or access sot content or electronic communication from a service provider, or compel the production of or access to electronic device information except as pursuant to the California Electronic Privacy Act in the Penal Code.

COMMENTS

1. Need for This Bill

According to the author:

Two disturbing trends have dramatically escalated the dangers of fentanyl: the deceptive use of fentanyl in counterfeit pills and the use of social media to traffic these drugs to young people. Drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth. These sites have chat settings designed to erase chat history after just a few hours, making it incredibly difficult for law enforcement to track and prosecute online fentanyl traffickers.

AB 1027 will strengthen the collaboration between social media companies and law enforcement as they work together to curb the practice of online drug trafficking in California. Specifically, the bill will:

• Require social media companies to post in their policy statement a general description of their platform’s policy on the retention of electronic communications information.
• Require social media companies to create and submit to the California Attorney General’s office a monthly report of accounts that have been flagged for illicit drug sales.
• Require social media companies to retain the information related to the actioned account, including a record of, and the content of, the communications for 90 days. 
• Upon failure to retain information related to the actioned account, a social media company will be subject to fine of not more than $190,000 for the initial violation and no more than $380,000 for subsequent violations.

2. Search warrants and the California Electronic Privacy Act

Both the United States and the California constitutions guarantee the right of all persons to be secure from unreasonable searches and seizures. (U.S. Const., amend. IV; Cal. Const., art. 1, sec. 13.) Generally, a “search” is a governmental intrusion upon, or invasion of a person’s security in an area in which they have a reasonable expectation of privacy. These constitutional provisions generally require the police to secure a warrant before conducting a search, and specify that the warrant must be issued “upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched.” (Ibid.)

Penal Code section 1523 defines a “search warrant” as an order, in writing, signed by a magistrate, commanding a peace officer to search for personal property and bring it before a magistrate. Section 1524 outlines the statutory grounds for issuance of search warrants and mandates that they be supported by probable cause. The standard for probable cause to issue a search warrant is “whether, given all the circumstances set forth in the affidavit, there is a fair probability that contraband or evidence of a crime will be found in a particular place.” (Illinois v. Gates (1983) 462 U.S. 213, 238.)

In 2015, the Legislature enacted CalECPA (SB 178 (Leno), Chapter 651, Statutes of 2015), a comprehensive digital privacy law which took effect on January 1, 2016 (§ 1546 et seq.).

[CalECPA] requires all California state and local law enforcement agencies to obtain a search warrant or wiretap order before they can access any electronic communication information. The law defines ‘electronic communication information’ in the broadest terms possible so that it includes emails, digital documents, text messages, location information, and any digital information stored in the cloud. The law protects all aspects of electronic communication information, not just its contents, but also metadata information relating to the sender, recipient, format, time, date, and location of the communications, including IP addresses.

CalECPA also limits the ability of California law enforcement to obtain information directly from a smartphone or similar device, or to track them. Law enforcement must either obtain a warrant or get the consent of the person possessing the electronic device.

(Daniels, California Updates Privacy Rights with the Electronic Communications Privacy Act (Nov. 17, 2015) JDSupra.

The act defines “electronic device information” as any information stored on or generated through the operation of an electronic device, including the current and prior locations of the device. “Electronic communication information” means any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. “Government entity” means a department or agency of the state or a political subdivision thereof, or an individual acting for or on behalf of the state or a political subdivision thereof.

3. Possible Conflict between CalECPA and the California Consumer Privacy Act

This bill intends to address issues with social media platforms being used for drug sales. It adds to reports they need to start submitting to the Attorney General in 2024 information regarding their terms of service contract information on sales of a controlled substance. It also adds to the things a social media platform must post on their website information on the retention of electronic communication information and a general description of their policies and procedures governing when they will proactively share relevant information pertaining to illegal distribution of a controlled substance.

This bill on the one had provides that it does not prohibit a social media platform from disclosing account and user information when requested by law enforcement under the California Consumer Privacy Act (CCPA) but it also provides that it does not authorize a governmental entity to compel the production of or access to content or electronic communications device or electronic device information except under CalECPA. CCPA provides that it shall not restrict a business’s ability to comply with a civil, criminal, or regulatory inquiry, subpoena, or summons by federal, state, or local authorities. It also allows law enforcement to request consumer information not be destroyed for 90 days pursuant to an investigation in order to allow an agency to receive a subpoena or warrant. CalECPA requires law enforcement to get a warrant to access electronic communication information. The bill already requires the information to be stored for 90 days so is that provision of CCPA necessary. Should the law be clear that CalECPA needs to be followed to access the information and the reference to CCPA be deleted?

4. Notice to the Attorney General

The bill provides that the Attorney General shall identify a clear and designated point of contact with in the Department of Justice to direct reports by a social media platform of actioned content or accounts that indicate an eminent (sic) threat to human life. If a threat is imminent, will notifying the Attorney General’s office help? Is the AG expected to act on it immediately? Will the contact have to be available 24/7? Would it make more sense to have a social media platform notify a local agency if the locale can be determined? Since this could be seen as an exception to CalECPA, should what is an imminent threat be more clearly defined such as the potential of death or great bodily injury?

As a technical amendment, staff believes the intent was to refer to an imminent threat, not an eminent threat? If it is intended to mean that it is not urgent but instead that it stands out maybe a different term than eminent should be used?

5. Double-referral

This bill was first heard by the Senate Judiciary Committee.

6. Argument in Support

Technet supports this bill stating:

AB 1027 takes a significant step toward establishing greater collaboration between

law enforcement and social media platforms in combatting the illegal sale of

controlled substances online. This bill would require platforms to retain data on

specified content related to a violation of its controlled substances policy and retain

that data for a period of 90 days. AB 1027 also requires platforms to report to the

Attorney General information about content related to controlled substances on the

platform on a semiannual basis. We are working with the author to secure an

additional amendment that replaces the reference to “controlled substances

distribution” with “controlled substances,” broadening the category and bringing it

into closer alignment with how platforms currently collect such information. Adding these requirements will equip law enforcement and prosecutors with more

information about when and how to file preservation requests and warrants, which

can mean the difference between successfully building a case against a dealer or

not.

7. Argument in Opposition

The Electronic Frontier Foundation opposes this bill stating (letter for 6/20/23 version):

There are several reasons that a person may wish to delete records of their personal

conversations promptly. Many choose to automatically delete messages for convenience's sake. But there are several instances where being able to delete information whenever you want carries greater importance. For example, a student may be speaking to a friend about a potential decision to become public about their sexual orientation in messages, and not wish for their parents to see it.

This is particularly true right now, as many states across the country pass laws

criminalizing certain types of healthcare. A person seeking reproductive or genderaffirming care that's criminalized in their state may speak to a support group about receiving that care. Law enforcement officials seeking to prosecute people seeking or supporting this kind of health care will have far more time to request access to that information if this bill requires its retention. Those seeking to expose that information— whether to bring lawsuits under bounty-style state laws around reproductive care, or to simply to embarrass people by exposing their personal conversations—will also have more time to hack into it.

Conditioning retention mandates on whether a social media platform has taken an action on content is also deeply concerning. Social media company content moderation and takedown systems are unreliable and often flag information that is not in violation of any rules. Speech moderation rules are unevenly enforced, with little to no transparency, against a range people for whom the Internet is an irreplaceable forum to express ideas, connect with others, and find support. This includes people on the margins who question authority, criticize the powerful, educate, and call attention to discrimination.

The bill's requirement that providers scan "actioned content" also poses serious threats to end-to-end encryption and, therefore, user privacy. Requiring that platforms scan actioned content may as a practical matter mean that platforms will not let people use end-to-end encryption because it would interfere with scanning.

Private communication is a basic, universal right. In the online world, the best tool we have to defend this right is end-to-end encryption. This ensures that governments, tech companies, social media platforms, and other groups cannot view or access our private messages, the pictures we share with family and friends, or our bank account details. This is a universal right, and one that is a particularly vital protection for the most vulnerable in society—such as children or human rights defenders who rely on private messaging to do their jobs in hostile environments.

Requiring companies to retain this kind of information under a government mandate undermines people's control of their own personal conversations. It also substantially increases risks that their information could be exposed, and effectively removes the option for end-to-end encryption. For these reasons, we must respectfully oppose A.B.1027 and respectfully urge your "no" vote. Thank you.

-- END –

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 1027 (Author:Petrie-Norris)

Version: July 3, 2023

Hearing Date: July 6, 2023

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Social media platforms: drug safety policies

DIGEST

This bill requires social media platforms to disclose their policies regarding retention of electronic communication information and sharing of information related to drug distribution. The bill adds controlled substance distribution as a category of content for purposes of the required terms of service reporting.

EXECUTIVE SUMMARY

The scourge of drug sales involving minors online is given a face through the anecdotes of people who are active drug users and parents of people who have overdosed on fentanyl that cite social media as an often used platform to advertise and sell drugs. Evidence shows that social media platforms have in fact become an increasingly popular avenue for the distribution and sale of illegal drugs, especially to younger generations. This includes fentanyl, a synthetic opioid that is 50 to 100 times stronger than morphine.

Recent laws have required more transparency from social media platforms about their policies and required them to report quantitative data on their content moderation efforts. The author argues that drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth.

This bill requires social media platforms to include in their already required policy statements a general description of the platform’s policy on the retention of electronic communication information and sharing of specified information. In addition, the bill adds to existing terms of service reporting requirements an obligation to disclose policies on addressing the distribution of controlled substances on the platform and data on the number of times such content was flagged and actioned. The bill also mandates platforms to retain specified user information and material for 90 days. A previous version of the bill was supported by the Peace Officers’ Research Association and TechNet. It is opposed by ACLU California Action and the Electronic Frontier Foundation.

PROPOSED CHANGES TO THE LAW

Existing federal law:

1. Provides a right to free speech and expression. (U.S. Const., 1st amend; Cal. Const., art 1, § 2.)
2. Provides, in federal law, that a provider or user of an interactive computer service shall not be treated as the publisher or speaker of any information provided by another information content provider. (47 U.S.C. § 230(c)(2).)
3. Provides that a provider or user of an interactive computer service shall not be held liable on account of:
   1. any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or
   2. any action taken to enable or make available to information content providers or others the technical means to restrict access to such material. (47 U.S.C. § 230(c)(2).)

Existing state law:

1. Requires an operator of a commercial website or online service that collects personally identifiable information about consumers to conspicuously post its privacy policy on its website and include specified disclosures. (Bus. & Prof. Code § 22575.)
2. Requires, pursuant to the California Consumer Protection Act of 2018 (CCPA), businesses, as defined, to include specified information in their privacy policies, such as a description of consumer rights, the categories of personal information the business collects about consumers, and a list of the categories it has sold about consumers in the preceding 12 months. (Civ. Code § 1798.130.)
3. Defines “controlled substance” as a drug, substance, or immediate precursor which is listed in any schedule I through V. (Health & Saf. Code § 11007.)
4. Requires a social media platform to create, and publicly post on the platform’s website, a policy statement with specified information, including:
   1. the social media platform’s policy on the use of the platform to illegally distribute a controlled substance;
   2. a general description of the platform’s moderation practices that are employed to prevent users from posting or sharing electronic content pertaining to the illegal distribution of a controlled substance;
   3. a link to the platform’s reporting mechanism for illegal or harmful content or behavior on the online platform; and
   4. a general description of the platform’s policies and procedures for responding to law enforcement inquiries, including warrants, subpoenas, and other court orders compelling the production of or access to electronic communication information, as defined in CalECPA. (Bus. & Prof. Code § 22945(b).)
5. Provides that the preceding statute does not apply to social media platforms that generated less than $100 million in gross revenue during the preceding calendar year. The law expires on January 1, 2028. (Bus. & Prof. Code § 22945.)
6. Requires a social media company to post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service. (Bus. & Prof. Code § 22676.)
7. Requires social media companies to submit a terms of service report, on a semiannual basis, starting January 1, 2024, to the Attorney General, who must make it available to the public in a searchable repository on its website. The terms of service report must include specified information, including:
   1. a statement of whether the current version of the terms of service defines specified categories of content, and, if so, the definitions of those categories, including any subcategories. This includes hate speech, racism, extremism, harassment, disinformation, misinformation, and foreign political interference;
   2. a detailed description of content moderation practices used by the social media company for that platform, including:
      1. any policies intended to address the above categories of content;
      2. how automated content moderation systems enforce terms of service and when these systems involve human review;
      3. how the social media company responds to user reports of violations of the terms of service;
      4. how the social media company would remove individual pieces of content, users, or groups that violate the terms of service, or take broader action against individual users or against groups of users that violate the terms of service; and
   3. information on content that was flagged by the social media company as content belonging to any of the above categories, including the total number of all of the following:
      1. flagged items of content;
      2. actioned items of content;
      3. actioned items of content that resulted in action taken by the social media company against the user or users responsible;
      4. actioned items of content that were removed, demonetized, or deprioritized by the social media company; and
      5. times actioned items of content were viewed or shared by users; and
   4. all information required in the previous section shall also be disaggregated into the category of content, the type of content, the type of media, and how the content was flagged and actioned. (Bus. & Prof. Code § 22677.)
8. Subject companies in violation of the preceding statute to penalties of up to $15,000 per violation per day to be sought by specified public prosecutors. (Bus. & Prof. Code § 22678.)
9. Establishes the California Electronic Communications Privacy Act (CalECPA), which prohibits a government entity from compelling the production of or access to electronic communication information from a service provider, as defined, except as specified, including pursuant to a lawful warrant or wiretap order. (Pen. Code § 1546.1.)
10. Defines “electronic communication information,” for purposes of CalECPA, to mean any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. (Pen. Code § 1546.)
11. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
12. Provides that a consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or shares the consumer’s personal information. This right may be referred to as the right to opt-out of sale or sharing. (Civ. Code § 1798.120.)
13. Grants consumers the right to request that a business delete any personal information about the consumer which the business has collected from the consumer. (Civ Code § 1798.105.)
14. Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
15. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
16. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Removes the sunset from the law requiring platforms to issue policy statements about controlled substance policies^[1] and applies it to social media platforms with gross revenue below $100 million.
2. Requires a social media platform’s policy statement regarding controlled substance distribution to include a general description of the platform’s:
   1. policy on the retention of electronic communication information, as defined in CalECPA, including how long the platform retains that information; and
   2. policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.
3. Requires the Attorney General to identify a clear and designated point of contact within the Department of Justice to direct reports by a social media platform of actioned content or accounts that indicate an “eminent” threat to human life.
4. States that the above section of law requiring these policy statements does not prohibit a social media platform from disclosing account and user information when requested by law enforcement pursuant to Section 1798.145 of the Civil Code. However, it also provides that it does not authorize a governmental entity to compel the production of or access to content or electronic communication information, as defined in Section 1546 of the Penal Code, from a service provider, or compel the production of or access to electronic device information, as defined in Section 1546 of the Penal Code, from any person or entity other than the authorized possessor of the device except pursuant to Section 1546.1 of the Penal Code and Section 22945.
5. Mandates a reporting mechanism for illegal or harmful content or behavior on platforms.^[2]
6. Requires a social media platform to retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia. A social media platform shall retain the content that violated a policy and the user name of the violating account at issue for a period of 90 days.
7. Adds controlled substance distribution to the categories of content that must be included in required terms of service reports.

COMMENTS

1. Issues with illegal online drug activity

This bill is motivated by the increase in the use of social media to buy and sell illegal drugs. One tragic example:

Last winter, Megan Macintosh found her 18-year-old son Chase unconscious after she says he experimented with pills. He died just over a month later, likely from a pill laced with fentanyl from an unknown source.

Macintosh turned to his social media for answers. Looking through her son’s Snapchat, she said she saw bags of pills and mushrooms. “I felt really helpless like there’s really nothing I can do when I saw how prevalent it was, how many people were in his feed,” she said.

The drug trade is booming on social media, according to Kathleen Miles, who works for the Center on Illicit Networks and Transnational Organized Crime. “I think social media can be great, but it also has a really dark side of it,” Miles said.

With fentanyl in high circulation, the risks are often deadly. The U.S. recorded more than 100,000 drug overdose deaths in a 12-month period for the first time, according to the Centers for Disease Control and Prevention. It’s the highest number of drug overdose deaths ever recorded in a year.^[3]

The Drug Enforcement Administration has warned of the alarming increase in the availability and lethality of fake prescription pills containing fentanyl and methamphetamine and issued a public safety alert that “warns Americans that counterfeit pills, often sold on social media or e-commerce websites, increasingly contain fentanyl or sometimes methamphetamine, posing health risks beyond the dangers of buying prescription pills.”^[4]

1. Drug Safety Policies on Online Platforms

This bill attempts to tackle the incidence of drug distribution online by bolstering existing laws requiring more transparency from social media platforms.

• • • • 1. Disclosing retention policies

AB 1628 (Ramos, Ch. 432, Stats. 2022) requires social media platforms to create and post a policy statement that includes their policies regarding distribution of controlled substances and its prevention, reporting mechanisms, and resources. Specifically, the statement must include the platform’s policy on the use of the platform to illegally distribute a controlled substance, which in most cases will likely be to disallow it. The statement must describe the platform’s policies for responding to law enforcement inquiries, but does not require any specific policy. The statement must also include a general description of the online platform’s moderation practices that are geared toward preventing content related to the illegal distribution of drugs as well as a link to the platform’s reporting mechanism for illegal or harmful content, if one exists. The platforms are to update the policy statement as necessary. The law only applies to platforms that generated at least $100 million in gross revenue and sunsets on January 1, 2028.

This bill seeks greater transparency from social media platforms by requiring these reports to also include a general description of the social media platform’s policy on the retention of electronic communication information, as defined in CalECPA, including how long the platform retains that information. In addition, it requires a general description of the platform’s policies and procedures governing when a platform proactively shares relevant information pertaining to the illegal distribution of a controlled substance.

• • • • 1. Controlled substance distribution reporting

Another bill, AB 587 (Gabriel, Ch. 269, Stats. 2022), also established transparency and reporting requirements on social media platforms. The law requires social media platforms to post their terms of service. These policies must include information about how users can ask questions, how they can flag content or users in violation, and a list of potential actions that the company might take in response. To ensure meaningful access, the terms of service must be posted in a manner reasonably designed to inform all users of their existence and contents and be available in all Medi-Cal threshold languages in which the social media platform offers product features.

AB 587 also requires a detailed terms of service report to be compiled by these companies and submitted on a semiannual basis to the Attorney General, who must make it available to the public in a searchable repository on its website. The terms of service report must include specified information, including a statement of whether the current version of the terms of service defines specified categories of content, and, if so, the definitions of those categories, including any subcategories. This includes hate speech, racism, extremism, harassment, disinformation, misinformation, and foreign political interference. Specific content moderation practices or other policies focused on these various categories of content are required to be included.

The law also required detailed information on flagged and actioned content, including the total number of all of the following:

• flagged items of content;
• actioned items of content;
• actioned items of content that resulted in action taken by the social media company against the user or users responsible;
• actioned items of content that were removed, demonetized, or deprioritized by the social media company; and
• times actioned items of content were viewed or shared by users.

In addition, all this information must also be disaggregated into the category of content, the type of content, the type of media, and how the content was flagged and actioned.

This bill bolsters the AB 587 reporting requirements by adding a new category of content to be reported on, controlled substance distribution. This will help provide more significant and quantitative evidence of the scope of the problem and what is being done about it. Just as with the existing law, any violations are subject to public enforcement.

• • • • 1. Forced retention of information

The bill also requires a social media platform to retain data on content it has taken action to take down or remove for a violation of a policy prohibiting the unlawful sale, distribution, amplification, or otherwise proliferation of controlled substances and related paraphernalia. A social media platform is required to retain the content that violated a policy and the user name of the violating account at issue for a period of 90 days.

This forced retention of information raises some thorny legal issues and may interfere with existing consumer rights.

For instance, the CCPA, as amended by the CPRA, grants a series of rights to consumers, including the right to delete information held by businesses. Section 25 of the CPRA requires any amendments thereto to be in line with the purpose and intent of the law:

The provisions of this Act may be amended after its approval by the voters by a statute that is passed by a vote of a majority of the members of each house of the Legislature and signed by the Governor, provided that such amendments are consistent with and further the purpose and intent of this Act as set forth in Section 3, including amendments to the exemptions in Section 1798.145 if the laws upon which the exemptions are based are amended to enhance privacy and are consistent with and further the purposes and intent of this Act . . . .

Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:

• consumers should know who is collecting their personal information;
• consumers should have control over how their personal information is used; and
• consumers should benefit from businesses’ use of their personal information.

This limitation on amendments applies not only to the specific CCPA provisions amended by the ballot initiative but also other relevant statutes, regardless of whether the CPRA makes any substantive change thereto. Given the retention provision may interfere directly with the rights provided under the CCPA, it may run afoul of the CPRA restriction.

In addition, given that the retention provision is essentially a government mandate on private businesses to seize certain personal information of private individuals, Fourth Amendment issues arguably arise. Groups in opposition highlight these, and other, concerns.

The Electronic Frontier Foundation writes:

Our organization had been opposed to the initial version of this bill but removed opposition when a 7-day mandatory retention period was deleted from the bill. Now that it has been amended to include a 90-day retention period for “actioned content,” we must again raise our concerns about this bill’s effect.

While we understand and respect Asm. Petrie-Norris’ goal of addressing the fentanyl crisis, this bill would considerably undermine people’s autonomy over the privacy of their communications. It may also conflict with the federal and California constitutions. Government-mandated data retention of people’s communications raises serious Fourth Amendment issues.

There are several reasons that a person may wish to delete records of their personal conversations promptly. Many choose to automatically delete messages for convenience’s sake. But there are several instances where being able to delete information whenever you want carries greater importance. For example, a student may be speaking to a friend about a potential decision to become public about their sexual orientation in messages, and not wish for their parents to see it.

This is particularly true right now, as many states across the country pass laws criminalizing certain types of healthcare. A person seeking reproductive or genderaffirming care that’s criminalized in their state may speak to a support group about receiving that care. Law enforcement officials seeking to prosecute people seeking or supporting this kind of health care will have far more time to request access to that information if this bill requires its retention. Those seeking to expose that information— whether to bring lawsuits under bounty-style state laws around reproductive care, or simply to embarrass people by exposing their personal conversations—will also have more time to hack into it.

ACLU California Action writes in opposition to the bill:

This bill could be weaponized against the most vulnerable communities in California and across the country. Testosterone – a drug used widely for gender-affirming healthcare, particularly for transgender men – is listed as a controlled substance in both California statute and federal definitions of controlled substances. As many states across the country pass laws criminalizing certain types of healthcare, some transgender people may be forced to purchase testosterone using nontraditional methods. Social media platforms would then be required to retain this extremely sensitive health information for 90 days, giving law enforcement officials in other states far more time to subpoena information that would assist in investigating transgender people.

Additionally, bad actors seeking to expose health information – whether to bring lawsuits under bounty-style state laws relating to reproductive or gender-affirming care, or to simply embarrass people by exposing their personal conversations – will have more time to hack into social media platforms. Facebook messages have already been used in one case to investigate a person for her alleged abortion.

• • • • 1. Additional provisions that arguably need clarification

The bill also includes a requirement for the Attorney General to identify a clear and designated point of contact within the Department of Justice to direct reports by a social media platform of actioned content or accounts that indicate an imminent^[5] threat to human life. This is ostensibly to make sure platforms can easily discern to whom they should report certain criminal activity. However, it is unclear whether the Attorney General is the right office to be communicating potentially life-endangering conduct. In addition, the author states the intent of this is address situations where platforms are looking to voluntarily and proactively report such information. The author has agreed to the following amendment to make this clearer:

“The Attorney General shall identify a clear and designated point of contact within the Department of Justice to direct proactive and voluntary reports by a social media platform of actioned content or accounts that indicate an eminent imminent threat to human life.”

The bill also states that this chapter of law, requiring these policy statements and now the retention requirement, does not prohibit a social media platform from disclosing account and user information when requested by law enforcement pursuant to Section 1798.145 of the Civil Code. However, it also provides that it does not authorize a governmental entity to compel the production of or access to content or electronic communication information, as defined in Section 1546 of the Penal Code, from a service provider, or compel the production of or access to electronic device information, as defined in Section 1546 of the Penal Code, from any person or entity other than the authorized possessor of the device except pursuant to Section 1546.1 of the Penal Code and Section 22945.

These sections could benefit from more clarity. To avoid conflicting with other laws, including CalECPA, the author has agreed to amend Sections 22945.3(a) and 22945.7 and replace it with the following provision:

“Nothing in this chapter shall be construed to alter the rights or obligations established in any other law, including, but not limited to, the California Electronic Communications Privacy Act, Penal Code Section 1546 et seq., and the California Consumer Privacy Act, Civil Code Section 1798.100 et seq.”

This would effectuate the author’s stated intent with these provisions while avoiding unintended consequences.

1. Stakeholder positions

According to the author:

Two disturbing trends have dramatically escalated the dangers of fentanyl: the deceptive use of fentanyl in counterfeit pills and the use of social media to traffic these drugs to young people. Drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth. These sites have chat settings designed to erase chat history after just a few hours, making it incredibly difficult for law enforcement to track and prosecute online fentanyl traffickers. By requiring social media platforms to enact more stringent data collection, reporting, and storage requirements, AB 1027 offers important assistance to law enforcement agencies as they continue to fight this deadly epidemic.

Several position letters in support largely focus on a previous version of the bill before multiple sets of recent amendments went into print.

SUPPORT

Peace Officers’ Research Association of California (previous version)

TechNet (previous version)

OPPOSITION

ACLU California Action

Electronic Frontier Foundation

RELATED LEGISLATION

Pending Legislation: SB 60 (Umberg, 2023) authorizes a person to seek an order requiring a social media platform to remove content that includes an offer to transport, import into this state, sell, furnish, administer, or give away a controlled substance in violation of the law. SB 60 is currently in the Assembly Appropriations Committee.

Prior Legislation:

AB 587 (Gabriel, Ch. 269, Stats. 2022) See Comment 2.

AB 1628 (Ramos, Ch. 432, Stats. 2022) See Comment 2.

PRIOR VOTES:

The following votes are relevant to a previous version of the bill:

Assembly Floor (Ayes 77, Noes 0)

Assembly Appropriations Committee (Ayes 15, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

Assembly Judiciary Committee (Ayes 9, Noes 0)

**************

1. The author has stated they intend to amend the bill to reinstate the sunset. ↑

2. The author has stated they intend to amend the bill to remove this provision. ↑

3. Tom Hanson, Teens have easier access to drugs as illegal trade booms on social media (November 30, 2021) CBS News, https://www.cbsnews.com/news/social-media-teens-drug-access/. All internet citations are current as of July 1, 2023. ↑

4. Devlin Barrett & Elizabeth Dwoskin, With overdose deaths soaring, DEA warns about fentanyl-, meth-laced pills (September 27, 2021) The Washington Post, https://www.washingtonpost.com/national-security/dea-warning-counterfeit-drugs/2021/09/27/448fcb18-1f27-11ec-b3d6-8cdebe60d3e2_story.html. ↑

5. The bill in print references “eminent” threats. The author likely intends this to refer to “imminent” threats. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 1027

Author:(Petrie-Norris)

As Amended Ver:April 27, 2023

Majority vote

SUMMARY

Requires a social media platform to publicly post on its internet website a general description of its policy regarding the retention of electronic communication information, including how long the platform retains that information.

Major Provisions

1. Requires a social media platform that operates in California, if owned by a business that generated annual revenue in excess of $100 million in the previous year, to include in a policy statement that it publicly posts on its internet website the following:
   1. A general description of the social media platform's policy regarding the retention of electronic communication information, as that term is defined under the California Electronic Communications Privacy Act (CalECPA).
   2. How long the platform retains that information.

COMMENTS

According the U.S. Centers for Disease Control and Prevention (CDC), fentanyl, a synthetic opioid up to 50 times stronger than heroin, is currently responsible for over 150 deaths a day in the United States due to overdoses. (CDC, Fentanyl Facts (Feb. 23, 2022), available at https://www.cdc.gov/stopoverdose/fentanyl/index.html.)

This epidemic of overdoses is exacerbated by the ability of interested parties to use social media platforms to connect with strangers or acquaintances who distribute and sell opioids, making illegal drugs easier and more convenient to purchase. Because the clientele of many social media platforms skews younger, this distribution channel has been especially harmful to teens and young adults. According to a 2021 Washington Post article:

DEA Administrator Anne Milgram specifically called out Snapchat and TikTok, two apps that are popular with teenagers and young adults, for not doing more to combat sales….

For years, illegal drug sales have been a scourge on Facebook, Snapchat, TikTok and other social media apps. Companies have repeatedly said they're working to rid their sites of drug deals by hiring extra moderators, using artificial-intelligence algorithms to root out illegal material and limiting searches for keywords related to drugs. But prescription and other drugs can still easily be found for sale. […]

The public health crisis is renewing calls from not just law enforcement groups but concerned parents and researchers for the social media companies to do more. They want the companies to be more transparent about what's happening on their platforms….

(Lerman & De Vynck, Snapchat, TikTok, Instagram face pressure to stop illegal drug sales as overdose deaths soar, Washington Post (Sep. 28, 2021), available at https://www.washingtonpost.com/technology/2021/09/28/tiktok-snapchat-fentanyl/.)

Last year's AB 1628 ((Ramos), Chapter 432, Statutes of 2022) was enacted in response to such calls for transparency in social media platforms' practices. The bill required each large social media platform to publicly post on its internet website a policy statement containing information such as (i) the platform's policy on the use of the platform to illegally distribute a controlled substance; (ii) a description of the platform's moderation practices employed to prevent users from sharing content regarding illegal distribution of a controlled substance; and (iii) the platform's policies and procedures for responding to law enforcement inquiries, including warrants, subpoenas, and other courts compelling production of electronic communications information.

This bill would bolster AB 1628 by further increasing the transparency of large social media platforms' treatment of electronic communications information. Specifically, the bill, as amended, would require each platform to post a general description of its policies regarding the retention of electronic communication information, including how long the platform retains that information.

The transparency provided by this bill—particularly specification of how long social media platforms retain electronic communications information—may prove valuable in combatting illegal drug trafficking, as well as other illicit activities, such as sex trafficking and the sharing of child pornography. At present, law enforcement authorities may be unsure of how long they will have to obtain needed records of communications, including valuable metadata (such as the time when a communication took place, the user account(s) involved, and any email addresses, IP addresses, or phone numbers associated with those accounts), from particular platforms. They may therefore waste time seeking records that cannot be obtained (because the data they seek has been deleted), or else wrongly believe it is futile to seek the records (because they incorrectly believe the data will have been deleted). Publication of these time frames may help ensure that law enforcement efforts in this regard are not wasted.

According to the Author

Social media platforms currently post a policy statement that includes general information about their terms and usage. […] By adding this additional policy statement requirement, AB 1027 will provide law enforcement agencies with access to information that could be invaluable in their efforts to investigate online illicit drug transactions.

Arguments in Support

Peace Officers Research Association of California writes:

AB 1027 aims to prevent fentanyl poisoning … [it] will offer important assistance to law enforcement to combat this epidemic.

Arguments in Opposition

None on file. All opposition letters are directed to a previous version of the bill.

FISCAL COMMENTS

No state costs.

VOTES

ASM JUDICIARY: 9-0-2

YES: Maienschein, Connolly, Dixon, Haney, Kalra, Pacheco, Papan, Reyes, Robert Rivas

ABS, ABST OR NV: Essayli, Sanchez

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM APPROPRIATIONS: 15-0-1

YES: Holden, Megan Dahle, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Addis, Lowenthal, Papan, Pellerin, Robert Rivas, Sanchez, Weber, Wilson

ABS, ABST OR NV: Mathis

UPDATED

VERSION: April 27, 2023

CONSULTANT: Jith Meganathan / P. & C.P. / (916) 319-2200 FN: 0000370

Date of Hearing: May 10, 2023

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Chris Holden, Chair

ABPCA Bill Id:AB 1027

Author:(Petrie-Norris) – As Amended Ver:April 27, 2023

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires a large social media platform, as specified, to publicly post on its internet website a description of its retention policy for electronic communication information, including how long it retains the information.

FISCAL EFFECT:

No state costs.

COMMENTS:

1. Background. This bill follows a series of other legislation intended to increase transparency of large social media platforms’ treatment of electronic communications information. Existing law requires a large social media platform to publicly post on its internet website information about use of the platform to distribute drugs and the platform’s policies and procedures for responding to law enforcement inquiries for information. This bill requires a large social media platform to post on its internet website a description of its electronic communications retention policy.
2. Previous Legislation. AB 587 (Gabriel), Chapter 269, Statutes of 2022, required social media companies to post their terms of service in a manner reasonably designed to inform all users of the policies and required social media companies to submit reports to the Attorney General.

AB 1628 (Ramos), Chapter 432, Statutes of 2022, required social media platforms operating in the state to create and publicly post policy statements including specified information about use of the platform to illegally distribute controlled substances.

SB 1056 (Umberg), Chapter 881, Statutes of 2022, required social media platforms to clearly state whether they have mechanisms for reporting violent posts and allowed a person who is the target of a violent post to seek an injunction to have the violent post removed.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 25, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 1027 (

Author:Petrie-Norris) – As Amended Ver:April 6, 2023

As Proposed to be Amended

SUBJECT: Social media platforms

SYNOPSIS

This author-sponsored measure would require each large social media platform that operates in California to make publicly available on its website a description of its policies regarding retention of electronic communication information—including, crucially, how long the platform retains such information.

The bill is intended as a policy response to the widespread use of social media platforms to sell fentanyl, a synthetic opioid that the Centers for Disease Control and Prevention reports is causing the overdose deaths of over 150 Americans per day. If a person overdoses or dies after taking fentanyl, and a law enforcement agency reasonably suspects the fentanyl was purchased via a social media platform, this bill should help apprise the agency as to whether there is sufficient time to obtain the records of the transaction before the underlying data is deleted. Publication of these time frames could therefore help ensure that law enforcement efforts in this regard are not wasted.

Committee amendments propose to amend the bill substantially, while still furthering the author’s goal of providing more tools to address fentanyl trafficking online. The bill, in its pre-amendment form, was previously heard by the Assembly Judiciary Committee, where it passed on a 9-0-2 vote.

SUMMARY: Requires a social media platform to publicly post on its internet website a general description of its policy regarding the retention of electronic communication information, including how long the platform retains that information. Specifically, this bill:

1. Requires a social media platform that operates in California, if owned by a business that generated annual revenue in excess of $100 million in the previous year, to include in a policy statement that it publicly posts on its internet website the following:
   1. A general description of the social media platform’s policy regarding the retention of electronic communication information, as that term is defined under the California Electronic Communications Privacy Act (CalECPA).
   2. How long the platform retains that information.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
2. Establishes CalECPA, which generally prohibits a government entity from compelling the production of, or access to, electronic communication information without a warrant, wiretap order, an order for electronic reader records, a subpoena, or an order for a pen register or trap and trace device. CalECPA also provides the target whose information is sought the ability to void or modify the warrant or order. (Pen. Code §§ 1546-1546.5.)
3. Defines “electronic communication information” under CalECPA as any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an Internet Protocol (IP) address. (Pen. Code § 1546.)
4. Requires social media platforms, if owned by a business that generated $100 million or more in the preceding year, to create, and publicly post on the platform’s internet website, a policy statement that includes all of the following:
   1. The social media platform’s policy on the use of the platform to illegally distribute a controlled substance.
   2. A general description of the platform’s moderation practices employed to prevent users from posting or sharing electronic content pertaining to the illegal distribution of a controlled substance. However, this description must not include information that might compromise operational efforts to identify prohibited content or user activity, or otherwise endanger user safety.
   3. A link to mental health and drug education resources provided by governmental public health authorities.
   4. A link to the social media platform’s reporting mechanism for illegal or harmful content or behavior, if one exists.
   5. A general description of the platform’s policies and procedures for responding to law enforcement inquiries, including warrants, subpoenas, and other court orders compelling the production of or access to electronic communication information, as that term is defined under CalECPA. (Bus. and Prof. Code § 22945(b).)
5. Allows the policy statement required by 4) to be posted separately or incorporated within another document or post, including the platform’s terms of service or community guidelines. (Bus. and Prof. Code § 22945(c).)
6. Requires a person or entity operating a social media platform to update as necessary the policy statement required by 4). Encourages platforms to consult with specified stakeholders to assist in developing and supporting the policy statement. (Bus. and Prof. Code § 22945(d).)
7. Defines “social media platform” as a public or semipublic internet-based service or application that has users in California and that meets both of the following criteria:
   1. A substantial function of the service or application is to connect users in order to allow them to interact socially with each other within the service or application. (A service or application that provides email or direct messaging services does not meet this criterion based solely on that function.)
   2. The service or application allows users to do all of the following:
      1. Construct a public or semipublic profile for purposes of signing into and using the service or application.
      2. Populate a list of other users with whom an individual shares a social connection within the system.
      3. Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users. (Bus. & Prof. Code § 22945(a)(3).)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS:

1) Background. According the U.S. Centers for Disease Control and Prevention (CDC), fentanyl, a synthetic opioid up to 50 times stronger than heroin, is currently responsible for over 150 deaths a day in the United States due to overdoses. (CDC, Fentanyl Facts (Feb. 23, 2022), available at https://www.cdc.gov/stopoverdose/fentanyl/index.html.)

This epidemic of overdoses is exacerbated by the ability of interested parties to use social media platforms to connect with strangers or acquaintances who distribute and sell opioids, making illegal drugs easier and more convenient to purchase. Because the clientele of many social media platforms skews younger, this distribution channel has been especially harmful to teens and young adults. According to a 2021 Washington Post article:

DEA Administrator Anne Milgram specifically called out Snapchat and TikTok, two apps that are popular with teenagers and young adults, for not doing more to combat sales….

For years, illegal drug sales have been a scourge on Facebook, Snapchat, TikTok and other social media apps. Companies have repeatedly said they’re working to rid their sites of drug deals by hiring extra moderators, using artificial-intelligence algorithms to root out illegal material and limiting searches for keywords related to drugs. But prescription and other drugs can still easily be found for sale. […]

The public health crisis is renewing calls from not just law enforcement groups but concerned parents and researchers for the social media companies to do more. They want the companies to be more transparent about what's happening on their platforms….

(Lerman & De Vynck, Snapchat, TikTok, Instagram face pressure to stop illegal drug sales as overdose deaths soar, Washington Post (Sep. 28, 2021), available at https://www.washingtonpost.com/technology/2021/09/28/tiktok-snapchat-fentanyl/.)

Last year’s AB 1628 (Ramos, Chap. 432, Stats. 2022) was enacted in response to such calls for transparency in social media platforms’ practices. The bill required each large social media platform to publicly post on its internet website a policy statement containing information such as (i) the platform’s policy on the use of the platform to illegally distribute a controlled substance; (ii) a description of the platform’s moderation practices employed to prevent users from sharing content regarding illegal distribution of a controlled substance; and (iii) the platform’s policies and procedures for responding to law enforcement inquiries, including warrants, subpoenas, and other court courts compelling production of electronic communications information.

This bill would bolster AB 1628 by further increasing the transparency of large social media platforms’ treatment of electronic communications information. Specifically, the bill, as amended, would require each platform to post a general description of its policies regarding the retention of electronic communication information, including how long the platform retains that information.

2) Author’s statement. According to the author:

Social media platforms currently post a policy statement that includes general information about their terms and usage. […] By adding this additional policy statement requirement, AB 1027 will provide law enforcement agencies with access to information that could be invaluable in their efforts to investigate online illicit drug transactions.

3) Why the bill is being amended. As referred to this Committee, this bill would have required social media platforms to retain the records and contents of a communication between users for at least 168 hours from the time the communication was made. This requirement would have undermined attempts by online drug sellers to delete their messages, or to rely on platform features, such as end-to-end encryption or automatic and rapid deletion of messages, to hide their transactions. In the event a drug overdose or death was tied to a sale made over social media, the bill might have given law enforcement more time to obtain a warrant and acquire the content of communications between the victim and the drug seller.

However, as pointed out by bill opponents, this requirement might have impaired important legislative efforts to protect access to reproductive health care, gender-affirming health care, and information central to LGBTQ identity. For example, ACLU California Action wrote in opposition:

[T]here are several instances where being able to delete information whenever you want carries greater importance. For example, a student may be speaking to a friend about a potential decision to become public about their sexual orientation in messages, and not wish for their parents to see it. This is particularly true right now, as many states across the country pass laws criminalizing certain types of healthcare. A person seeking reproductive or gender-affirming care that’s criminalized in their state may speak to a support group about receiving that care. Law enforcement officials seeking to prosecute people seeking or supporting this kind of health care will have far more time to request access to that information if this bill requires its retention. Those seeking to expose that information—whether to bring lawsuits under bounty-style state laws around reproductive care, or to simply embarrass people by exposing their personal conversations—will also have more time to hack into it.

This bill is being amended to respond to these two important policy goals: enhancing the ability of law enforcement to identify drug sellers who transact on social media, while preserving platforms’ ability to protect the privacy of lawful conversations that, if exposed, could lead to consequences ranging from shaming to persecution to criminal prosecution.

4) Committee amendment—providing transparency as to social media platforms’ record retention policies. Committee amendments would delete the existing provisions of the bill and replace it with the following provision:

Business and Professions Code 22945. (b) A social media platform that operates in the state shall create, and publicly post on the social media platform’s internet website, a policy statement that includes all of the following:

[…]

(6) A general description of the social media platform’s policy on the retention of electronic communication information, as defined in Section 1546 of the Penal Code, including how long the platform retains that information.

The transparency provided by this amendment—particularly specification of how long social media platforms retain electronic communications information—may prove valuable in combatting illegal drug trafficking, as well as other illicit activities, such as sex trafficking and the sharing of child pornography. At present, law enforcement authorities may be unsure of how long they will have to obtain needed records of communications, including valuable metadata (such as the time when a communication took place, the user account(s) involved, and any email addresses, IP addresses, or phone numbers associated with those accounts), from particular platforms. They may therefore waste time seeking records that cannot be obtained (because the data they seek has been deleted), or else wrongly believe it is futile to seek the records (because they incorrectly believe the data will have been deleted). Publication of these time frames may help ensure that law enforcement efforts in this regard are not wasted. That said, it is worth cautioning that publicizing data retention practices may drive drug sellers away from platforms with longer retention periods, thereby, in the long run, further frustrating law enforcement efforts to catch traffickers. But it may also enable those seeking information about reproductive or gender-affirming health care, in jurisdictions where this care is illegal, to choose platforms with shorter retention times in order better protect their privacy–once again revealing how the same platform features that facilitate drug trafficking are also those most important for protecting the vulnerable.

5) Related legislation. AB 587 (Gabriel, Chap. 269, Stats. 2022) required social media companies, as defined, to post their terms of service in a manner reasonably designed to inform all users of specified policies and further required social media companies to submit specified semiannual reports to the Attorney General, starting January 1, 2024.

AB 1628 (Ramos, Chap. 432, Stats. 2022) required social media platforms, as defined, that operate in this state to create and publicly post policy statements including specified information regarding platforms’ use to illegally distribute controlled substances.

SB 1056 (Umberg, Chap. 881, Stats. 2022) required social media platforms, as defined, to clearly and conspicuously state whether they have mechanisms for reporting violent posts, as defined; and allows a person who is the target, or who believes they are the target, of a violent post to seek an injunction to have the violent post removed.

REGISTERED SUPPORT / OPPOSITION: (Note that these positions were taken in response to the bill in print, not as it is proposed to be amended.)

Support

Alexander Neville Foundation

League of California Cities

Oppose unless Amended

California Chamber of Commerce

Chamber of Progress

Computer & Communications Industry Association

Internet Coalition

Netchoice

Technet

Opposition

ACLU California Action

Electronic Frontier Foundation

Analysis Prepared by: Jith Meganathan / P. & C.P. / (916) 319-2200

Date of Hearing: April 11, 2023

ASSEMBLY COMMITTEE ON JUDICIARY

Brian Maienschein, Chair

ABPCA Bill Id:AB 1027

Author:(Petrie-Norris) – As Amended Ver:April 6, 2023

SUBJECT: Controlled substances

KEY ISSUE: IN ORDER TO FACILITATE INVESTIGATION AND PROSECUTION OF ILLEGAL ONLINE ACTIVITY, INCLUDING THE ONLINE SALE OF FENTANYL, SHOULD SOCIAL MEDIA PLATFORMS BE REQUIRED to maintain records of communications between users of the platform for at least 168 hours?

SYNOPSIS

This bill aims to address the immense growth in the online sale of fentanyl, particularly targeted at minors through social media by assisting law enforcement in addressing the rampant expansion of the sale of fentanyl via social media by requiring social media platforms to maintain a record of communications between its users for at least 168 hours, or approximately seven days. Failure to maintain these records would give rise to a civil claim against the platform by specified public prosecutors, including the Attorney General. A prosecutor would be authorized to recover a civil penalty of up to $250,000 and reasonable attorney’s fees and costs, as well as request injunctive relief. Advocates for social media platforms raise the concern that the requirements imposed by this bill would have the collateral effect of eliminating any expectation of privacy a user may have. While the concern is certainly noteworthy, the topic is not within this committee’s jurisdiction. However, the concern that some of the language in a previous version of this bill is federally preempted is within this Committee’s jurisdiction, and are therefore addressed in the COMMENTS section of the analysis.

The author has indicated that this bill is sponsored by The Neville Project, however The Neville Project reflects a support position rather than as a sponsor. The bill is opposed by TechNet, the California Chamber of Commerce, the Chamber of Progress, the Internet Coalition, the Computer and Communications Industry Association, and NetChoice. Should this bill be approved by this Committee, it would be referred to the Assembly Committee on Privacy and Consumer Protection, which has jurisdiction over the privacy issues raised by opponents to the bill.

SUMMARY: Requires social media platforms to maintain records of communications between users of the platform for at least 168 hours. Specifically, this bill:

1. Requires a social media platform to maintain a record of, and the content of, a communication between users of the social media platform for at least 168 hours from the time the communication was made. Exempts information that is the subject of a consumer request to delete the information.
2. Makes a social media platform that has violated 1) liable in a civil action brought by the Attorney General and other specified public prosecutors, and authorizes recovery of a civil penalty of up to $250,000 as well as the following remedies:
   1. Injunctive relief;
   2. Reasonable attorneys’ fees and costs.
3. Defines social media platform to have the same meaning as existing law.

EXISTING LAW:

1. Provides that, among other rights, all people have an inalienable right to pursue and obtain privacy. (California Constitution, Article I, Section 1.)
2. Declares that the right to privacy is a personal and fundamental right protected by the California Constitution and that all individuals have a right of privacy in information pertaining to them. (Civil Code Section 1798.1, the Information Practices Act of 1977.)
3. Requires, pursuant to the California Consumer Protection Act of 2018 (CCPA), businesses, as defined, to include specified information in their privacy policies, such as a description of consumer rights, the categories of personal information the business collects about consumers, and a list of the categories it has sold about consumers in the preceding 12 months. (Civil Code Section 1798.130.)
4. Requires an operator of a commercial website or online service that collects personally identifiable information about consumers to conspicuously post its privacy policy on its website and included specified disclosures. (Business and Professions Code Section 22575.)
5. Defines “social media platform” as a public or semipublic internet-based service or application that has users in California and meets specified criteria. (Business and Professions Code Section 22945.)
6. Provides that, except as otherwise provided, every person who possesses for sale or purchase for purposes of sale any specified controlled substance, as defined, shall be punished by imprisonment in a county jail for two, three, or four years pursuant to existing law pertaining to felony sentencing. (Health and Safety Code Section 11351.)
7. Provides that, except as otherwise provided, every person who transports, imports into this state, sells, furnishes, administers, or gives away, or offers to transport, import into this state, sell, furnish, administer, or give away, or attempts to import into this state or transport, any specified controlled substance shall be punished by imprisonment in a county jail for two, three, or four years pursuant to existing law pertaining to felony sentencing. (Health and Safety Code Section 11352.)
8. Defines “controlled substance,” unless otherwise specified, to mean a drug, substance, or immediate precursor which is listed in any schedule pursuant to the Uniform Controlled Substances Act, as specified. (Health and Safety Code Section 11007; Sections 11054-11058.)
9. Prohibits a government entity from compelling the production of or access to electronic communication information, as defined, from a service provider, as defined, except as specified. (Penal Code Section 1546.1.)
10. Defines “electronic communication,” for purposes of 9), above, to mean the transfer of signs, signals, writings, images, sounds, data, or intelligence of any nature in whole or in part by a wire, radio, electromagnetic, photoelectric, or photo-optical system. (Penal Code Section 1546 (c).)
11. Defines “electronic communication information,” for purposes of 9), above, to mean any information about an electronic communication or the use of an electronic communication service, including, but not limited to, the contents, sender, recipients, format, or location of the sender or recipients at any point during the communication, the time or date the communication was created, sent, or received, or any information pertaining to any individual or device participating in the communication, including, but not limited to, an IP address. (Penal Code Section 154 6 (d).)
12. Defines “electronic communication service,” for purposes of 9), above, to mean a service that provides to its subscribers or users the ability to send or receive electronic communications, including any service that acts as an intermediary in the transmission of electronic communications, or stores electronic communication information. (Penal Code Section 1546 (e).)
13. Defines “service provider,” for the purposes of 9), above, to mean a person or entity offering an electronic communication service.
14. Pursuant to the federal Communications Decency Act of 1996, provides, that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” and affords broad protection from civil liability for the good faith content moderation decisions of interactive computer services. (47 U.S.C. Section 230(c)(1) and (2).)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: This bill aims to address the immense growth in the online sale of fentanyl, particularly sales targeted at minors through social media. In May 2022, The New York Times reported on the development of this dangerous and disturbing trend. The article describes how overdoses are the leading cause of preventable death among those between 18 and 45 years of age, and the role that social media in particular has played. Specifically, the Times writes:

[M]uch as drug dealers in the 1980s and ‘90s seized on pagers and burner phones to conduct business covertly, today’s suppliers have embraced modern iterations – social media and messaging apps with privacy features such as encrypted or disappearing messages. Dealers and young buyers usually spot each other on social media and then often proceed by directly messaging each other.” (Fentanyl Tainted Pills Bought on Social Media Cause Youth Drug Deaths to Soar, Jan Hoffman (May 19, 2022) New York Times available at https://www.nytimes.com/2022/05/19/health/pills-fentanyl-social-media.html.)

The requirements proposed by this bill are intended to assist law enforcement in addressing this trend by requiring that social media platforms retain potential evidence of criminal online sales activity in the event that it is needed for a criminal investigation or prosecution. According to the author:

Two disturbing trends have dramatically escalated the dangers of fentanyl: the deceptive use of fentanyl in counterfeit pills and the use of social media to traffic these drugs to young people. Drug dealers have capitalized on the anonymity of social media sites to target their sales to pre-teens, teens and unhoused youth. These sites have chat settings designed to erase chat history after just a few hours, making it incredibly difficult for law enforcement to track and prosecute online fentanyl traffickers. By requiring social media platforms to enact more stringent data collection and storage requirement, AB 1027 offers important assistance to law enforcement agencies as they continue to fight this deadly epidemic.

This bill aims to assist law enforcement in addressing the rampant expansion of the sale of fentanyl via social media by requiring social media platforms to maintain a record of communications between its users for at least 168 hours, which is the equivalent of seven days. Failure to maintain these records would authorize specified public prosecutors, including the Attorney General, to bring a civil claim against the platform. A prosecutor would be authorized to recover a civil penalty of up to $250,000 and reasonable attorney’s fees and costs, as well as request injunctive relief.

With regard to the authors intent for this bill – namely to curb the sale of fentanyl on social media platforms – it is reasonable to conclude that requiring platforms to retain records of all communications between their users may help achieve this goal. In the unfortunate event of an overdose or other harm resulting from the use of fentanyl, it is possible that law enforcement would look to social media platforms to discover whether that particular incident occurred as a result of a sale that took place on a social media platform and follow the procedures necessary to obtain evidence of a crime, including by issuing a subpoena in an appropriate case. Further, retaining records of all communications would necessarily capture all instances of a sale of the narcotic on the platform. This would arguably facilitate law enforcement’s ability to identify users who habitually engage in the sale of fentanyl on the platform, and prevent them from continuing to do so.

The opposition raises concerns regarding the impact of this bill on the privacy of social media users. Advocates for social media platforms raise the concern that the requirements imposed by this bill would have the collateral effect of eliminating any expectation of privacy a user may have. While the concern is certainly noteworthy, and it is plausible that requiring platforms to retain all records of communications between users of the platform arguably would violate the expectations of privacy of some users of platforms who believe that no records of sensitive conversations and relationships are retained, that topic is not within this Committee’s jurisdiction. Rather, the questions of whether such expectations of privacy (and the non-detection of criminal activity carried out on the platform) are reasonable and the extent to which social media platforms can or should be required to retain records of user communications, lie squarely within the jurisdiction of the Assembly Committee on Privacy and Consumer Protection. Therefore, the remainder of this analysis will focus on issues that are within this Committee’s jurisdiction and will not address whether the bill should be amended to address this concern.

The opposition also raises concerns that a previous version of this bill was preempted by federal law. As raised by the opposition, “Section 230 of the Communications Decency Act (47 U.S.C. §230) generally protects platforms from liability for content that users generate with limited exceptions. This protection enables platforms to host third party content and to moderate third-party content on their platforms without fear of liability.” As opposed to the concerns regarding the risking users’ privacy, questions of liability and whether this bill is federally preempted, are decidedly within the purview of this Committee.

Section 230 of the federal Communications Decency Act of 1996 provides that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” and affords broad protection from civil liability for the good faith content moderation decisions of interactive computer services. (47 U.S.C. Sec. 230(c)(1) and (2).) Though Section 230 was originally passed in response to judicial inconsistency with respect to the liability of internet service providers under statutes pertaining to “publishers” of content created by others, it has since been interpreted to confer operators of social media platforms and other online services with broad immunity from liability for content posted on their platforms by others.

Section 230 also indicates that “[n]othing in this section shall be construed to prevent any State from enforcing any State law that is consistent with this section,” but further provides that “[n]o cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with this section.” (47 U.S.C. Sec. 230(e)(3).) The latter provision has generally been interpreted to expressly preempt any state law that has the effect of treating a social media or other online platform as the publisher of information posted by other users, including prescriptive requirements relating to content moderation. This is consistent with the law’s original intent, which was to ensure that internet platforms facilitating the sharing of content can do so without considerable risk of liability in the event that content is not meticulously policed.

Briefly, the concerns raised by the opposition are compelling. It is likely that the language of the bill in its original form, establishing social media’s liability arising from the sale of fentanyl occurring on the platform that results in the death or overdose of a child, does, would have violated Section 230 of the Communications Decency Act and therefore been federally preempted. In essence, the bill’s original language would have imposed liability on a platform for the words or actions of users, directly conflicting with the immunity provision of Section 230.

However, recent amendments to the bill have removed this provision in its entirety. Instead, recent amendments to the bill now allow a public prosecutor to recover a civil penalty of up to $250,000 and reasonable attorney’s fees and costs, as well as injunctive relief, if a platform failed to comply with the record retention requirements of the bill. This modification removes the platform’s liability for the content posted on the platform by a third party. Therefore, the Section 230 and preemption concerns of opponents appear to have been addressed.

ARGUMENTS IN SUPPORT: This bill is supported by The Alexander Neville Foundation. In support of their position they write:

ANF was founded when Alexander Neville, a 14 year old boy, purchased what was marketed and advertised as an oxycodone on Snapchat. It turned out to be a counterfeit made with a fatal dose of fentanyl. His family and friends have taken up the cause to educate Americans about the new drug landscape and especially about how Snapchat and other social media platforms play a large role in the drug crisis as it pertains to our youth.

Had Snapchat not allowed rampant drug dealing so that a kid could order hard drugs easier than pizza, my son would be alive.

Two disturbing trends have dramatically escalated the dangers of fentanyl: the deceptive use of fentanyl in counterfeit pills and the use of social media to traffic illicit substances to young people.

[…]

Illegal drug sellers have capitalized on the easy communication and anonymity of social media sites to target pre-teens, teens and unhoused youth. For instance, some social media platforms have chat settings designed to erase chat history after just a few hours. This makes it incredibly difficult for law enforcement to track and prosecute online fentanyl traffickers.

The prevalence of these pills is evident by law enforcement seizures. In 2021, the Orange County Sheriff’s Department seized 104 pounds of suspected fentanyl and 16,278 pills suspected of containing fentanyl. In just the first 2 months of 2022 they have seized 205 pounds of suspected fentanyl and 143,127 pills suspected to contain fentanyl.

AB 1027 would require social media companies to keep a record of communications between platform users for a minimum of seven days. For social media companies that do not comply, this bill makes them liable for a civil penalty up to $250,000. This will offer important assistance to law enforcement to combat this epidemic

ARGUMENTS IN OPPOSITION: This bill is opposed by a coalition of business and internet association advocates. In support of their position they write:

AB 1027’s content retention requirements raise serious privacy concerns. AB 1027 requires a social media platform to not only maintain a record of all communications, including private messages, between users, but the content of those messages. Private and direct messages are intended to be private, which is why our platforms don’t monitor or moderate content in them. This bill would require us to be able to access and turn over the content of these private messages if called upon by law enforcement. Even in service of the worthy goal of reducing drug trafficking, this raises serious privacy concerns for our platforms’ users. Additionally, this is impossible for platforms that provide encrypted messaging, which prevents anyone other than the intended recipient, including our platforms, from accessing the content of the message.

Pending related legislation. AB 33 (Bains, 2023) would establish the Fentanyl Addiction and Overdose Prevention Task Force to undertake various duties relating to fentanyl abuse, including, among others, collecting and organizing data on the nature and extent of fentanyl abuse in California and evaluating approaches to increase public awareness of fentanyl abuse. This bill is currently awaiting a hearing in Assembly Committee on Public Safety.

SB 19 (Seyarto, 2023) would, upon appropriation by the Legislature, establish the Anti-Fentanyl Abuse Task Force to undertake various duties relating to fentanyl abuse including, among others, collecting and organizing data on the nature and extent of fentanyl abuse in California and evaluating approaches to increase public awareness of fentanyl abuse. This bill is currently in Senate Appropriations.

AB 461 (Ramos, 2023) would require the governing board of each community college district and the Trustees of the California State University to provide information about the use and location of fentanyl test strips as part of established campus orientations and to notify students of the presence and location of fentanyl test strips. The bill would require the governing board of each community college district and the Trustees of the California State University to require that each campus health center stock and distribute fentanyl test strips, as specified. This bill is currently in Assembly Appropriations.

AB 955 (Petrie-Norris, 2023) would make the sale of fentanyl on a social media platform, as defined, in California punishable by imprisonment in a county jail for a period of 3, 6, or 9 years. This bill is currently awaiting a hearing in Assembly Committee on Public Safety.

REGISTERED SUPPORT / OPPOSITION:

Support

The Alexander Neville Foundation

Opposition

California Chamber of Commerce

Chamber of Progress

Computer and Communications Industry Association

Internet Coalition

NetChoice

TechNet

Analysis Prepared by: Manuela Boucher-de la Cadena / JUD. / (916) 319-2334