SB 1223: Consumer privacy: sensitive personal information: neural data.
- Session Year: 2023-2024
- House: Senate
- Latest Version Date: 2024-09-28
Current Status:
Passed
(2024-09-28: Chaptered by Secretary of State. Chapter 887, Statutes of 2024.)
Introduced
In Committee
First Chamber
In Committee
Second Chamber
Enacted
What does this bill do?
This bill adds “neural data” to the list of sensitive personal information under California’s consumer privacy law, affecting businesses that collect or use such data about California residents. It defines neural data as information produced by measuring activity of a person’s central or peripheral nervous system that is not inferred from other nonneural information.
The summary is provided by generative AI which can make mistakes. For original language, please view the details in the table below.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by AB 1008 to be operative only if this bill and AB 1008 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by AB 1008 to be operative only if this bill and AB 1008 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
This bill would incorporate additional changes to Section 1798.140 of the Civil Code proposed by AB 1008 to be operative only if this bill and AB 1008 are enacted and this bill is enacted last.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information, and would make conforming changes. information.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by the measurement of measuring the activity of an individuals a consumers central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology, as defined, system, and that is not inferred from nonneural information, and would make conforming changes.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use of the consumers sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform certain other services, and as authorized by certain regulations. The CCPA defines sensitive personal information to mean, among other things, the processing of biometric information, as defined, for the purpose of uniquely identifying a consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would define sensitive personal information, for purposes of the CCPA, to additionally include a consumers neural data, and would define neural data to mean information that is generated by the measurement of the activity of an individuals central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology, as defined, and would make conforming changes.
The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.
This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing civil law establishes rules governing the interpretation of contracts, as prescribed, and provides that other obligations are interpreted by the same rules by which statutes of a similar nature are interpreted.This bill would make nonsubstantive changes to that provision.Existing civil law establishes rules governing the interpretation of contracts, as prescribed, and provides that other obligations are interpreted by the same rules by which statutes of a similar nature are interpreted.
This bill would make nonsubstantive changes to that provision.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Section 5 of Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and Assembly Bill 1008. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after Assembly Bill 1008, in which case Section 1 of this bill shall not become operative.
SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Section 5 of Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and Assembly Bill 1008. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after Assembly Bill 1008, in which case Section 1 of this bill shall not become operative.
SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 1.5.Section 1798.140 of the Civil Code, as amended by Section 5 of Chapter 121 of the Statutes of 2024, is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.(2)(A)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern.
(B)(i)For purposes of this paragraph, publicly available means any of the following:
(I)Information that is lawfully made available from federal, state, or local government records.
(II)Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media.
(III)Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
(ii)Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(4)Personal information can exist in various formats, including, but not limited to, all of the following:
(A)Physical formats, including paper documents, printed images, vinyl records, or video tapes.
(B)Digital formats, including text, image, audio, or video files.
(C)Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.Section 1.5 of this bill incorporates amendments to Section 1798.140 of the Civil Code proposed by both this bill and Assembly Bill 1008. That section of this bill shall become operative only if (1) both bills are enacted and become effective on or before January 1, 2025, (2) each bill amends Section 1798.140 of the Civil Code and (3) this bill is enacted after Assembly Bill 1008, in which case Section 1 of this bill shall not become operative.
SEC. 2.SEC. 3.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly branded internet websites, applications, or services, other than the business, distinctly branded internet website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons internet website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(w)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)(i)A consumers neural data.
(ii)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (6) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 2.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
SECTION 1.Section 1798.99.90 of the Civil Code is amended to read:1798.99.90.(a)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (c).(b)For purposes of this section, the following definitions apply:(1)Business means the same as defined in subdivision (c) of Section 1798.140.(2)Collect means the same as defined in subdivision (f) of Section 1798.140.(3)Family planning center means a business categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300 of the Civil Code.(4)Personal information has the same definition as that term is defined in subdivision (w) of Section 1798.140, except as applied to all persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.(5)Precise geolocation means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person.(6)Sell means the same as defined in Section 1798.140.(7)Share means the same as defined in Section 1798.140.(c)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information.(d)(1)An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person or business who violates this section for injunctive and monetary relief and attorneys fees within three years of discovery of the violation.(2)If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorneys fees incurred in connection with the litigation.(e)This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05.SEC. 2.Section 1798.130 of the Civil Code is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a business obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.(B)For purposes of subdivision (b) of Section 1798.110:(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.(4)For purposes of subdivision (b) of Section 1798.115:(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).(5)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).(B)For purposes of subdivision (c) of Section 1798.110:(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.(ii)The categories of sources from which consumers personal information is collected.(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.(iv)The categories of third parties to whom the business discloses consumers personal information.(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.(6)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.(7)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.(b)A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (w) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (af) of Section 1798.140.SEC. 3.Section 1798.140 of the Civil Code is amended to read:1798.140.DefinitionsFor purposes of this title:(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.(d)Business means:(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (11) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.(3)Debugging to identify and repair errors that impair existing intended functionality.(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.(7)Undertaking internal research for technological development and demonstration.(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:(A)Prohibits the contractor from:(i)Selling or sharing the personal information.(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.(o)Device means any physical object that is capable of connecting to the Internet, directly or indirectly, or to another device.(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.(t)Neural data means information that is generated by measuring the activity of a consumers central or peripheral nervous system, and that is not inferred from nonneural information. (u)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.(v)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.(w)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.(B)Any personal information described in subdivision (e) of Section 1798.80.(C)Characteristics of protected classifications under California or federal law.(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.(E)Biometric information.(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.(G)Geolocation data.(H)Audio, electronic, visual, thermal, olfactory, or similar information.(I)Professional or employment-related information.(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.(L)Sensitive personal information.(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.(x)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.(y)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.(z)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.(aa)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.(ab)Pseudonymize or pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.(ac)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:(1)Compatible with the business purpose for which the personal information was collected.(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.(5)Made subject to business processes to prevent inadvertent release of deidentified information.(6)Protected from any reidentification attempts.(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.(ad)Security and integrity means the ability of:(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.(3)Businesses to ensure the physical safety of natural persons.(ae)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.(2)For purposes of this title, a business does not sell personal information when:(A)A consumer uses or directs the business to intentionally:(i)Disclose personal information.(ii)Interact with one or more third parties.(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).(af)Sensitive personal information means:(1)Personal information that reveals:(A)A consumers social security, drivers license, state identification card, or passport number.(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.(C)A consumers precise geolocation.(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.(F)A consumers genetic data.(G)A consumers neural data.(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.(B)Personal information collected and analyzed concerning a consumers health.(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (w) shall not be considered sensitive personal information or personal information.(ag)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.(ah)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:(A)Selling or sharing the personal information.(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).(ai)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.(2)For purposes of this title, a business does not share personal information when:(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).(aj)Third party means a person who is not any of the following:(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.(2)A service provider to the business.(3)A contractor.(ak)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.(al)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.SEC. 4.Section 1798.185 of the Civil Code is amended to read:1798.185.Regulations(a)On or before July 1, 2020, the Attorney General shall solicit broad public participation and adopt regulations to further the purposes of this title, including, but not limited to, the following areas:(1)Updating or adding categories of personal information to those enumerated in subdivision (c) of Section 1798.130 and subdivision (w) of Section 1798.140, and updating or adding categories of sensitive personal information to those enumerated in subdivision (af) of Section 1798.140 in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.(2)Updating as needed the definitions of deidentified and unique identifier to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and adding, modifying, or deleting categories to the definition of designated methods for submitting requests to facilitate a consumers ability to obtain information from a business pursuant to Section 1798.130. The authority to update the definition of deidentified shall not apply to deidentification standards set forth in Section 164.514 of Title 45 of the Code of Federal Regulations, where such information previously was protected health information as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.(3)Establishing any exceptions necessary to comply with state or federal law, including, but not limited to, those relating to trade secrets and intellectual property rights, within one year of passage of this title and as needed thereafter, with the intention that trade secrets should not be disclosed in response to a verifiable consumer request.(4)Establishing rules and procedures for the following:(A)To facilitate and govern the submission of a request by a consumer to opt out of the sale or sharing of personal information pursuant to Section 1798.120 and to limit the use of a consumers sensitive personal information pursuant to Section 1798.121 to ensure that consumers have the ability to exercise their choices without undue burden and to prevent businesses from engaging in deceptive or harassing conduct, including in retaliation against consumers for exercising their rights, while allowing businesses to inform consumers of the consequences of their decision to opt out of the sale or sharing of their personal information or to limit the use of their sensitive personal information.(B)To govern business compliance with a consumers opt-out request.(C)For the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt out of the sale of personal information.(5)Adjusting the monetary thresholds, in January of every odd-numbered year to reflect any increase in the Consumer Price Index, in: subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140; subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150; subdivision (a) of Section 1798.155; Section 1798.199.25; and subdivision (a) of Section 1798.199.90.(6)Establishing rules, procedures, and any exceptions necessary to ensure that the notices and information that businesses are required to provide pursuant to this title are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer, including establishing rules and guidelines regarding financial incentives within one year of passage of this title and as needed thereafter.(7)Establishing rules and procedures to further the purposes of Sections 1798.105, 1798.106, 1798.110, and 1798.115 and to facilitate a consumers or the consumers authorized agents ability to delete personal information, correct inaccurate personal information pursuant to Section 1798.106, or obtain information pursuant to Section 1798.130, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a business determination that a request for information received from a consumer is a verifiable consumer request, including treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a consumer who does not maintain an account with the business to request information through the business authentication of the consumers identity, within one year of passage of this title and as needed thereafter.(8)Establishing how often, and under what circumstances, a consumer may request a correction pursuant to Section 1798.106, including standards governing the following:(A)How a business responds to a request for correction, including exceptions for requests to which a response is impossible or would involve disproportionate effort, and requests for correction of accurate information.(B)How concerns regarding the accuracy of the information may be resolved.(C)The steps a business may take to prevent fraud.(D)If a business rejects a request to correct personal information collected and analyzed concerning a consumers health, the right of a consumer to provide a written addendum to the business with respect to any item or statement regarding any such personal information that the consumer believes to be incomplete or incorrect. The addendum shall be limited to 250 words per alleged incomplete or incorrect item and shall clearly indicate in writing that the consumer requests the addendum to be made a part of the consumers record.(9)Establishing the standard to govern a business determination, pursuant to subparagraph (B) of paragraph (2) of subdivision (a) of Section 1798.130, that providing information beyond the 12-month period in a response to a verifiable consumer request is impossible or would involve a disproportionate effort.(10)Issuing regulations further defining and adding to the business purposes, including other notified purposes, for which businesses, service providers, and contractors may use consumers personal information consistent with consumers expectations, and further defining the business purposes for which service providers and contractors may combine consumers personal information obtained from different sources, except as provided for in paragraph (6) of subdivision (e) of Section 1798.140.(11)Issuing regulations identifying those business purposes, including other notified purposes, for which service providers and contractors may use consumers personal information received pursuant to a written contract with a business, for the service provider or contractors own business purposes, with the goal of maximizing consumer privacy.(12)Issuing regulations to further define intentionally interacts, with the goal of maximizing consumer privacy.(13)Issuing regulations to further define precise geolocation, including if the size defined is not sufficient to protect consumer privacy in sparsely populated areas or when the personal information is used for normal operational purposes, including billing.(14)Issuing regulations to define the term specific pieces of information obtained from the consumer with the goal of maximizing a consumers right to access relevant personal information while minimizing the delivery of information to a consumer that would not be useful to the consumer, including system log information and other technical data. For delivery of the most sensitive personal information, the regulations may require a higher standard of authentication provided that the agency shall monitor the impact of the higher standard on the right of consumers to obtain their personal information to ensure that the requirements of verification do not result in the unreasonable denial of verifiable consumer requests.(15)Issuing regulations requiring businesses whose processing of consumers personal information presents significant risk to consumers privacy or security, to:(A)Perform a cybersecurity audit on an annual basis, including defining the scope of the audit and establishing a process to ensure that audits are thorough and independent. The factors to be considered in determining when processing may result in significant risk to the security of personal information shall include the size and complexity of the business and the nature and scope of processing activities.(B)Submit to the California Privacy Protection Agency on a regular basis a risk assessment with respect to their processing of personal information, including whether the processing involves sensitive personal information, and identifying and weighing the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, with the goal of restricting or prohibiting the processing if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public. Nothing in this section shall require a business to divulge trade secrets.(16)Issuing regulations governing access and opt-out rights with respect to businesses use of automated decisionmaking technology, including profiling and requiring businesses response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer.(17)Issuing regulations to further define a law enforcement agency-approved investigation for purposes of the exception in subparagraph (B) of paragraph (1) of subdivision (a) of Section 1798.145.(18)Issuing regulations to define the scope and process for the exercise of the agencys audit authority, to establish criteria for selection of persons to audit, and to protect consumers personal information from disclosure to an auditor in the absence of a court order, warrant, or subpoena.(19)(A)Issuing regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumers intent to opt out of the sale or sharing of the consumers personal information and to limit the use or disclosure of the consumers sensitive personal information. The requirements and specifications for the opt-out preference signal should be updated from time to time to reflect the means by which consumers interact with businesses, and should:(i)Ensure that the manufacturer of a platform or browser or device that sends the opt-out preference signal cannot unfairly disadvantage another business.(ii)Ensure that the opt-out preference signal is consumer-friendly, clearly described, and easy to use by an average consumer and does not require that the consumer provide additional information beyond what is necessary.(iii)Clearly represent a consumers intent and be free of defaults constraining or presupposing that intent.(iv)Ensure that the opt-out preference signal does not conflict with other commonly used privacy settings or tools that consumers may employ.(v)Provide a mechanism for the consumer to selectively consent to a business sale of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, without affecting the consumers preferences with respect to other businesses or disabling the opt-out preference signal globally.(vi)State that in the case of a page or setting view that the consumer accesses to set the opt-out preference signal, the consumer should see up to three choices, including:(I)Global opt out from sale and sharing of personal information, including a direction to limit the use of sensitive personal information.(II)Choice to Limit the Use of My Sensitive Personal Information.(III)Choice titled Do Not Sell/Do Not Share My Personal Information for Cross-Context Behavioral Advertising.(B)Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age.(C)Issuing regulations, with the goal of strengthening consumer privacy while considering the legitimate operational interests of businesses, to govern the use or disclosure of a consumers sensitive personal information, notwithstanding the consumers direction to limit the use or disclosure of the consumers sensitive personal information, including:(i)Determining any additional purposes for which a business may use or disclose a consumers sensitive personal information.(ii)Determining the scope of activities permitted under paragraph (8) of subdivision (e) of Section 1798.140, as authorized by subdivision (a) of Section 1798.121, to ensure that the activities do not involve health-related research.(iii)Ensuring the functionality of the business operations.(iv)Ensuring that the exemption in subdivision (d) of Section 1798.121 for sensitive personal information applies to information that is collected or processed incidentally, or without the purpose of inferring characteristics about a consumer, while ensuring that businesses do not use the exemption for the purpose of evading consumers rights to limit the use and disclosure of their sensitive personal information under Section 1798.121.(20)Issuing regulations to govern how a business that has elected to comply with subdivision (b) of Section 1798.135 responds to the opt-out preference signal and provides consumers with the opportunity subsequently to consent to the sale or sharing of their personal information or the use and disclosure of their sensitive personal information for purposes in addition to those authorized by subdivision (a) of Section 1798.121. The regulations should:(A)Strive to promote competition and consumer choice and be technology neutral.(B)Ensure that the business does not respond to an opt-out preference signal by:(i)Intentionally degrading the functionality of the consumer experience.(ii)Charging the consumer a fee in response to the consumers opt-out preferences.(iii)Making any products or services not function properly or fully for the consumer, as compared to consumers who do not use the opt-out preference signal.(iv)Attempting to coerce the consumer to opt in to the sale or sharing of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, by stating or implying that the use of the opt-out preference signal will adversely affect the consumer as compared to consumers who do not use the opt-out preference signal, including stating or implying that the consumer will not be able to use the business products or services or that those products or services may not function properly or fully.(v)Displaying any notification or pop-up in response to the consumers opt-out preference signal.(C)Ensure that any link to a web page or its supporting content that allows the consumer to consent to opt in:(i)Is not part of a pop-up notice, banner, or other intrusive design that obscures any part of the web page the consumer intended to visit from full view or that interferes with or impedes in any way the consumers experience visiting or browsing the web page or website the consumer intended to visit.(ii)Does not require or imply that the consumer must click the link to receive full functionality of any products or services, including the website.(iii)Does not make use of any dark patterns.(iv)Applies only to the business with which the consumer intends to interact.(D)Strive to curb coercive or deceptive practices in response to an opt-out preference signal but should not unduly restrict businesses that are trying in good faith to comply with Section 1798.135.(21)Review existing Insurance Code provisions and regulations relating to consumer privacy, except those relating to insurance rates or pricing, to determine whether any provisions of the Insurance Code provide greater protection to consumers than the provisions of this title. Upon completing its review, the agency shall adopt a regulation that applies only the more protective provisions of this title to insurance companies. For the purpose of clarity, the Insurance Commissioner shall have jurisdiction over insurance rates and pricing.(22)Harmonizing the regulations governing opt-out mechanisms, notices to consumers, and other operational mechanisms in this title to promote clarity and the functionality of this title for consumers.(b)The Attorney General may adopt additional regulations as necessary to further the purposes of this title.(c)The Attorney General shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.(d)Notwithstanding subdivision (a), the timeline for adopting final regulations required by the act adding this subdivision shall be July 1, 2022. Beginning the later of July 1, 2021, or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking under this title, the authority assigned to the Attorney General to adopt regulations under this section shall be exercised by the California Privacy Protection Agency. Notwithstanding any other law, civil and administrative enforcement of the provisions of law added or amended by this act shall not commence until July 1, 2023, and shall only apply to violations occurring on or after that date. Enforcement of provisions of law contained in the California Consumer Privacy Act of 2018 amended by this act shall remain in effect and shall be enforceable until the same provisions of this act become enforceable.SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.(a)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (c).
(b)For purposes of this section, the following definitions apply:
(1)Business means the same as defined in subdivision (c) of Section 1798.140.
(2)Collect means the same as defined in subdivision (f) of Section 1798.140.
(3)Family planning center means a business categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300 of the Civil Code.
(4)Personal information has the same definition as that term is defined in subdivision (x) (w) of Section 1798.140, except as applied to all persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.
(5)Precise geolocation means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person.
(6)Sell means the same as defined in Section 1798.140.
(7)Share means the same as defined in Section 1798.140.
(c)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information.
(d)(1)An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person or business who violates this section for injunctive and monetary relief and attorneys fees within three years of discovery of the violation.
(2)If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorneys fees incurred in connection with the litigation.
(e)This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05.
SEC. 2.Section 1798.130 of the Civil Code is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss business duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss business obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(5)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(6)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(7)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (x) (w) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ag) (af) of Section 1798.140.
SEC. 3.Section 1798.140 of the Civil Code is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (11) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the Internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Neural data means information that is generated by the measurement of measuring the activity of an individuals a consumers central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology. system, and that is not inferred from nonneural information.
(u)Neurotechnology means a device, instrument, or a set of devices or instruments, that allows a connection with a persons central or peripheral nervous system for various purposes, including, but not limited to, reading, recording, or modifying a persons brain activity or the information obtained from a persons brain activity. (v)(u)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(w)(v)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(x)(w)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(y)(x)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(z)(y)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(aa)(z)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(ab)(aa)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(ac)(ab)Pseudonymize or Pseudonymization pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ad)(ac)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ae)(ad)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(af)(ae)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ag)(af)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)A consumers neural data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) (w) shall not be considered sensitive personal information or personal information.
(ah)(ag)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ai)(ah)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(aj)(ai)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ak)(aj)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(al)(ak)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(am)(al)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 4.Section 1798.185 of the Civil Code is amended to read:1798.185.Regulations
(a)On or before July 1, 2020, the Attorney General shall solicit broad public participation and adopt regulations to further the purposes of this title, including, but not limited to, the following areas:
(1)Updating or adding categories of personal information to those enumerated in subdivision (c) of Section 1798.130 and subdivision (x) (w) of Section 1798.140, and updating or adding categories of sensitive personal information to those enumerated in subdivision (ag) (af) of Section 1798.140 in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.
(2)Updating as needed the definitions of deidentified and unique identifier to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and adding, modifying, or deleting categories to the definition of designated methods for submitting requests to facilitate a consumers ability to obtain information from a business pursuant to Section 1798.130. The authority to update the definition of deidentified shall not apply to deidentification standards set forth in Section 164.514 of Title 45 of the Code of Federal Regulations, where such information previously was protected health information as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.
(3)Establishing any exceptions necessary to comply with state or federal law, including, but not limited to, those relating to trade secrets and intellectual property rights, within one year of passage of this title and as needed thereafter, with the intention that trade secrets should not be disclosed in response to a verifiable consumer request.
(4)Establishing rules and procedures for the following:
(A)To facilitate and govern the submission of a request by a consumer to opt out of the sale or sharing of personal information pursuant to Section 1798.120 and to limit the use of a consumers sensitive personal information pursuant to Section 1798.121 to ensure that consumers have the ability to exercise their choices without undue burden and to prevent business businesses from engaging in deceptive or harassing conduct, including in retaliation against consumers for exercising their rights, while allowing businesses to inform consumers of the consequences of their decision to opt out of the sale or sharing of their personal information or to limit the use of their sensitive personal information.
(B)To govern business compliance with a consumers opt-out request.
(C)For the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt out of the sale of personal information.
(5)Adjusting the monetary thresholds, in January of every odd-numbered year to reflect any increase in the Consumer Price Index, in: subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140; subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150; subdivision (a) of Section 1798.155; Section 1798.199.25; and subdivision (a) of Section 1798.199.90.
(6)Establishing rules, procedures, and any exceptions necessary to ensure that the notices and information that businesses are required to provide pursuant to this title are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer, including establishing rules and guidelines regarding financial incentives within one year of passage of this title and as needed thereafter.
(7)Establishing rules and procedures to further the purposes of Sections 1798.105, 1798.106, 1798.110, and 1798.115 and to facilitate a consumers or the consumers authorized agents ability to delete personal information, correct inaccurate personal information pursuant to Section 1798.106, or obtain information pursuant to Section 1798.130, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a businesss business determination that a request for information received from a consumer is a verifiable consumer request, including treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a consumer who does not maintain an account with the business to request information through the businesss business authentication of the consumers identity, within one year of passage of this title and as needed thereafter.
(8)Establishing how often, and under what circumstances, a consumer may request a correction pursuant to Section 1798.106, including standards governing the following:
(A)How a business responds to a request for correction, including exceptions for requests to which a response is impossible or would involve disproportionate effort, and requests for correction of accurate information.
(B)How concerns regarding the accuracy of the information may be resolved.
(C)The steps a business may take to prevent fraud.
(D)If a business rejects a request to correct personal information collected and analyzed concerning a consumers health, the right of a consumer to provide a written addendum to the business with respect to any item or statement regarding any such personal information that the consumer believes to be incomplete or incorrect. The addendum shall be limited to 250 words per alleged incomplete or incorrect item and shall clearly indicate in writing that the consumer requests the addendum to be made a part of the consumers record.
(9)Establishing the standard to govern a businesss business determination, pursuant to subparagraph (B) of paragraph (2) of subdivision (a) of Section 1798.130, that providing information beyond the 12-month period in a response to a verifiable consumer request is impossible or would involve a disproportionate effort.
(10)Issuing regulations further defining and adding to the business purposes, including other notified purposes, for which businesses, service providers, and contractors may use consumers personal information consistent with consumers expectations, and further defining the business purposes for which service providers and contractors may combine consumers personal information obtained from different sources, except as provided for in paragraph (6) of subdivision (e) of Section 1798.140.
(11)Issuing regulations identifying those business purposes, including other notified purposes, for which service providers and contractors may use consumers personal information received pursuant to a written contract with a business, for the service provider or contractors own business purposes, with the goal of maximizing consumer privacy.
(12)Issuing regulations to further define intentionally interacts, with the goal of maximizing consumer privacy.
(13)Issuing regulations to further define precise geolocation, including if the size defined is not sufficient to protect consumer privacy in sparsely populated areas or when the personal information is used for normal operational purposes, including billing.
(14)Issuing regulations to define the term specific pieces of information obtained from the consumer with the goal of maximizing a consumers right to access relevant personal information while minimizing the delivery of information to a consumer that would not be useful to the consumer, including system log information and other technical data. For delivery of the most sensitive personal information, the regulations may require a higher standard of authentication provided that the agency shall monitor the impact of the higher standard on the right of consumers to obtain their personal information to ensure that the requirements of verification do not result in the unreasonable denial of verifiable consumer requests.
(15)Issuing regulations requiring businesses whose processing of consumers personal information presents significant risk to consumers privacy or security, to:
(A)Perform a cybersecurity audit on an annual basis, including defining the scope of the audit and establishing a process to ensure that audits are thorough and independent. The factors to be considered in determining when processing may result in significant risk to the security of personal information shall include the size and complexity of the business and the nature and scope of processing activities.
(B)Submit to the California Privacy Protection Agency on a regular basis a risk assessment with respect to their processing of personal information, including whether the processing involves sensitive personal information, and identifying and weighing the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, with the goal of restricting or prohibiting the processing if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public. Nothing in this section shall require a business to divulge trade secrets.
(16)Issuing regulations governing access and opt-out rights with respect to businesses use of automated decisionmaking technology, including profiling and requiring businesses response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer.
(17)Issuing regulations to further define a law enforcement agency-approved investigation for purposes of the exception in subparagraph (B) of paragraph (1) of subdivision (a) of Section 1798.145.
(18)Issuing regulations to define the scope and process for the exercise of the agencys audit authority, to establish criteria for selection of persons to audit, and to protect consumers personal information from disclosure to an auditor in the absence of a court order, warrant, or subpoena.
(19)(A)Issuing regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumers intent to opt out of the sale or sharing of the consumers personal information and to limit the use or disclosure of the consumers sensitive personal information. The requirements and specifications for the opt-out preference signal should be updated from time to time to reflect the means by which consumers interact with businesses, and should:
(i)Ensure that the manufacturer of a platform or browser or device that sends the opt-out preference signal cannot unfairly disadvantage another business.
(ii)Ensure that the opt-out preference signal is consumer-friendly, clearly described, and easy to use by an average consumer and does not require that the consumer provide additional information beyond what is necessary.
(iii)Clearly represent a consumers intent and be free of defaults constraining or presupposing that intent.
(iv)Ensure that the opt-out preference signal does not conflict with other commonly used privacy settings or tools that consumers may employ.
(v)Provide a mechanism for the consumer to selectively consent to a businesss business sale of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, without affecting the consumers preferences with respect to other businesses or disabling the opt-out preference signal globally.
(vi)State that in the case of a page or setting view that the consumer accesses to set the opt-out preference signal, the consumer should see up to three choices, including:
(I)Global opt out from sale and sharing of personal information, including a direction to limit the use of sensitive personal information.
(II)Choice to Limit the Use of My Sensitive Personal Information.
(III)Choice titled Do Not Sell/Do Not Share My Personal Information for Cross-Context Behavioral Advertising.
(B)Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age.
(C)Issuing regulations, with the goal of strengthening consumer privacy while considering the legitimate operational interests of businesses, to govern the use or disclosure of a consumers sensitive personal information, notwithstanding the consumers direction to limit the use or disclosure of the consumers sensitive personal information, including:
(i)Determining any additional purposes for which a business may use or disclose a consumers sensitive personal information.
(ii)Determining the scope of activities permitted under paragraph (8) of subdivision (e) of Section 1798.140, as authorized by subdivision (a) of Section 1798.121, to ensure that the activities do not involve health-related research.
(iii)Ensuring the functionality of the businesss business operations.
(iv)Ensuring that the exemption in subdivision (d) of Section 1798.121 for sensitive personal information applies to information that is collected or processed incidentally, or without the purpose of inferring characteristics about a consumer, while ensuring that businesses do not use the exemption for the purpose of evading consumers rights to limit the use and disclosure of their sensitive personal information under Section 1798.121.
(20)Issuing regulations to govern how a business that has elected to comply with subdivision (b) of Section 1798.135 responds to the opt-out preference signal and provides consumers with the opportunity subsequently to consent to the sale or sharing of their personal information or the use and disclosure of their sensitive personal information for purposes in addition to those authorized by subdivision (a) of Section 1798.121. The regulations should:
(A)Strive to promote competition and consumer choice and be technology neutral.
(B)Ensure that the business does not respond to an opt-out preference signal by:
(i)Intentionally degrading the functionality of the consumer experience.
(ii)Charging the consumer a fee in response to the consumers opt-out preferences.
(iii)Making any products or services not function properly or fully for the consumer, as compared to consumers who do not use the opt-out preference signal.
(iv)Attempting to coerce the consumer to opt in to the sale or sharing of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, by stating or implying that the use of the opt-out preference signal will adversely affect the consumer as compared to consumers who do not use the opt-out preference signal, including stating or implying that the consumer will not be able to use the businesss business products or services or that those products or services may not function properly or fully.
(v)Displaying any notification or pop-up in response to the consumers opt-out preference signal.
(C)Ensure that any link to a web page or its supporting content that allows the consumer to consent to opt in:
(i)Is not part of a popup, pop-up notice, banner, or other intrusive design that obscures any part of the web page the consumer intended to visit from full view or that interferes with or impedes in any way the consumers experience visiting or browsing the web page or website the consumer intended to visit.
(ii)Does not require or imply that the consumer must click the link to receive full functionality of any products or services, including the website.
(iii)Does not make use of any dark patterns.
(iv)Applies only to the business with which the consumer intends to interact.
(D)Strive to curb coercive or deceptive practices in response to an opt-out preference signal but should not unduly restrict businesses that are trying in good faith to comply with Section 1798.135.
(21)Review existing Insurance Code provisions and regulations relating to consumer privacy, except those relating to insurance rates or pricing, to determine whether any provisions of the Insurance Code provide greater protection to consumers than the provisions of this title. Upon completing its review, the agency shall adopt a regulation that applies only the more protective provisions of this title to insurance companies. For the purpose of clarity, the Insurance Commissioner shall have jurisdiction over insurance rates and pricing.
(22)Harmonizing the regulations governing opt-out mechanisms, notices to consumers, and other operational mechanisms in this title to promote clarity and the functionality of this title for consumers.
(b)The Attorney General may adopt additional regulations as necessary to further the purposes of this title.
(c)The Attorney General shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.
(d)Notwithstanding subdivision (a), the timeline for adopting final regulations required by the act adding this subdivision shall be July 1, 2022. Beginning the later of July 1, 2021, or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking under this title, the authority assigned to the Attorney General to adopt regulations under this section shall be exercised by the California Privacy Protection Agency. Notwithstanding any other law, civil and administrative enforcement of the provisions of law added or amended by this act shall not commence until July 1, 2023, and shall only apply to violations occurring on or after that date. Enforcement of provisions of law contained in the California Consumer Privacy Act of 2018 amended by this act shall remain in effect and shall be enforceable until the same provisions of this act become enforceable.
SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
(a)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (c).
(b)For purposes of this section, the following definitions apply:
(1)Business means the same as defined in subdivision (c) of Section 1798.140.
(2)Collect means the same as defined in subdivision (f) of Section 1798.140.
(3)Family planning center means a business categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300 of the Civil Code.
(4)Personal information has the same definition as that term is defined in subdivision (v) (x) of Section 1798.140, except as applied to all persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.
(5)Precise geolocation means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person.
(6)Sell means the same as defined in subdivision (ad) of Section 1798.140.
(7)Share means the same as defined in subdivision (ah) of Section 1798.140.
(c)A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information.
(d)(1)An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person or business who violates this section for injunctive and monetary relief and attorneys fees within three years of discovery of the violation.
(2)If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorneys fees incurred in connection with the litigation.
(e)This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05.
SEC. 2.Section 1798.130 of the Civil Code is amended to read:1798.130.Notice, Disclosure, Correction, and Deletion Requirements
(a)In order to comply with Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:
(1)(A)Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or for requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(B)If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, or requests for deletion or correction pursuant to Sections 1798.105 and 1798.106, respectively.
(2)(A)Disclose and deliver the required information to a consumer free of charge, correct inaccurate personal information, or delete a consumers personal information, based on the consumers request, within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the businesss duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumers request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure of the required information shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request provided that if the consumer, has an account with the business, the business may require the consumer to use that account to submit a verifiable consumer request.
(B)The disclosure of the required information shall cover the 12-month period preceding the business receipt of the verifiable consumer request provided that, upon the adoption of a regulation pursuant to paragraph (9) of subdivision (a) of Section 1798.185, a consumer may request that the business disclose the required information beyond the 12-month period, and the business shall be required to provide that information unless doing so proves impossible or would involve a disproportionate effort. A consumers right to request required information beyond the 12-month period, and a businesss obligation to provide that information, shall only apply to personal information collected on or after January 1, 2022. Nothing in this subparagraph shall require a business to keep personal information for any length of time.
(3)(A)A business that receives a verifiable consumer request pursuant to Section 1798.110 or 1798.115 shall disclose any personal information it has collected about a consumer, directly or indirectly, including through or by a service provider or contractor, to the consumer. A service provider or contractor shall not be required to comply with a verifiable consumer request received directly from a consumer or a consumers authorized agent, pursuant to Section 1798.110 or 1798.115, to the extent that the service provider or contractor has collected personal information about the consumer in its role as a service provider or contractor. A service provider or contractor shall provide assistance to a business with which it has a contractual relationship with respect to the business response to a verifiable consumer request, including, but not limited to, by providing to the business the consumers personal information in the service provider or contractors possession, which the service provider or contractor obtained as a result of providing services to the business, and by correcting inaccurate information or by enabling the business to do the same. A service provider or contractor that collects personal information pursuant to a written contract with a business shall be required to assist the business through appropriate technical and organizational measures in complying with the requirements of subdivisions (d) to (f), inclusive, of Section 1798.100, taking into account the nature of the processing.
(B)For purposes of subdivision (b) of Section 1798.110:
(i)To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(ii)Identify by category or categories the personal information collected about the consumer for the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information collected; the categories of sources from which the consumers personal information was collected; the business or commercial purpose for collecting, selling, or sharing the consumers personal information; and the categories of third parties to whom the business discloses the consumers personal information.
(iii)Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumers request without hindrance. Specific pieces of information do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumers personal information from one business to another in the context of switching services.
(4)For purposes of subdivision (b) of Section 1798.115:
(A)Identify the consumer and associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.
(B)Identify by category or categories the personal information of the consumer that the business sold or shared during the applicable period of time by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold or shared during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold or shared. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (C).
(C)Identify by category or categories the personal information of the consumer that the business disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information, and provide the categories of persons to whom the consumers personal information was disclosed for a business purpose during the applicable period of time by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information disclosed. The business shall disclose the information in a list that is separate from a list generated for the purposes of subparagraph (B).
(5)Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months:
(A)A description of a consumers rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
(B)For purposes of subdivision (c) of Section 1798.110:
(i)A list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.
(ii)The categories of sources from which consumers personal information is collected.
(iii)The business or commercial purpose for collecting, selling, or sharing consumers personal information.
(iv)The categories of third parties to whom the business discloses consumers personal information.
(C)For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:
(i)A list of the categories of personal information it has sold or shared about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold or shared, or if the business has not sold or shared consumers personal information in the preceding 12 months, the business shall prominently disclose that fact in its privacy policy.
(ii)A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information disclosed, or if the business has not disclosed consumers personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.
(6)Ensure that all individuals responsible for handling consumer inquiries about the business privacy practices or the business compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.
(7)Use any personal information collected from the consumer in connection with the business verification of the consumers request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.
(b)A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.
(c)The categories of personal information required to be disclosed pursuant to Sections 1798.100, 1798.110, and 1798.115 shall follow the definitions of personal information and sensitive personal information in Section 1798.140 by describing the categories of personal information using the specific terms set forth in subparagraphs (A) to (K), inclusive, of paragraph (1) of subdivision (v) (x) of Section 1798.140 and by describing the categories of sensitive personal information using the specific terms set forth in paragraphs (1) to (9), inclusive, of subdivision (ae) (ag) of Section 1798.140.
SEC. 3.Section 1798.140 of the Civil Code is amended to read:1798.140.Definitions
For purposes of this title:
(a)Advertising and marketing means a communication by a business or a person acting on the business behalf in any medium intended to induce a consumer to obtain goods, services, or employment.
(b)Aggregate consumer information means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. Aggregate consumer information does not mean one or more individual consumer records that have been deidentified.
(c)Biometric information means an individuals physiological, biological, or behavioral characteristics, including information pertaining to an individuals deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information.
(d)Business means:
(1)A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:
(A)As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.
(B)Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
(C)Derives 50 percent or more of its annual revenues from selling or sharing consumers personal information.
(2)Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers personal information. Control or controlled means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. Common branding means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.
(3)A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business.
(4)A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
(e)Business purpose means the use of personal information for the business operational purposes, or other notified purposes, or for the service provider or contractors operational purposes, as defined by regulations adopted pursuant to paragraph (11) of subdivision (a) of Section 1798.185, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed or for another purpose that is compatible with the context in which the personal information was collected. Business purposes are:
(1)Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
(2)Helping to ensure security and integrity to the extent the use of the consumers personal information is reasonably necessary and proportionate for these purposes.
(3)Debugging to identify and repair errors that impair existing intended functionality.
(4)Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumers current interaction with the business, provided that the consumers personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumers experience outside the current interaction with the business.
(5)Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
(6)Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.
(7)Undertaking internal research for technological development and demonstration.
(8)Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
(f)Collects, collected, or collection means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. This includes receiving information from the consumer, either actively or passively, or by observing the consumers behavior.
(g)Commercial purposes means to advance a persons commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.
(h)Consent means any freely given, specific, informed, and unambiguous indication of the consumers wishes by which the consumer, or the consumers legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent.
(i)Consumer means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier.
(j)(1)Contractor means a person to whom the business makes available a consumers personal information for a business purpose, pursuant to a written contract with the business, provided that the contract:
(A)Prohibits the contractor from:
(i)Selling or sharing the personal information.
(ii)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract, or as otherwise permitted by this title.
(iii)Retaining, using, or disclosing the information outside of the direct business relationship between the contractor and the business.
(iv)Combining the personal information that the contractor receives pursuant to a written contract with the business with personal information that it receives from or on behalf of another person or persons, or collects from its own interaction with the consumer, provided that the contractor may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) and in regulations adopted by the California Privacy Protection Agency.
(B)Includes a certification made by the contractor that the contractor understands the restrictions in subparagraph (A) and will comply with them.
(C)Permits, subject to agreement with the contractor, the business to monitor the contractors compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a contractor engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the contractor engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(k)Cross-context behavioral advertising means the targeting of advertising to a consumer based on the consumers personal information obtained from the consumers activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.
(l)Dark pattern means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice, as further defined by regulation.
(m)Deidentified means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information:
(1)Takes reasonable measures to ensure that the information cannot be associated with a consumer or household.
(2)Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision.
(3)Contractually obligates any recipients of the information to comply with all provisions of this subdivision.
(n)Designated methods for submitting requests means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this title, and any new, consumer-friendly means of contacting a business, as approved by the Attorney General pursuant to Section 1798.185.
(o)Device means any physical object that is capable of connecting to the Internet, directly or indirectly, or to another device.
(p)Homepage means the introductory page of an internet website and any internet web page where personal information is collected. In the case of an online service, such as a mobile application, homepage means the applications platform page or download page, a link within the application, such as from the application configuration, About, Information, or settings page, and any other location that allows consumers to review the notices required by this title, including, but not limited to, before downloading the application.
(q)Household means a group, however identified, of consumers who cohabitate with one another at the same residential address and share use of common devices or services.
(r)Infer or inference means the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.
(s)Intentionally interacts means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the persons website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumers intent to interact with a person.
(t)Neural data means information that is generated by the measurement of the activity of an individuals central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.
(u)Neurotechnology means a device, instrument, or a set of devices or instruments, that allows a connection with a persons central or peripheral nervous system for various purposes, including, but not limited to, reading, recording, or modifying a persons brain activity or the information obtained from a persons brain activity.
(t)(v)Nonpersonalized advertising means advertising and marketing that is based solely on a consumers personal information derived from the consumers current interaction with the business with the exception of the consumers precise geolocation.
(u)(w)Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert.
(v)(x)(1)Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
(A)Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, drivers license number, passport number, or other similar identifiers.
(B)Any personal information described in subdivision (e) of Section 1798.80.
(C)Characteristics of protected classifications under California or federal law.
(D)Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
(E)Biometric information.
(F)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumers interaction with an internet website application, or advertisement.
(G)Geolocation data.
(H)Audio, electronic, visual, thermal, olfactory, or similar information.
(I)Professional or employment-related information.
(J)Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
(K)Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumers preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(L)Sensitive personal information.
(2)Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, publicly available means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumers knowledge.
(3)Personal information does not include consumer information that is deidentified or aggregate consumer information.
(w)(y)Precise geolocation means any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
(x)(z)Probabilistic identifier means the identification of a consumer or a consumers device to a degree of certainty of more probable than not based on any categories of personal information included in, or similar to, the categories enumerated in the definition of personal information.
(y)(aa)Processing means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
(z)(ab)Profiling means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (16) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural persons performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(aa)(ac)Pseudonymize or Pseudonymization means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
(ab)(ad)Research means scientific analysis, systematic study, and observation, including basic research or applied research that is designed to develop or contribute to public or scientific knowledge and that adheres or otherwise conforms to all other applicable ethics and privacy laws, including, but not limited to, studies conducted in the public interest in the area of public health. Research with personal information that may have been collected from a consumer in the course of the consumers interactions with a business service or device for other purposes shall be:
(1)Compatible with the business purpose for which the personal information was collected.
(2)Subsequently pseudonymized and deidentified, or deidentified and in the aggregate, such that the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, by a business.
(3)Made subject to technical safeguards that prohibit reidentification of the consumer to whom the information may pertain, other than as needed to support the research.
(4)Subject to business processes that specifically prohibit reidentification of the information, other than as needed to support the research.
(5)Made subject to business processes to prevent inadvertent release of deidentified information.
(6)Protected from any reidentification attempts.
(7)Used solely for research purposes that are compatible with the context in which the personal information was collected.
(8)Subjected by the business conducting the research to additional security controls that limit access to the research data to only those individuals as are necessary to carry out the research purpose.
(ac)(ae)Security and integrity means the ability of:
(1)Networks or information systems to detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information.
(2)Businesses to detect security incidents, resist malicious, deceptive, fraudulent, or illegal actions and to help prosecute those responsible for those actions.
(3)Businesses to ensure the physical safety of natural persons.
(ad)(af)(1)Sell, selling, sale, or sold, means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for monetary or other valuable consideration.
(2)For purposes of this title, a business does not sell personal information when:
(A)A consumer uses or directs the business to intentionally:
(i)Disclose personal information.
(ii)Interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ae)(ag)Sensitive personal information means:
(1)Personal information that reveals:
(A)A consumers social security, drivers license, state identification card, or passport number.
(B)A consumers account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
(C)A consumers precise geolocation.
(D)A consumers racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
(E)The contents of a consumers mail, email, and text messages unless the business is the intended recipient of the communication.
(F)A consumers genetic data.
(G)A consumers neural data.
(2)(A)The processing of biometric information for the purpose of uniquely identifying a consumer.
(B)Personal information collected and analyzed concerning a consumers health.
(C)Personal information collected and analyzed concerning a consumers sex life or sexual orientation.
(3)Sensitive personal information that is publicly available pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information.
(af)(ah)Service or services means work, labor, and services, including services furnished in connection with the sale or repair of goods.
(ag)(ai)(1)Service provider means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from:
(A)Selling or sharing the personal information.
(B)Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title.
(C)Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business.
(D)Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (10) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service providers compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months.
(2)If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1).
(ah)(aj)(1)Share, shared, or sharing means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumers personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
(2)For purposes of this title, a business does not share personal information when:
(A)A consumer uses or directs the business to intentionally disclose personal information or intentionally interact with one or more third parties.
(B)The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumers personal information or limited the use of the consumers sensitive personal information.
(C)The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code).
(ai)(ak)Third party means a person who is not any of the following:
(1)The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumers current interaction with the business under this title.
(2)A service provider to the business.
(3)A contractor.
(aj)(al)Unique identifier or unique personal identifier means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including, but not limited to, a device identifier; an Internet Protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device that is linked to a consumer or family. For purposes of this subdivision, family means a custodial parent or guardian and any children under 18 years of age over which the parent or guardian has custody.
(ak)(am)Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. A business is not obligated to provide information to the consumer pursuant to Sections 1798.110 and 1798.115, to delete personal information pursuant to Section 1798.105, or to correct inaccurate personal information pursuant to Section 1798.106, if the business cannot verify, pursuant to this subdivision and regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185, that the consumer making the request is the consumer about whom the business has collected information or is a person authorized by the consumer to act on such consumers behalf.
SEC. 4.Section 1798.185 of the Civil Code is amended to read:1798.185.Regulations
(a)On or before July 1, 2020, the Attorney General shall solicit broad public participation and adopt regulations to further the purposes of this title, including, but not limited to, the following areas:
(1)Updating or adding categories of personal information to those enumerated in subdivision (c) of Section 1798.130 and subdivision (v) (x) of Section 1798.140, and updating or adding categories of sensitive personal information to those enumerated in subdivision (ae) (ag) of Section 1798.140 in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.
(2)Updating as needed the definitions of deidentified and unique identifier to address changes in technology, data collection, obstacles to implementation, and privacy concerns, and adding, modifying, or deleting categories to the definition of designated methods for submitting requests to facilitate a consumers ability to obtain information from a business pursuant to Section 1798.130. The authority to update the definition of deidentified shall not apply to deidentification standards set forth in Section 164.514 of Title 45 of the Code of Federal Regulations, where such information previously was protected health information as defined in Section 160.103 of Title 45 of the Code of Federal Regulations.
(3)Establishing any exceptions necessary to comply with state or federal law, including, but not limited to, those relating to trade secrets and intellectual property rights, within one year of passage of this title and as needed thereafter, with the intention that trade secrets should not be disclosed in response to a verifiable consumer request.
(4)Establishing rules and procedures for the following:
(A)To facilitate and govern the submission of a request by a consumer to opt out of the sale or sharing of personal information pursuant to Section 1798.120 and to limit the use of a consumers sensitive personal information pursuant to Section 1798.121 to ensure that consumers have the ability to exercise their choices without undue burden and to prevent business from engaging in deceptive or harassing conduct, including in retaliation against consumers for exercising their rights, while allowing businesses to inform consumers of the consequences of their decision to opt out of the sale or sharing of their personal information or to limit the use of their sensitive personal information.
(B)To govern business compliance with a consumers opt-out request.
(C)For the development and use of a recognizable and uniform opt-out logo or button by all businesses to promote consumer awareness of the opportunity to opt out of the sale of personal information.
(5)Adjusting the monetary thresholds, in January of every odd-numbered year to reflect any increase in the Consumer Price Index, in: subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140; subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150; subdivision (a) of Section 1798.155; Section 1798.199.25; and subdivision (a) of Section 1798.199.90.
(6)Establishing rules, procedures, and any exceptions necessary to ensure that the notices and information that businesses are required to provide pursuant to this title are provided in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are available in the language primarily used to interact with the consumer, including establishing rules and guidelines regarding financial incentives within one year of passage of this title and as needed thereafter.
(7)Establishing rules and procedures to further the purposes of Sections 1798.105, 1798.106, 1798.110, and 1798.115 and to facilitate a consumers or the consumers authorized agents ability to delete personal information, correct inaccurate personal information pursuant to Section 1798.106, or obtain information pursuant to Section 1798.130, with the goal of minimizing the administrative burden on consumers, taking into account available technology, security concerns, and the burden on the business, to govern a businesss determination that a request for information received from a consumer is a verifiable consumer request, including treating a request submitted through a password-protected account maintained by the consumer with the business while the consumer is logged into the account as a verifiable consumer request and providing a mechanism for a consumer who does not maintain an account with the business to request information through the businesss authentication of the consumers identity, within one year of passage of this title and as needed thereafter.
(8)Establishing how often, and under what circumstances, a consumer may request a correction pursuant to Section 1798.106, including standards governing the following:
(A)How a business responds to a request for correction, including exceptions for requests to which a response is impossible or would involve disproportionate effort, and requests for correction of accurate information.
(B)How concerns regarding the accuracy of the information may be resolved.
(C)The steps a business may take to prevent fraud.
(D)If a business rejects a request to correct personal information collected and analyzed concerning a consumers health, the right of a consumer to provide a written addendum to the business with respect to any item or statement regarding any such personal information that the consumer believes to be incomplete or incorrect. The addendum shall be limited to 250 words per alleged incomplete or incorrect item and shall clearly indicate in writing that the consumer requests the addendum to be made a part of the consumers record.
(9)Establishing the standard to govern a businesss determination, pursuant to subparagraph (B) of paragraph (2) of subdivision (a) of Section 1798.130, that providing information beyond the 12-month period in a response to a verifiable consumer request is impossible or would involve a disproportionate effort.
(10)Issuing regulations further defining and adding to the business purposes, including other notified purposes, for which businesses, service providers, and contractors may use consumers personal information consistent with consumers expectations, and further defining the business purposes for which service providers and contractors may combine consumers personal information obtained from different sources, except as provided for in paragraph (6) of subdivision (e) of Section 1798.140.
(11)Issuing regulations identifying those business purposes, including other notified purposes, for which service providers and contractors may use consumers personal information received pursuant to a written contract with a business, for the service provider or contractors own business purposes, with the goal of maximizing consumer privacy.
(12)Issuing regulations to further define intentionally interacts, with the goal of maximizing consumer privacy.
(13)Issuing regulations to further define precise geolocation, including if the size defined is not sufficient to protect consumer privacy in sparsely populated areas or when the personal information is used for normal operational purposes, including billing.
(14)Issuing regulations to define the term specific pieces of information obtained from the consumer with the goal of maximizing a consumers right to access relevant personal information while minimizing the delivery of information to a consumer that would not be useful to the consumer, including system log information and other technical data. For delivery of the most sensitive personal information, the regulations may require a higher standard of authentication provided that the agency shall monitor the impact of the higher standard on the right of consumers to obtain their personal information to ensure that the requirements of verification do not result in the unreasonable denial of verifiable consumer requests.
(15)Issuing regulations requiring businesses whose processing of consumers personal information presents significant risk to consumers privacy or security, to:
(A)Perform a cybersecurity audit on an annual basis, including defining the scope of the audit and establishing a process to ensure that audits are thorough and independent. The factors to be considered in determining when processing may result in significant risk to the security of personal information shall include the size and complexity of the business and the nature and scope of processing activities.
(B)Submit to the California Privacy Protection Agency on a regular basis a risk assessment with respect to their processing of personal information, including whether the processing involves sensitive personal information, and identifying and weighing the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public, against the potential risks to the rights of the consumer associated with that processing, with the goal of restricting or prohibiting the processing if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public. Nothing in this section shall require a business to divulge trade secrets.
(16)Issuing regulations governing access and opt-out rights with respect to businesses use of automated decisionmaking technology, including profiling and requiring businesses response to access requests to include meaningful information about the logic involved in those decisionmaking processes, as well as a description of the likely outcome of the process with respect to the consumer.
(17)Issuing regulations to further define a law enforcement agency-approved investigation for purposes of the exception in subparagraph (B) of paragraph (1) of subdivision (a) of Section 1798.145.
(18)Issuing regulations to define the scope and process for the exercise of the agencys audit authority, to establish criteria for selection of persons to audit, and to protect consumers personal information from disclosure to an auditor in the absence of a court order, warrant, or subpoena.
(19)(A)Issuing regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumers intent to opt out of the sale or sharing of the consumers personal information and to limit the use or disclosure of the consumers sensitive personal information. The requirements and specifications for the opt-out preference signal should be updated from time to time to reflect the means by which consumers interact with businesses, and should:
(i)Ensure that the manufacturer of a platform or browser or device that sends the opt-out preference signal cannot unfairly disadvantage another business.
(ii)Ensure that the opt-out preference signal is consumer-friendly, clearly described, and easy to use by an average consumer and does not require that the consumer provide additional information beyond what is necessary.
(iii)Clearly represent a consumers intent and be free of defaults constraining or presupposing that intent.
(iv)Ensure that the opt-out preference signal does not conflict with other commonly used privacy settings or tools that consumers may employ.
(v)Provide a mechanism for the consumer to selectively consent to a businesss sale of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, without affecting the consumers preferences with respect to other businesses or disabling the opt-out preference signal globally.
(vi)State that in the case of a page or setting view that the consumer accesses to set the opt-out preference signal, the consumer should see up to three choices, including:
(I)Global opt out from sale and sharing of personal information, including a direction to limit the use of sensitive personal information.
(II)Choice to Limit the Use of My Sensitive Personal Information.
(III)Choice titled Do Not Sell/Do Not Share My Personal Information for Cross-Context Behavioral Advertising.
(B)Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age.
(C)Issuing regulations, with the goal of strengthening consumer privacy while considering the legitimate operational interests of businesses, to govern the use or disclosure of a consumers sensitive personal information, notwithstanding the consumers direction to limit the use or disclosure of the consumers sensitive personal information, including:
(i)Determining any additional purposes for which a business may use or disclose a consumers sensitive personal information.
(ii)Determining the scope of activities permitted under paragraph (8) of subdivision (e) of Section 1798.140, as authorized by subdivision (a) of Section 1798.121, to ensure that the activities do not involve health-related research.
(iii)Ensuring the functionality of the businesss operations.
(iv)Ensuring that the exemption in subdivision (d) of Section 1798.121 for sensitive personal information applies to information that is collected or processed incidentally, or without the purpose of inferring characteristics about a consumer, while ensuring that businesses do not use the exemption for the purpose of evading consumers rights to limit the use and disclosure of their sensitive personal information under Section 1798.121.
(20)Issuing regulations to govern how a business that has elected to comply with subdivision (b) of Section 1798.135 responds to the opt-out preference signal and provides consumers with the opportunity subsequently to consent to the sale or sharing of their personal information or the use and disclosure of their sensitive personal information for purposes in addition to those authorized by subdivision (a) of Section 1798.121. The regulations should:
(A)Strive to promote competition and consumer choice and be technology neutral.
(B)Ensure that the business does not respond to an opt-out preference signal by:
(i)Intentionally degrading the functionality of the consumer experience.
(ii)Charging the consumer a fee in response to the consumers opt-out preferences.
(iii)Making any products or services not function properly or fully for the consumer, as compared to consumers who do not use the opt-out preference signal.
(iv)Attempting to coerce the consumer to opt in to the sale or sharing of the consumers personal information, or the use or disclosure of the consumers sensitive personal information, by stating or implying that the use of the opt-out preference signal will adversely affect the consumer as compared to consumers who do not use the opt-out preference signal, including stating or implying that the consumer will not be able to use the businesss products or services or that those products or services may not function properly or fully.
(v)Displaying any notification or pop-up in response to the consumers opt-out preference signal.
(C)Ensure that any link to a web page or its supporting content that allows the consumer to consent to opt in:
(i)Is not part of a popup, notice, banner, or other intrusive design that obscures any part of the web page the consumer intended to visit from full view or that interferes with or impedes in any way the consumers experience visiting or browsing the web page or website the consumer intended to visit.
(ii)Does not require or imply that the consumer must click the link to receive full functionality of any products or services, including the website.
(iii)Does not make use of any dark patterns.
(iv)Applies only to the business with which the consumer intends to interact.
(D)Strive to curb coercive or deceptive practices in response to an opt-out preference signal but should not unduly restrict businesses that are trying in good faith to comply with Section 1798.135.
(21)Review existing Insurance Code provisions and regulations relating to consumer privacy, except those relating to insurance rates or pricing, to determine whether any provisions of the Insurance Code provide greater protection to consumers than the provisions of this title. Upon completing its review, the agency shall adopt a regulation that applies only the more protective provisions of this title to insurance companies. For the purpose of clarity, the Insurance Commissioner shall have jurisdiction over insurance rates and pricing.
(22)Harmonizing the regulations governing opt-out mechanisms, notices to consumers, and other operational mechanisms in this title to promote clarity and the functionality of this title for consumers.
(b)The Attorney General may adopt additional regulations as necessary to further the purposes of this title.
(c)The Attorney General shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.
(d)Notwithstanding subdivision (a), the timeline for adopting final regulations required by the act adding this subdivision shall be July 1, 2022. Beginning the later of July 1, 2021, or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking under this title, the authority assigned to the Attorney General to adopt regulations under this section shall be exercised by the California Privacy Protection Agency. Notwithstanding any other law, civil and administrative enforcement of the provisions of law added or amended by this act shall not commence until July 1, 2023, and shall only apply to violations occurring on or after that date. Enforcement of provisions of law contained in the California Consumer Privacy Act of 2018 amended by this act shall remain in effect and shall be enforceable until the same provisions of this act become enforceable.
SEC. 5.The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.
SECTION 1.Section 1429 of the Civil Code is amended to read:1429.The rules that govern the interpretation of contracts are prescribed by Part 2 of this division. Other obligations are interpreted by the same rules by which statutes of a similar nature are interpreted.The rules which that govern the interpretation of contracts are prescribed by Part II 2 of this Division. division. Other obligations are interpreted by the same rules by which statutes of a similar nature are interpreted.
|
Date
|
Status
|
|---|---|
| Sep 28, 2024 | Chaptered by Secretary of State. Chapter 887, Statutes of 2024. |
| Sep 28, 2024 | Approved by the Governor. |
| Sep 11, 2024 | Enrolled and presented to the Governor at 3 p.m. |
| Aug 31, 2024 | Assembly amendments concurred in. (Ayes 38. Noes 0. Page 5800.) Ordered to engrossing and enrolling. |
| Aug 31, 2024 | In Senate. Concurrence in Assembly amendments pending. |
| Aug 31, 2024 | Read third time. Passed. (Ayes 76. Noes 0. Page 7105.) Ordered to the Senate. |
| Aug 27, 2024 | Read third time and amended. |
| Aug 27, 2024 | Ordered to third reading. |
| Aug 27, 2024 | Joint Rule 61(b)(16) suspended. (Ayes 63. Noes 0. Page 6657.) |
| Aug 22, 2024 | Read third time and amended. |
| Aug 22, 2024 | Ordered to third reading. |
| Aug 12, 2024 | Ordered to third reading. |
| Aug 12, 2024 | From consent calendar on motion of Assembly Member Flora. |
| Aug 8, 2024 | Read second time. Ordered to consent calendar. |
| Aug 7, 2024 | From committee: Do pass. Ordered to consent calendar. (Ayes 14. Noes 0.) (August 7). |
| Jul 3, 2024 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 10. Noes 0.) (July 2). Re-referred to Com. on APPR. |
| Jun 26, 2024 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on P. & C.P. |
| May 28, 2024 | Referred to Com. on P. & C.P. |
| May 22, 2024 | In Assembly. Read first time. Held at Desk. |
| May 21, 2024 | Read third time. Passed. (Ayes 38. Noes 0. Page 4083.) Ordered to the Assembly. |
| May 14, 2024 | Read second time. Ordered to third reading. |
| May 13, 2024 | From committee: Be ordered to second reading pursuant to Senate Rule 28.8. |
| May 3, 2024 | Set for hearing May 13. |
| Apr 17, 2024 | From committee: Do pass and re-refer to Com. on APPR. (Ayes 11. Noes 0. Page 3635.) (April 16). Re-referred to Com. on APPR. |
| Apr 5, 2024 | Set for hearing April 16. |
| Apr 3, 2024 | Re-referred to Com. on JUD. |
| Mar 18, 2024 | From committee with author's amendments. Read second time and amended. Re-referred to Com. on RLS. |
| Feb 29, 2024 | Referred to Com. on RLS. |
| Feb 16, 2024 | From printer. May be acted upon on or after March 17. |
| Feb 15, 2024 | Introduced. Read first time. To Com. on RLS. for assignment. To print. |
|
Date
|
Description
|
Location
|
Votes
|
|
|---|---|---|---|---|
| Aug 31, 2024 | SB 1223 Becker Senate Third Reading By Bauer-Kahan | Assembly Floor |
Passed |
|
| Aug 31, 2024 | Unfinished Business SB1223 Becker Concurrence | Senate Floor |
Passed |
|
| Aug 7, 2024 | Do pass. To Consent Calendar. | Assembly Standing Committee on Appropriations |
Passed |
|
| Jul 2, 2024 | Do pass and be re-referred to the Committee on [Appropriations] | Assembly Standing Committee on Privacy and Consumer Protection |
Passed |
|
| May 21, 2024 | Senate 3rd Reading SB1223 Becker | Senate Floor |
Passed |
|
| Apr 16, 2024 | Do pass, but first be re-referred to the Committee on [Appropriations] | Senate Standing Committee on Judiciary |
Passed |
This list shows positions taken on this bill by organizations on the date displayed, which is linked to the original source.
Positions by individuals are not included.
|
Organization
|
Position
|
Date
|
|---|---|---|
| American Academy of Neurology | ** Support | |
| California Chamber Of Commerce | ** Against | |
| California Medical Association And Affiliates | * Support | Jul 2, 2024 |
| California Privacy Protection Agency | ** Support | |
| Colorado State Representative Cathy Kipp | ** Support | |
| Colorado State Representative Matt Soper | ** Support | |
| Colorado State Senator Kevin Priola | ** Support | |
| Colorado State Senator Mark Baisley | ** Support | |
| Computer & Communications Industry Association | ** Against | |
| NeuroRights Foundation | ** Support | |
| Neurorights Foundation | * Support | Jul 2, 2024 |
| Neurorights Foundation | * Support | Jul 2, 2024 |
| Oakland Privacy | * Support | Jul 2, 2024 |
| Perk Advocacy | ** Support | |
| Technet | ** Against |
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | SB 1223 |
UNFINISHED BUSINESS
Bill No: SB 1223
Author: Becker (D)
Amended: 8/27/24
Vote: 21
SENATE JUDICIARY COMMITTEE: 11-0, 4/16/24
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Stern, Wahab
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
SENATE FLOOR: 38-0, 5/21/24
AYES: Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
NO VOTE RECORDED: Allen, Seyarto
ASSEMBLY FLOOR: 56-0, 8/31/24 – Roll call not available
SUBJECT: Consumer privacy: sensitive personal information: neural data
SOURCE: NeuroRights Foundation
DIGEST:
This bill includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the California Consumer Privacy Act (CCPA).
Assembly Amendments
rework the bill’s definitions.
ANALYSIS:
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- The categories of personal information it has collected about that consumer;
- The categories of sources from which the personal information is collected;
- The business or commercial purpose for collecting or selling personal information;
- The categories of third parties with whom the business shares personal information; and
- The specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
- Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
- The categories of personal information that the business collected about the consumer;
- The categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
- The categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
- Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (Civ. Code § 1798.120.)
- Prohibits a business from discriminating against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. (Civ. Code § 1798.125(a)(1).)
- Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
- Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Includes a consumer’s neural data in the CCPA’s definition of sensitive personal information.
- Defines “neural data” as information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.
- Provides that the Legislature finds and declares that the bill further the purposes and intent of the CPRA.
Background
The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020, election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CPRA also created a new category of “sensitive personal information” and afforded consumers enhanced rights with respect to that information, including the ability to restrict businesses’ use of that information. The emergence of consumer neurotechnologies such as neuromonitoring devices, cognitive training applications, neurostimulation devices, mental health apps, and so called “brain wearables” has raised concerns about whether more regulatory oversight is necessary. Specifically, issues of privacy, when devices can interact with your brain and nervous system, have been highlighted. Given the heightened sensitivity of neural data, this bill includes it within the definition of sensitive information, defining it as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.”
The bill is sponsored by the NeuroRights Foundation and supported by several Colorado state legislators. The bill is opposed by industry associations, including Technet.
Comments
The emergence of neurotechnologies Neurotechnologies have been described as the “next technology frontier” by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.[1] Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
Like with most advanced technologies, there are tremendous possibilities:
Neurotechnologies can provide insights into brain or nervous system activity, or can influence brain or nervous system function. Essentially, neurotechnologies have the potential to help neuroscientists gather information that might help uncover some of the secrets of the biology underlying the normal and pathological functioning of the human brain – arguably the most complex and least understood organ of the human body – as well as delivering practical therapeutic or rehabilitative solutions in the clinical care of neurological disorders to help ease the personal and socioeconomic burden of these conditions. Adopting a technology-based approach can also have benefits for research, allowing the use of more sensitive endpoints that will accelerate data gathering and evidence generation in clinical trials.[2]
The infinite applications are also being explored for consumer products: “Eventually, neurotechnologies could enable commercial devices, like phones, powered by mind control. Neurotechnologies could also potentially enable features like a thought-to-text writing function, or virtual and augmented reality devices assisted by brain control for purposes of entertainment.”[3] For example, a few years back, Facebook purchased a neurotechnology startup, as part of efforts to develop a wristband for controlling smartphones, computers and other digital devices without having to touch a screen or keyboard.[4]
With the emergence of these consumer neurotechnology devices comes not only concern that regulatory oversight is insufficient to, for example, assess efficacy claims, many are sounding alarms around the privacy implications:
A last bastion of privacy, our brains have remained inviolate, even as sensors now record our heartbeats, breaths, steps and sleep. All that is about to change. An avalanche of brain-tracking devices—earbuds, headphones, headbands, watches and even wearable tattoos—will soon enter the market, promising to transform our lives. And threatening to breach the refuge of our minds.
Tech titans Meta, Snap, Microsoft and Apple are already investing heavily in brain wearables. They aim to embed brain sensors into smart watches, earbuds, headsets and sleep aids. Integrating them into our everyday lives could revolutionize health care, enabling early diagnosis and personalized treatment of conditions such as depression, epilepsy and even cognitive decline. Brain sensors could improve our ability to meditate, focus and even communicate with a seamless technological telepathy—using the power of thoughts and emotion to drive our interaction with augmented reality (AR) and virtual reality (VR) headsets, or even type on virtual keyboards with our minds.
But brain wearables also pose very real risks to mental privacy, freedom of thought and self-determination. As these devices proliferate, they will generate vast amounts of neural data, creating an intimate window into our brain states, emotions and even memories. We need the individual power to shutter this new view into our inner selves.
Employers already seek out such data, tracking worker fatigue levels and offering brain wellness programs to mitigate stress, via platforms that give them unprecedented access to employees’ brains. Cognitive and emotional testing based on neuroscience is becoming a new job screening norm, revealing personality aspects that may have little to do with a job. In China, train conductors of the Beijing-Shanghai line, the busiest of its kind in the world, wear brain sensors throughout their work day. There are even reports of Chinese employees being sent home if their brain activity shows less than stellar brain metrics. As companies embrace brain wearables that can track employees’ attention, focus and even boredom, without safeguards in place, they could trample on employee’s mental privacy, eroding trust and well-being along with the dignity of work itself.[5]
Protecting our neural data. This bill responds to the privacy concerns raised by these neurotechnologies by including “neural data” into the definition of sensitive personal information for purposes of the CCPA. Neural data is defined as information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.
Author’s Statement. According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT: (Verified 8/28/24)
NeuroRights Foundation (source)
California Privacy Protection Agency
Colorado State Representative Cathy Kipp
Colorado State Representative Matt Soper
Colorado State Senator Mark Baisley
Colorado State Senator Kevin Priola
1 Individual
OPPOSITION: (Verified 8/28/24)
California Chamber of Commerce
Computer & Communications Industry Association
Technet
ARGUMENTS IN SUPPORT: The NeuroRights Foundation, the sponsor of the bill, writes:
While the California Consumer Privacy Act (CCPA) has been instrumental in improving the standard for data protection, it doesn't specifically address neural data. As the wearable neurotechnology market grows, this oversight could lead to privacy violations and the misuse of neural data, highlighting the need for legislation to specifically address the unique challenges posed by advancements in neurotechnology.
SB 1223 bridges this gap by categorizing neural data as sensitive information under the CCPA and establishing clear definitions for neural data and neurotechnology, providing clarity and guidance for individuals and businesses.
ARGUMENTS IN OPPOSITION: The California Chamber of Commerce argues:
We have a concern about the breadth of technologies that could be included under the definitions of “neural data” and “neurotechnology” and have suggested amendments to tailor them to technologies that directly measure brain activity.
The fundamental challenge with the existing definitions is that they include references to the “peripheral nervous system” (“PNS”) – all nerves in parts of the body other than the brain and spinal cord. There are two problems with these references. First, information about activity of the PNS simply is not capable of revealing someone’s inner thoughts and mental processes, which this bill seeks to protect. Those result from activity of the brain, not the PNS. Many scientists argue that even information about brain activity does not and will not permit decoding complex thoughts, and recent research has described attempts to argue otherwise as alarmist.
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
8/31/24 23:10:31
**** END ****
Neurotechnologies: The Next Technology Frontier, IEEE Brain, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/. All internet citations are current as of May 9, 2024. ↑
Roongroj Bhidayasiri, The grand challenge at the frontiers of neurotechnology and its emerging clinical applications (January 17, 2024) Front Neurol, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10827995/pdf/fneur-15-1314477.pdf. ↑
See fn. 1. ↑
Queenie Wong & Scott Stein, Facebook buys startup working on technology that lets you control computers with your mind (September 23, 2019) CNET, https://www.cnet.com/science/facebook-buys-ctrl-labs-to-work-on-a-wristband-that-will-let-you-control-computers-with-your-mind/. ↑
Nita Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy (March 27, 2023) Scientific American, https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/. ↑
SENATE THIRD READING
STR Bill Id:SB 1223
Author:(Becker)
As Amended Ver:August 27, 2024
Majority vote
SUMMARY
Defines "neural data" within the California Consumer Privacy Act (CCPA), and designates neural data as sensitive personal information. Proposed amendments are non-substantive and for chaptering purposes.
Major Provisions
- Defines "neural data" to mean "information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information" for the purposes of the CCPA.
- Amends the CCPA's definition of "sensitive personal information" to include neural data.
COMMENTS
Background. There is no information more private than the thoughts, emotions, and fundamental beliefs that define an individual. In modern society, the mind serves as something of a final refuge for personal privacy. The physical world contains an endless array of cameras meant to record the comings and goings of individuals, and the digital world is designed to extract information from its users. But until now, information that existed in the mind could only be inferred from an individual's actions. In the near future this may no longer be true, as technological advances improve humans' ability to measure and interpret brain activity.
Neurotechnologies have been described as the "next technology frontier" by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
What this bill would do. This bill would define "neural data" to mean information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information. This bill would also amend the definition of "sensitive personal information" under the California Consumer Privacy Act (CCPA) to include neural data, thereby granting neural data substantial protections under California's privacy laws.
Analysis. Advances in the field of artificial intelligence over the past few decades have greatly enhanced researchers' ability to analyze and interpret data related to brain activity. In 2021 the Colorado general assembly enacted Senate Bill 21-190, which established the "Colorado Privacy Act" as part of the "Colorado Consumer Protection Act." These privacy laws were expanded in April of this year by House Bill 24-1058, which amended the definition of "sensitive data" to include "neural data" as follows:
"NEURAL DATA" MEANS INFORMATION THAT IS GENERATED BY THE MEASUREMENT OF THE ACTIVITY OF AN INDIVIDUAL'S CENTRAL OR PERIPHERAL NERVOUS SYSTEMS AND THAT CAN BE PROCESSED BY OR WITH THE ASSISTANCE OF A DEVICE.
This inspired an earlier version of SB 1223, which similarly defined "neural data" in terms of information that could be measured through the use of "neurotechnology". The current version of the bill simplifies this definition of neural data and incorporates it cleanly into the CCPA.
According to the Author
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians' neural data against predatory use.
Arguments in Support
The California Privacy Protection Agency writes:
Because of the unique sensitivity of such data, it is appropriate to afford it even greater protections under California law. As this technology develops, there is the risk that these measurements of brain activity can be used to draw inferences about the users' emotions and state of mind. The Agency supports the bill giving consumers even more control over this information.
The NeuroRights Foundation, who sponsored this bill, writes:
In recent years, neurotechnology has become increasingly prevalent in the global marketplace. Devices like brain-computer interfaces (BCIs) and neurostimulation devices promise exciting new possibilities, from assisting individuals with disabilities to enhancing cognitive abilities. However, these technologies also raise significant privacy concerns.
One major worry is the potential for unauthorized access to neural data. BCIs, for instance, interpret neural signals to control external devices or software. This data is highly sensitive, revealing intimate details about an individual's thoughts, emotions, and intentions. Without adequate safeguards, there's a risk of this data being exploited without the individual's consent.
Arguments in Opposition
TechNet writes on behalf of a coalition of industry associations:
As a result, the definitions of "neural data" and "neurotechnology" would ensnare vast swaths of technology that have nothing to do with mental privacy. For example, they could mean that any data about how someone moves a mouse is sensitive, because, to move a mouse, someone's brain sends a signal to the nerves in their hand, part of the PNS. As another example, it would disincentivize innovation in vehicular safety features, such as systems that monitor drivers' eye movements and body positions to detect fatigue. Both of those kinds of data could be considered measurements of the activity of the PNS.
FISCAL COMMENTS
According to the Assembly Appropriations Committee's analysis of this bill:
The California Privacy Protection Agency (Privacy Agency) anticipates absorbable enforcement costs due to this bill. However, the Privacy Agency notes it may need additional enforcement resources in the long term to develop specialized expert testimony and biological evidence.
VOTES
SENATE FLOOR: 38-0-2
YES: Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Allen, Seyarto
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: August 27, 2024
CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0004743
SENATE THIRD READING
STR Bill Id:SB 1223
Author:(Becker)
As Amended Ver:August 22, 2024
Majority vote
SUMMARY
Defines "neural data" within the California Consumer Privacy Act (CCPA), and designates neural data as sensitive personal information. Amendments are non-substantive and technical in nature.
Major Provisions
- Defines "neural data" to mean "information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information" for the purposes of the CCPA.
- Amends the CCPA's definition of "sensitive personal information" to include neural data.
COMMENTS
Background. There is no information more private than the thoughts, emotions, and fundamental beliefs that define an individual. In modern society, the mind serves as something of a final refuge for personal privacy. The physical world contains an endless array of cameras meant to record the comings and goings of individuals, and the digital world is designed to extract information from its users. But until now, information that existed in the mind could only be inferred from an individual's actions. In the near future this may no longer be true, as technological advances improve humans' ability to measure and interpret brain activity.
Neurotechnologies have been described as the "next technology frontier" by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
What this bill would do. This bill would define "neural data" to mean information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information. This bill would also amend the definition of "sensitive personal information" under the California Consumer Privacy Act (CCPA) to include neural data, thereby granting neural data substantial protections under California's privacy laws.
Analysis. Advances in the field of artificial intelligence over the past few decades have greatly enhanced researchers' ability to analyze and interpret data related to brain activity. In 2021 the Colorado general assembly enacted Senate Bill 21-190, which established the "Colorado Privacy Act" as part of the "Colorado Consumer Protection Act." These privacy laws were expanded in April of this year by House Bill 24-1058, which amended the definition of "sensitive data" to include "neural data" as follows:
"NEURAL DATA" MEANSINFORMATION THAT IS GENERATED BY THE MEASUREMENT OF THE ACTIVITY OF AN INDIVIDUAL'S CENTRAL OR PERIPHERAL NERVOUS SYSTEMS AND THAT CAN BE PROCESSED BY OR WITH THE ASSISTANCE OF A DEVICE.
This inspired an earlier version of SB 1223, which similarly defined "neural data" in terms of information that could be measured through the use of "neurotechnology". The current version of the bill simplifies this definition of neural data and incorporates it cleanly into the CCPA.
According to the Author
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians' neural data against predatory use.
Arguments in Support
The California Privacy Protection Agency writes:
Because of the unique sensitivity of such data, it is appropriate to afford it even greater protections under California law. As this technology develops, there is the risk that these measurements of brain activity can be used to draw inferences about the users' emotions and state of mind. The Agency supports the bill giving consumers even more control over this information.
The NeuroRights Foundation, who sponsored this bill, writes:
In recent years, neurotechnology has become increasingly prevalent in the global marketplace. Devices like brain-computer interfaces (BCIs) and neurostimulation devices promise exciting new possibilities, from assisting individuals with disabilities to enhancing cognitive abilities. However, these technologies also raise significant privacy concerns.
One major worry is the potential for unauthorized access to neural data. BCIs, for instance, interpret neural signals to control external devices or software. This data is highly sensitive, revealing intimate details about an individual's thoughts, emotions, and intentions. Without adequate safeguards, there's a risk of this data being exploited without the individual's consent.
Arguments in Opposition
TechNet writes on behalf of a coalition of industry associations:
As a result, the definitions of "neural data" and "neurotechnology" would ensnare vast swaths of technology that have nothing to do with mental privacy. For example, they could mean that any data about how someone moves a mouse is sensitive, because, to move a mouse, someone's brain sends a signal to the nerves in their hand, part of the PNS. As another example, it would disincentivize innovation in vehicular safety features, such as systems that monitor drivers' eye movements and body positions to detect fatigue. Both of those kinds of data could be considered measurements of the activity of the PNS.
FISCAL COMMENTS
According to the Assembly Appropriations Committee's analysis of this bill:
The California Privacy Protection Agency (Privacy Agency) anticipates absorbable enforcement costs due to this bill. However, the Privacy Agency notes it may need additional enforcement resources in the long term to develop specialized expert testimony and biological evidence.
VOTES
SENATE FLOOR: 38-0-2
YES: Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Allen, Seyarto
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: August 22, 2024
CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0004546
SENATE THIRD READING
STR Bill Id:SB 1223
Author:(Becker)
As Amended Ver:June 26, 2024
Majority vote
SUMMARY
Defines "neural data" within the California Consumer Privacy Act (CCPA), and designates neural data as sensitive personal information.
Major Provisions
- Defines "neural data" to mean "information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information" for the purposes of the CCPA.
- Amends the CCPA's definition of "sensitive personal information" to include neural data.
COMMENTS
Background. There is no information more private than the thoughts, emotions, and fundamental beliefs that define an individual. In modern society, the mind serves as something of a final refuge for personal privacy. The physical world contains an endless array of cameras meant to record the comings and goings of individuals, and the digital world is designed to extract information from its users. But until now, information that existed in the mind could only be inferred from an individual's actions. In the near future this may no longer be true, as technological advances improve humans' ability to measure and interpret brain activity.
Neurotechnologies have been described as the "next technology frontier" by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
What this bill would do. This bill would define "neural data" to mean information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information. This bill would also amend the definition of "sensitive personal information" under the California Consumer Privacy Act (CCPA) to include neural data, thereby granting neural data substantial protections under California's privacy laws.
Analysis. Advances in the field of artificial intelligence over the past few decades have greatly enhanced researchers' ability to analyze and interpret data related to brain activity. In 2021 the Colorado general assembly enacted Senate Bill 21-190, which established the "Colorado Privacy Act" as part of the "Colorado Consumer Protection Act." These privacy laws were expanded in April of this year by House Bill 24-1058, which amended the definition of "sensitive data" to include "neural data" as follows:
"NEURAL DATA" MEANS INFORMATION THAT IS GENERATED BY THE MEASUREMENT OF THE ACTIVITY OF AN INDIVIDUAL'S CENTRAL OR PERIPHERAL NERVOUS SYSTEMS AND THAT CAN BE PROCESSED BY OR WITH THE ASSISTANCE OF A DEVICE.
This inspired an earlier version of SB 1223, which similarly defined "neural data" in terms of information that could be measured through the use of "neurotechnology". The current version of the bill simplifies this definition of neural data and incorporates it cleanly into the CCPA.
According to the Author
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians' neural data against predatory use.
Arguments in Support
The California Privacy Protection Agency writes:
Because of the unique sensitivity of such data, it is appropriate to afford it even greater protections under California law. As this technology develops, there is the risk that these measurements of brain activity can be used to draw inferences about the users' emotions and state of mind. The Agency supports the bill giving consumers even more control over this information.
The NeuroRights Foundation, who sponsored this bill, writes:
In recent years, neurotechnology has become increasingly prevalent in the global marketplace. Devices like brain-computer interfaces (BCIs) and neurostimulation devices promise exciting new possibilities, from assisting individuals with disabilities to enhancing cognitive abilities. However, these technologies also raise significant privacy concerns.
One major worry is the potential for unauthorized access to neural data. BCIs, for instance, interpret neural signals to control external devices or software. This data is highly sensitive, revealing intimate details about an individual's thoughts, emotions, and intentions. Without adequate safeguards, there's a risk of this data being exploited without the individual's consent.
Arguments in Opposition
TechNet writes on behalf of a coalition of industry associations:
As a result, the definitions of "neural data" and "neurotechnology" would ensnare vast swaths of technology that have nothing to do with mental privacy. For example, they could mean that any data about how someone moves a mouse is sensitive, because, to move a mouse, someone's brain sends a signal to the nerves in their hand, part of the PNS. As another example, it would disincentivize innovation in vehicular safety features, such as systems that monitor drivers' eye movements and body positions to detect fatigue. Both of those kinds of data could be considered measurements of the activity of the PNS.
FISCAL COMMENTS
According to the Assembly Appropriations Committee's analysis of this bill:
The California Privacy Protection Agency (Privacy Agency) anticipates absorbable enforcement costs due to this bill. However, the Privacy Agency notes it may need additional enforcement resources in the long term to develop specialized expert testimony and biological evidence.
VOTES
SENATE FLOOR: 38-0-2
YES: Alvarado-Gil, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk
ABS, ABST OR NV: Allen, Seyarto
ASM PRIVACY AND CONSUMER PROTECTION: 10-0-1
YES: Bauer-Kahan, Joe Patterson, Bryan, Dixon, Hoover, Irwin, Lowenthal, Ortega, Ward, Wilson
ABS, ABST OR NV: Wicks
ASM APPROPRIATIONS: 14-0-1
YES: Wicks, Sanchez, Arambula, Bryan, Calderon, Wendy Carrillo, Dixon, Mike Fong, Grayson, Haney, Hart, Jim Patterson, Pellerin, Ta
ABS, ABST OR NV: Villapudua
UPDATED
VERSION: June 26, 2024
CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0003849
Date of Hearing: August 7, 2024
ASSEMBLY COMMITTEE ON APPROPRIATIONS
Buffy Wicks, Chair
SBPCA Bill Id:SB 1223
Author:(Becker) – As Amended Ver:June 26, 2024
Policy Committee: | Privacy and Consumer Protection | Vote: | 10 - 0 |
|
| ||
|
|
Urgency: No State Mandated Local Program: No Reimbursable: No
SUMMARY:
This bill expands the definition of sensitive personal information in the California Consumer Privacy Act (CCPA) to include neural data.
The bill defines “neural data” to mean information generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.
FISCAL EFFECT:
The California Privacy Protection Agency (Privacy Agency) anticipates absorbable enforcement costs due to this bill. However, the Privacy Agency notes it may need additional enforcement resources in the long term to develop specialized expert testimony and biological evidence.
COMMENTS:
- Purpose. This bill is sponsored by the Neurorights Foundation. According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It’s imperative that we establish robust safeguards to shield consumers’ privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual’s health or even unwillingly identify them…Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
- Background. The CCPA gives a California consumer the right to know what personal information about them is collected and sold, to request the specific pieces of personal information about them held by a business, and to opt out of the sale of their personal information. Under the CCPA, a business’s use of a consumer’s sensitive personal information is more restricted than other types of personal information. Currently, the law’s definition of sensitive personal information includes a consumer’s social security or passport number, their precise geolocation, and their genetic data, among other types of information.
Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | SB 1223 |
THIRD READING
Bill No: SB 1223
Author: Becker (D)
Amended: 3/18/24
Vote: 21
SENATE JUDICIARY COMMITTEE: 11-0, 4/16/24
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Stern, Wahab
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
SUBJECT: Consumer privacy: sensitive personal information: neural data
SOURCE: NeuroRights Foundation
DIGEST:
This bill includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the California Consumer Privacy Act (CCPA).
ANALYSIS:
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- The categories of personal information it has collected about that consumer;
- The categories of sources from which the personal information is collected;
- The business or commercial purpose for collecting or selling personal information;
- The categories of third parties with whom the business shares personal information; and
- The specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
- Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
- The categories of personal information that the business collected about the consumer;
- The categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
- The categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
- Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (Civ. Code § 1798.120.)
- Prohibits a business from discriminating against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. (Civ. Code § 1798.125(a)(1).)
- Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
- Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Includes a consumer’s neural data in the CCPA’s definition of sensitive personal information.
- Defines the following terms:
- “Neural data” means information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.
- “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s central or peripheral nervous system for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
Background
The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020, election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CPRA also created a new category of “sensitive personal information” and afforded consumers enhanced rights with respect to that information, including the ability to restrict businesses’ use of that information. The emergence of consumer neurotechnologies such as neuromonitoring devices, cognitive training applications, neurostimulation devices, mental health apps, and so called “brain wearables” has raised concerns about whether more regulatory oversight is necessary. Specifically, issues of privacy, when devices can interact with your brain and nervous system, have been highlighted. Given the heightened sensitivity of neural data, this bill includes it within the definition of sensitive information, defining it as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.”
The bill is sponsored by the NeuroRights Foundation and supported by several Colorado state legislators. The bill is opposed by industry associations, including Technet.
Comments
The emergence of neurotechnologies Neurotechnologies have been described as the “next technology frontier” by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.[1] Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
Like with most advanced technologies, there are tremendous possibilities:
Neurotechnologies can provide insights into brain or nervous system activity, or can influence brain or nervous system function. Essentially, neurotechnologies have the potential to help neuroscientists gather information that might help uncover some of the secrets of the biology underlying the normal and pathological functioning of the human brain – arguably the most complex and least understood organ of the human body – as well as delivering practical therapeutic or rehabilitative solutions in the clinical care of neurological disorders to help ease the personal and socioeconomic burden of these conditions. Adopting a technology-based approach can also have benefits for research, allowing the use of more sensitive endpoints that will accelerate data gathering and evidence generation in clinical trials.[2]
The infinite applications are also being explored for consumer products: “Eventually, neurotechnologies could enable commercial devices, like phones, powered by mind control. Neurotechnologies could also potentially enable features like a thought-to-text writing function, or virtual and augmented reality devices assisted by brain control for purposes of entertainment.”[3] For example, a few years back, Facebook purchased a neurotechnology startup, as part of efforts to develop a wristband for controlling smartphones, computers and other digital devices without having to touch a screen or keyboard.[4]
With the emergence of these consumer neurotechnology devices comes not only concern that regulatory oversight is insufficient to, for example, assess efficacy claims, many are sounding alarms around the privacy implications:
A last bastion of privacy, our brains have remained inviolate, even as sensors now record our heartbeats, breaths, steps and sleep. All that is about to change. An avalanche of brain-tracking devices—earbuds, headphones, headbands, watches and even wearable tattoos—will soon enter the market, promising to transform our lives. And threatening to breach the refuge of our minds.
Tech titans Meta, Snap, Microsoft and Apple are already investing heavily in brain wearables. They aim to embed brain sensors into smart watches, earbuds, headsets and sleep aids. Integrating them into our everyday lives could revolutionize health care, enabling early diagnosis and personalized treatment of conditions such as depression, epilepsy and even cognitive decline. Brain sensors could improve our ability to meditate, focus and even communicate with a seamless technological telepathy—using the power of thoughts and emotion to drive our interaction with augmented reality (AR) and virtual reality (VR) headsets, or even type on virtual keyboards with our minds.
But brain wearables also pose very real risks to mental privacy, freedom of thought and self-determination. As these devices proliferate, they will generate vast amounts of neural data, creating an intimate window into our brain states, emotions and even memories. We need the individual power to shutter this new view into our inner selves.
Employers already seek out such data, tracking worker fatigue levels and offering brain wellness programs to mitigate stress, via platforms that give them unprecedented access to employees’ brains. Cognitive and emotional testing based on neuroscience is becoming a new job screening norm, revealing personality aspects that may have little to do with a job. In China, train conductors of the Beijing-Shanghai line, the busiest of its kind in the world, wear brain sensors throughout their work day. There are even reports of Chinese employees being sent home if their brain activity shows less than stellar brain metrics. As companies embrace brain wearables that can track employees’ attention, focus and even boredom, without safeguards in place, they could trample on employee’s mental privacy, eroding trust and well-being along with the dignity of work itself.[5]
Protecting our neural data. This bill responds to the privacy concerns raised by these neurotechnologies by including “neural data” into the definition of sensitive personal information for purposes of the CCPA. Neural data is defined as information that is generated by the measurement of the activity of an individual’s CNS or PNS that can be processed by, or with the assistance of, neurotechnology. “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s CNS or PNS for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
Author’s Statement. According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT: (Verified 5/14/23)
NeuroRights Foundation (sponsor)
Colorado State Representative Cathy Kipp
Colorado State Representative Matt Soper
Colorado State Senator Mark Baisley
Colorado State Senator Kevin Priola
1 Individual
OPPOSITION: (Verified 5/14/23)
California Chamber of Commerce
Computer & Communications Industry Association
Technet
ARGUMENTS IN SUPPORT: The NeuroRights Foundation, the sponsor of the bill, writes:
While the California Consumer Privacy Act (CCPA) has been instrumental in improving the standard for data protection, it doesn't specifically address neural data. As the wearable neurotechnology market grows, this oversight could lead to privacy violations and the misuse of neural data, highlighting the need for legislation to specifically address the unique challenges posed by advancements in neurotechnology.
SB 1223 bridges this gap by categorizing neural data as sensitive information under the CCPA and establishing clear definitions for neural data and neurotechnology, providing clarity and guidance for individuals and businesses.
ARGUMENTS IN OPPOSITION: The California Chamber of Commerce argues:
We have a concern about the breadth of technologies that could be included under the definitions of “neural data” and “neurotechnology” and have suggested amendments to tailor them to technologies that directly measure brain activity.
The fundamental challenge with the existing definitions is that they include references to the “peripheral nervous system” (“PNS”) – all nerves in parts of the body other than the brain and spinal cord. There are two problems with these references. First, information about activity of the PNS simply is not capable of revealing someone’s inner thoughts and mental processes, which this bill seeks to protect. Those result from activity of the brain, not the PNS. Many scientists argue that even information about brain activity does not and will not permit decoding complex thoughts, and recent research has described attempts to argue otherwise as alarmist.
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
5/15/24 15:28:05
**** END ****
Neurotechnologies: The Next Technology Frontier, IEEE Brain, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/. All internet citations are current as of May 9, 2024. ↑
Roongroj Bhidayasiri, The grand challenge at the frontiers of neurotechnology and its emerging clinical applications (January 17, 2024) Front Neurol, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10827995/pdf/fneur-15-1314477.pdf. ↑
See fn. 1. ↑
Queenie Wong & Scott Stein, Facebook buys startup working on technology that lets you control computers with your mind (September 23, 2019) CNET, https://www.cnet.com/science/facebook-buys-ctrl-labs-to-work-on-a-wristband-that-will-let-you-control-computers-with-your-mind/. ↑
Nita Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy (March 27, 2023) Scientific American, https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/. ↑
SENATE RULES COMMITTEE Office of Senate Floor Analyses (916) 651-1520 Fax: (916) 327-4478 | SB 1223 |
THIRD READING
Bill No: SB 1223
Author: Becker (D)
Amended: 3/18/24
Vote: 21
SENATE JUDICIARY COMMITTEE: 11-0, 4/16/24
AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Min, Niello, Stern, Wahab
SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8
SUBJECT: Consumer privacy: sensitive personal information: neural data
SOURCE: NeuroRights Foundation
DIGEST:
This bill includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the California Consumer Privacy Act (CCPA).
ANALYSIS:
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- The categories of personal information it has collected about that consumer;
- The categories of sources from which the personal information is collected;
- The business or commercial purpose for collecting or selling personal information;
- The categories of third parties with whom the business shares personal information; and
- The specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
- Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
- The categories of personal information that the business collected about the consumer;
- The categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
- The categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
- Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (Civ. Code § 1798.120.)
- Prohibits a business from discriminating against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. (Civ. Code § 1798.125(a)(1).)
- Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
- Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill:
- Includes a consumer’s neural data in the CCPA’s definition of sensitive personal information.
- Defines the following terms:
- “Neural data” means information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.
- “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s central or peripheral nervous system for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
Background
The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020, election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CPRA also created a new category of “sensitive personal information” and afforded consumers enhanced rights with respect to that information, including the ability to restrict businesses’ use of that information. The emergence of consumer neurotechnologies such as neuromonitoring devices, cognitive training applications, neurostimulation devices, mental health apps, and so called “brain wearables” has raised concerns about whether more regulatory oversight is necessary. Specifically, issues of privacy, when devices can interact with your brain and nervous system, have been highlighted. Given the heightened sensitivity of neural data, this bill includes it within the definition of sensitive information, defining it as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.”
The bill is sponsored by the NeuroRights Foundation and supported by several Colorado state legislators. The bill is opposed by industry associations, including Technet.
Comments
The emergence of neurotechnologies Neurotechnologies have been described as the “next technology frontier” by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.[1] Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
Like with most advanced technologies, there are tremendous possibilities:
Neurotechnologies can provide insights into brain or nervous system activity, or can influence brain or nervous system function. Essentially, neurotechnologies have the potential to help neuroscientists gather information that might help uncover some of the secrets of the biology underlying the normal and pathological functioning of the human brain – arguably the most complex and least understood organ of the human body – as well as delivering practical therapeutic or rehabilitative solutions in the clinical care of neurological disorders to help ease the personal and socioeconomic burden of these conditions. Adopting a technology-based approach can also have benefits for research, allowing the use of more sensitive endpoints that will accelerate data gathering and evidence generation in clinical trials.[2]
The infinite applications are also being explored for consumer products: “Eventually, neurotechnologies could enable commercial devices, like phones, powered by mind control. Neurotechnologies could also potentially enable features like a thought-to-text writing function, or virtual and augmented reality devices assisted by brain control for purposes of entertainment.”[3] For example, a few years back, Facebook purchased a neurotechnology startup, as part of efforts to develop a wristband for controlling smartphones, computers and other digital devices without having to touch a screen or keyboard.[4]
With the emergence of these consumer neurotechnology devices comes not only concern that regulatory oversight is insufficient to, for example, assess efficacy claims, many are sounding alarms around the privacy implications:
A last bastion of privacy, our brains have remained inviolate, even as sensors now record our heartbeats, breaths, steps and sleep. All that is about to change. An avalanche of brain-tracking devices—earbuds, headphones, headbands, watches and even wearable tattoos—will soon enter the market, promising to transform our lives. And threatening to breach the refuge of our minds.
Tech titans Meta, Snap, Microsoft and Apple are already investing heavily in brain wearables. They aim to embed brain sensors into smart watches, earbuds, headsets and sleep aids. Integrating them into our everyday lives could revolutionize health care, enabling early diagnosis and personalized treatment of conditions such as depression, epilepsy and even cognitive decline. Brain sensors could improve our ability to meditate, focus and even communicate with a seamless technological telepathy—using the power of thoughts and emotion to drive our interaction with augmented reality (AR) and virtual reality (VR) headsets, or even type on virtual keyboards with our minds.
But brain wearables also pose very real risks to mental privacy, freedom of thought and self-determination. As these devices proliferate, they will generate vast amounts of neural data, creating an intimate window into our brain states, emotions and even memories. We need the individual power to shutter this new view into our inner selves.
Employers already seek out such data, tracking worker fatigue levels and offering brain wellness programs to mitigate stress, via platforms that give them unprecedented access to employees’ brains. Cognitive and emotional testing based on neuroscience is becoming a new job screening norm, revealing personality aspects that may have little to do with a job. In China, train conductors of the Beijing-Shanghai line, the busiest of its kind in the world, wear brain sensors throughout their work day. There are even reports of Chinese employees being sent home if their brain activity shows less than stellar brain metrics. As companies embrace brain wearables that can track employees’ attention, focus and even boredom, without safeguards in place, they could trample on employee’s mental privacy, eroding trust and well-being along with the dignity of work itself.[5]
Protecting our neural data. This bill responds to the privacy concerns raised by these neurotechnologies by including “neural data” into the definition of sensitive personal information for purposes of the CCPA. Neural data is defined as information that is generated by the measurement of the activity of an individual’s CNS or PNS that can be processed by, or with the assistance of, neurotechnology. “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s CNS or PNS for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
Author’s Statement. According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No
SUPPORT: (Verified 5/14/23)
NeuroRights Foundation (sponsor)
Colorado State Representative Cathy Kipp
Colorado State Representative Matt Soper
Colorado State Senator Mark Baisley
Colorado State Senator Kevin Priola
OPPOSITION: (Verified 5/14/23)
California Chamber of Commerce
Computer & Communications Industry Association
Technet
ARGUMENTS IN SUPPORT: The NeuroRights Foundation, the sponsor of the bill, writes:
While the California Consumer Privacy Act (CCPA) has been instrumental in improving the standard for data protection, it doesn't specifically address neural data. As the wearable neurotechnology market grows, this oversight could lead to privacy violations and the misuse of neural data, highlighting the need for legislation to specifically address the unique challenges posed by advancements in neurotechnology.
SB 1223 bridges this gap by categorizing neural data as sensitive information under the CCPA and establishing clear definitions for neural data and neurotechnology, providing clarity and guidance for individuals and businesses.
ARGUMENTS IN OPPOSITION: The California Chamber of Commerce argues:
We have a concern about the breadth of technologies that could be included under the definitions of “neural data” and “neurotechnology” and have suggested amendments to tailor them to technologies that directly measure brain activity.
The fundamental challenge with the existing definitions is that they include references to the “peripheral nervous system” (“PNS”) – all nerves in parts of the body other than the brain and spinal cord. There are two problems with these references. First, information about activity of the PNS simply is not capable of revealing someone’s inner thoughts and mental processes, which this bill seeks to protect. Those result from activity of the brain, not the PNS. Many scientists argue that even information about brain activity does not and will not permit decoding complex thoughts, and recent research has described attempts to argue otherwise as alarmist.
Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113
5/14/24 15:06:52
**** END ****
Neurotechnologies: The Next Technology Frontier, IEEE Brain, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/. All internet citations are current as of May 9, 2024. ↑
Roongroj Bhidayasiri, The grand challenge at the frontiers of neurotechnology and its emerging clinical applications (January 17, 2024) Front Neurol, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10827995/pdf/fneur-15-1314477.pdf. ↑
See fn. 1. ↑
Queenie Wong & Scott Stein, Facebook buys startup working on technology that lets you control computers with your mind (September 23, 2019) CNET, https://www.cnet.com/science/facebook-buys-ctrl-labs-to-work-on-a-wristband-that-will-let-you-control-computers-with-your-mind/. ↑
Nita Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy (March 27, 2023) Scientific American, https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/. ↑
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: SB 1223 (Author:Becker)
Version: March 18, 2024
Hearing Date: April 16, 2024
Fiscal: Yes
Urgency: No
Consultant: CK
SUBJECT
Consumer privacy: sensitive personal information: neural data
DIGEST
This bill includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the California Consumer Privacy Act (CCPA).
EXECUTIVE SUMMARY
The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020, election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CPRA also created a new category of “sensitive personal information” and afforded consumers enhanced rights with respect to that information, including the ability to restrict businesses’ use of that information. The emergence of consumer neurotechnologies such as neuromonitoring devices, cognitive training applications,
neurostimulation devices, mental health apps, and so called “brain wearables” has raised concerns about whether more regulatory oversight is necessary. Specifically, issues of privacy, when devices can interact with your brain and nervous system, have been highlighted. Given the heightened sensitivity of neural data, this bill includes it within the definition of sensitive information, defining it as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.”
The bill is sponsored by the NeuroRights Foundation and supported by several Colorado state legislators. The bill is opposed by industry associations, including Technet.
PROPOSED CHANGES TO THE LAW
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- the categories of personal information it has collected about that consumer;
- the categories of sources from which the personal information is collected;
- the business or commercial purpose for collecting or selling personal information;
- the categories of third parties with whom the business shares personal information; and
- the specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
- Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
- the categories of personal information that the business collected about the consumer;
- the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
- the categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
- Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (Civ. Code § 1798.120.)
- Prohibits a business from discriminating against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. (Civ. Code § 1798.125(a)(1).)
- Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
- Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill includes personal information that reveals a consumer’s citizenship or immigration status in the CCPA’s definition of sensitive personal information.
COMMENTS
- California’s landmark privacy protection law
As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct. (Civ. Code § 1798.105(d).)
The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells personal information to third parties is required to notify consumers that this information may be sold and that they have the right to opt out of such sales. (Civ. Code § 1798.120(a).) The CPRA added a new category of information, sensitive information, which includes data such as precise geolocation and genetic information. Consumers are additionally empowered to limit businesses’ use of such information.
- The emergence of neurotechnologies
Neurotechnologies have been described as the “next technology frontier” by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.[1] Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
Like with most advanced technologies, there are tremendous possibilities:
Neurotechnologies can provide insights into brain or nervous system activity, or can influence brain or nervous system function. Essentially, neurotechnologies have the potential to help neuroscientists gather information that might help uncover some of the secrets of the biology underlying the normal and pathological functioning of the human brain – arguably the most complex and least understood organ of the human body – as well as delivering practical therapeutic or rehabilitative solutions in the clinical care of neurological disorders to help ease the personal and socioeconomic burden of these conditions. Adopting a technology-based approach can also have benefits for research, allowing the use of more sensitive endpoints that will accelerate data gathering and evidence generation in clinical trials.[2]
The infinite applications are also being explored for consumer products: “Eventually, neurotechnologies could enable commercial devices, like phones, powered by mind control. Neurotechnologies could also potentially enable features like a thought-to-text writing function, or virtual and augmented reality devices assisted by brain control for purposes of entertainment.”[3] For example, a few years back, Facebook purchased a neurotechnology startup, as part of efforts to develop a wristband for controlling smartphones, computers and other digital devices without having to touch a screen or keyboard.[4]
With the emergence of these consumer neurotechnology devices comes not only concern that regulatory oversight is insufficient to, for example, assess efficacy claims, many are sounding alarms around the privacy implications:
A last bastion of privacy, our brains have remained inviolate, even as sensors now record our heartbeats, breaths, steps and sleep. All that is about to change. An avalanche of brain-tracking devices—earbuds, headphones, headbands, watches and even wearable tattoos—will soon enter the market, promising to transform our lives. And threatening to breach the refuge of our minds.
Tech titans Meta, Snap, Microsoft and Apple are already investing heavily in brain wearables. They aim to embed brain sensors into smart watches, earbuds, headsets and sleep aids. Integrating them into our everyday lives could revolutionize health care, enabling early diagnosis and personalized treatment of conditions such as depression, epilepsy and even cognitive decline. Brain sensors could improve our ability to meditate, focus and even communicate with a seamless technological telepathy—using the power of thoughts and emotion to drive our interaction with augmented reality (AR) and virtual reality (VR) headsets, or even type on virtual keyboards with our minds.
But brain wearables also pose very real risks to mental privacy, freedom of thought and self-determination. As these devices proliferate, they will generate vast amounts of neural data, creating an intimate window into our brain states, emotions and even memories. We need the individual power to shutter this new view into our inner selves.
Employers already seek out such data, tracking worker fatigue levels and offering brain wellness programs to mitigate stress, via platforms that give them unprecedented access to employees’ brains. Cognitive and emotional testing based on neuroscience is becoming a new job screening norm, revealing personality aspects that may have little to do with a job. In China, train conductors of the Beijing-Shanghai line, the busiest of its kind in the world, wear brain sensors throughout their work day. There are even reports of Chinese employees being sent home if their brain activity shows less than stellar brain metrics. As companies embrace brain wearables that can track employees’ attention, focus and even boredom, without safeguards in place, they could trample on employee’s mental privacy, eroding trust and well-being along with the dignity of work itself.[5]
- Protecting our neural data
This bill responds to the privacy concerns raised by these neurotechnologies by including “neural data” into the definition of sensitive personal information for purposes of the CCPA. Neural data is defined as information that is generated by the measurement of the activity of an individual’s CNS or PNS that can be processed by, or with the assistance of, neurotechnology. “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s CNS or PNS for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
Industry groups in opposition, including the California Chamber of Commerce argue:
We have a concern about the breadth of technologies that could be included under the definitions of “neural data” and “neurotechnology” and have suggested amendments to tailor them to technologies that directly measure brain activity.
The fundamental challenge with the existing definitions is that they include references to the “peripheral nervous system” (“PNS”) – all nerves in parts of the body other than the brain and spinal cord. There are two problems with these references. First, information about activity of the PNS simply is not capable of revealing someone’s inner thoughts and mental processes, which this bill seeks to protect. Those result from activity of the brain, not the PNS. Many scientists argue that even information about brain activity does not and will not permit decoding complex thoughts, and recent research has described attempts to argue otherwise as alarmist.
- Furthering the purpose and intent of the CPRA
Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:
- consumers should know who is collecting their personal information;
- consumers should have control over how their personal information is used; and
- consumers should benefit from businesses’ use of their personal information.
Section 3 also includes a series of responsibilities that businesses should have. These include:
- businesses should specifically and clearly inform consumers about how they use personal information; and
- businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.
Section 3 also lays out various guiding principles about how the law should be implemented.
This bill provides stronger protections for this incredibly sensitive information. This allows for a fuller realization of the benefits intended by the law. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”
SUPPORT
NeuroRights Foundation (sponsor)
Colorado State Representative Cathy Kipp
Colorado State Representative Matt Soper
Colorado State Senator Mark Baisley
Colorado State Senator Kevin Priola
OPPOSITION
California Chamber of Commerce
Computer & Communications Industry Association
Technet
RELATED LEGISLATION
Pending Legislation:
AB 1824 (Valencia, 2024) provides that a business that receives personal information of a consumer due to a merger, acquisition, bankruptcy, or other transaction must comply with a consumer’s direction to the original business in terms of the handling of their personal information. AB 1824 is currently in the Assembly Appropriations Committee.
AB 2877 (Bauer-Kahan, 2024) requires members of the PPA board to have qualifications, experience, and skills in the area of consumer rights. AB 2877 is currently in the Assembly Privacy and Consumer Protection Committee.
AB 3048 (Lowenthal, 2024) requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information. AB 3048 is currently in the Assembly Appropriations Committee.
Prior Legislation:
AB 947 (Gabriel, Ch. 551, Stats. 2023) includes personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.
AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provides stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.
AB 1546 (Gabriel, 2023) would have extended the statute of limitations for actions brought by the Attorney General to enforce the CCPA to five years after the accrual of the cause of action. AB 1546 was held in the Senate Appropriations Committee.
AB 254 (Bauer-Kahan, Ch. 254, Stats. 2023) includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).
AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) includes mental health application information in the definition of “medical information” and the businesses that offer mental health digital services to consumers in the definition of a provider of health care for purposes of the CMIA.
AB 694 (Assembly Committee on Privacy and Consumer Protection, Ch. 525, Stats. 2021) made nonsubstantive and conforming changes to the CCPA to clean up the language amended in by the CPRA.
AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.
**************
Neurotechnologies: The Next Technology Frontier, IEEE Brain, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/. All internet citations are current as of April 9, 2024. ↑
Roongroj Bhidayasiri, The grand challenge at the frontiers of neurotechnology and its emerging clinical applications (January 17, 2024) Front Neurol, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10827995/pdf/fneur-15-1314477.pdf. ↑
See fn. 1. ↑
Queenie Wong & Scott Stein, Facebook buys startup working on technology that lets you control computers with your mind (September 23, 2019) CNET, https://www.cnet.com/science/facebook-buys-ctrl-labs-to-work-on-a-wristband-that-will-let-you-control-computers-with-your-mind/. ↑
Nita Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy (March 27, 2023) Scientific American, https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/. ↑
Senator Thomas Umberg, Chair
2023-2024 Regular Session
Bill No: SB 1223 (Author:Becker)
Version: March 18, 2024
Hearing Date: April 16, 2024
Fiscal: Yes
Urgency: No
Consultant: CK
SUBJECT
Consumer privacy: sensitive personal information: neural data
DIGEST
This bill includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the California Consumer Privacy Act (CCPA).
EXECUTIVE SUMMARY
The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020, election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).
The CPRA also created a new category of “sensitive personal information” and afforded consumers enhanced rights with respect to that information, including the ability to restrict businesses’ use of that information. The emergence of consumer neurotechnologies such as neuromonitoring devices, cognitive training applications,
neurostimulation devices, mental health apps, and so called “brain wearables” has raised concerns about whether more regulatory oversight is necessary. Specifically, issues of privacy, when devices can interact with your brain and nervous system, have been highlighted. Given the heightened sensitivity of neural data, this bill includes it within the definition of sensitive information, defining it as “information that is generated by the measurement of the activity of an individual’s central or peripheral nervous systems that can be processed by, or with the assistance of, neurotechnology.”
The bill is author-sponsored. No timely support has been received by the Committee. The bill is opposed by industry associations, including Technet.
PROPOSED CHANGES TO THE LAW
Existing law:
- Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
- Grants a consumer the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- the categories of personal information it has collected about that consumer;
- the categories of sources from which the personal information is collected;
- the business or commercial purpose for collecting or selling personal information;
- the categories of third parties with whom the business shares personal information; and
- the specific pieces of personal information it has collected about that consumer. (Civ. Code § 1798.110.)
- Provides consumers the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, disclose to the consumer the following:
- the categories of personal information that the business collected about the consumer;
- the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold; and
- the categories of personal information that the business disclosed about the consumer for a business purpose. (Civ. Code § 1798.115.)
- Provides a consumer the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold and that consumers have the right to opt out of the sale of their personal information. (Civ. Code § 1798.120.)
- Prohibits a business from discriminating against a consumer because the consumer exercised any of the consumer’s rights under the CCPA. (Civ. Code § 1798.125(a)(1).)
- Provides that a business need not comply with the CCPA to the extent it restricts the business’ ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
- Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
- Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
- Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
- Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
- Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)
This bill includes personal information that reveals a consumer’s citizenship or immigration status in the CCPA’s definition of sensitive personal information.
COMMENTS
- California’s landmark privacy protection law
As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct. (Civ. Code § 1798.105(d).)
The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells personal information to third parties is required to notify consumers that this information may be sold and that they have the right to opt out of such sales. (Civ. Code § 1798.120(a).) The CPRA added a new category of information, sensitive information, which includes data such as precise geolocation and genetic information. Consumers are additionally empowered to limit businesses’ use of such information.
- The emergence of neurotechnologies
Neurotechnologies have been described as the “next technology frontier” by the Institute of Electrical and Electronics Engineers (IEEE), the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity.[1] Neurotechnology describes the field of science and engineering in which the nervous system is interfaced with technical devices, it uses neural interfaces to read or write information into the central nervous system (CNS), the peripheral nervous system (PNS), or the autonomic nervous system (ANS). There are a number of methods to do this, both invasive and noninvasive.
Like with most advanced technologies, there are tremendous possibilities:
Neurotechnologies can provide insights into brain or nervous system activity, or can influence brain or nervous system function. Essentially, neurotechnologies have the potential to help neuroscientists gather information that might help uncover some of the secrets of the biology underlying the normal and pathological functioning of the human brain – arguably the most complex and least understood organ of the human body – as well as delivering practical therapeutic or rehabilitative solutions in the clinical care of neurological disorders to help ease the personal and socioeconomic burden of these conditions. Adopting a technology-based approach can also have benefits for research, allowing the use of more sensitive endpoints that will accelerate data gathering and evidence generation in clinical trials.[2]
The infinite applications are also being explored for consumer products: “Eventually, neurotechnologies could enable commercial devices, like phones, powered by mind control. Neurotechnologies could also potentially enable features like a thought-to-text writing function, or virtual and augmented reality devices assisted by brain control for purposes of entertainment.”[3] For example, a few years back, Facebook purchased a neurotechnology startup, as part of efforts to develop a wristband for controlling smartphones, computers and other digital devices without having to touch a screen or keyboard.[4]
With the emergence of these consumer neurotechnology devices comes not only concern that regulatory oversight is insufficient to, for example, assess efficacy claims, many are sounding alarms around the privacy implications:
A last bastion of privacy, our brains have remained inviolate, even as sensors now record our heartbeats, breaths, steps and sleep. All that is about to change. An avalanche of brain-tracking devices—earbuds, headphones, headbands, watches and even wearable tattoos—will soon enter the market, promising to transform our lives. And threatening to breach the refuge of our minds.
Tech titans Meta, Snap, Microsoft and Apple are already investing heavily in brain wearables. They aim to embed brain sensors into smart watches, earbuds, headsets and sleep aids. Integrating them into our everyday lives could revolutionize health care, enabling early diagnosis and personalized treatment of conditions such as depression, epilepsy and even cognitive decline. Brain sensors could improve our ability to meditate, focus and even communicate with a seamless technological telepathy—using the power of thoughts and emotion to drive our interaction with augmented reality (AR) and virtual reality (VR) headsets, or even type on virtual keyboards with our minds.
But brain wearables also pose very real risks to mental privacy, freedom of thought and self-determination. As these devices proliferate, they will generate vast amounts of neural data, creating an intimate window into our brain states, emotions and even memories. We need the individual power to shutter this new view into our inner selves.
Employers already seek out such data, tracking worker fatigue levels and offering brain wellness programs to mitigate stress, via platforms that give them unprecedented access to employees’ brains. Cognitive and emotional testing based on neuroscience is becoming a new job screening norm, revealing personality aspects that may have little to do with a job. In China, train conductors of the Beijing-Shanghai line, the busiest of its kind in the world, wear brain sensors throughout their work day. There are even reports of Chinese employees being sent home if their brain activity shows less than stellar brain metrics. As companies embrace brain wearables that can track employees’ attention, focus and even boredom, without safeguards in place, they could trample on employee’s mental privacy, eroding trust and well-being along with the dignity of work itself.[5]
- Protecting our neural data
This bill responds to the privacy concerns raised by these neurotechnologies by including “neural data” into the definition of sensitive personal information for purposes of the CCPA. Neural data is defined as information that is generated by the measurement of the activity of an individual’s CNS or PNS that can be processed by, or with the assistance of, neurotechnology. “Neurotechnology” means a device, instrument, or a set of devices or instruments, that allows a connection with a person’s CNS or PNS for various purposes, including, but not limited to, reading, recording, or modifying a person’s brain activity or the information obtained from a person’s brain activity.
According to the author:
The realm of science fiction has become our reality as corporations now possess the capability to gather and commercialize our neural data through consumer-facing neurotechnology. It's imperative that we establish robust safeguards to shield consumers' privacy. I fear a future where vast databases, housing millions of brain scans, may be utilized to gauge an individual's health or even unwillingly identify them.
We're engaged in a rapid race to keep pace with advancing neurotechnology. Consequently, California must initiate regulatory measures within this burgeoning industry.
Fortunately, the California Consumer Privacy Act (CCPA) furnishes a sturdy legal framework for privacy protection and consumer rights. Through the implementation of a few strategic amendments, such as those proposed in SB 1223, we can safeguard Californians’ neural data against predatory use.
Industry groups in opposition, including the California Chamber of Commerce argue:
We have a concern about the breadth of technologies that could be included under the definitions of “neural data” and “neurotechnology” and have suggested amendments to tailor them to technologies that directly measure brain activity.
The fundamental challenge with the existing definitions is that they include references to the “peripheral nervous system” (“PNS”) – all nerves in parts of the body other than the brain and spinal cord. There are two problems with these references. First, information about activity of the PNS simply is not capable of revealing someone’s inner thoughts and mental processes, which this bill seeks to protect. Those result from activity of the brain, not the PNS. Many scientists argue that even information about brain activity does not and will not permit decoding complex thoughts, and recent research has described attempts to argue otherwise as alarmist.
- Furthering the purpose and intent of the CPRA
Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:
- consumers should know who is collecting their personal information;
- consumers should have control over how their personal information is used; and
- consumers should benefit from businesses’ use of their personal information.
Section 3 also includes a series of responsibilities that businesses should have. These include:
- businesses should specifically and clearly inform consumers about how they use personal information; and
- businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.
Section 3 also lays out various guiding principles about how the law should be implemented.
This bill provides stronger protections for this incredibly sensitive information. This allows for a fuller realization of the benefits intended by the law. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”
SUPPORT
None received
OPPOSITION
California Chamber of Commerce
Computer & Communications Industry Association
Technet
RELATED LEGISLATION
Pending Legislation:
AB 1824 (Valencia, 2024) provides that a business that receives personal information of a consumer due to a merger, acquisition, bankruptcy, or other transaction must comply with a consumer’s direction to the original business in terms of the handling of their personal information. AB 1824 is currently in the Assembly Appropriations Committee.
AB 2877 (Bauer-Kahan, 2024) requires members of the PPA board to have qualifications, experience, and skills in the area of consumer rights. AB 2877 is currently in the Assembly Privacy and Consumer Protection Committee.
AB 3048 (Lowenthal, 2024) requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information. AB 3048 is currently in the Assembly Appropriations Committee.
Prior Legislation:
AB 947 (Gabriel, Ch. 551, Stats. 2023) includes personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.
AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provides stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.
AB 1546 (Gabriel, 2023) would have extended the statute of limitations for actions brought by the Attorney General to enforce the CCPA to five years after the accrual of the cause of action. AB 1546 was held in the Senate Appropriations Committee.
AB 254 (Bauer-Kahan, Ch. 254, Stats. 2023) includes “reproductive or sexual health application information” in the definition of “medical information” and the businesses that offer reproductive or sexual health digital services to consumers in the definition of a provider of health care for purposes of the Confidentiality of Medical Information Act (CMIA).
AB 2089 (Bauer-Kahan, Ch. 690, Stats. 2022) includes mental health application information in the definition of “medical information” and the businesses that offer mental health digital services to consumers in the definition of a provider of health care for purposes of the CMIA.
AB 694 (Assembly Committee on Privacy and Consumer Protection, Ch. 525, Stats. 2021) made nonsubstantive and conforming changes to the CCPA to clean up the language amended in by the CPRA.
AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.
**************
Neurotechnologies: The Next Technology Frontier, IEEE Brain, https://brain.ieee.org/topics/neurotechnologies-the-next-technology-frontier/. All internet citations are current as of April 9, 2024. ↑
Roongroj Bhidayasiri, The grand challenge at the frontiers of neurotechnology and its emerging clinical applications (January 17, 2024) Front Neurol, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10827995/pdf/fneur-15-1314477.pdf. ↑
See fn. 1. ↑
Queenie Wong & Scott Stein, Facebook buys startup working on technology that lets you control computers with your mind (September 23, 2019) CNET, https://www.cnet.com/science/facebook-buys-ctrl-labs-to-work-on-a-wristband-that-will-let-you-control-computers-with-your-mind/. ↑
Nita Farahany, Wearable Brain Devices Will Challenge Our Mental Privacy (March 27, 2023) Scientific American, https://www.scientificamerican.com/article/wearable-brain-devices-will-challenge-our-mental-privacy/. ↑
Discussed in Hearing
32SEC
Senate Floor
1MIN
Assembly Floor
35SEC
Assembly Floor
15MIN
Assembly Standing Committee on Privacy and Consumer Protection
4MIN
Senate Floor
16MIN
Senate Standing Committee on Judiciary
Bill Author
Bill Co-Author(s):