Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered.

This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.

This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.

Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered.

This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide that these provisions do not alter applicable law regarding use by a law enforcement agency, as defined, of personal information generated by an electronic monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.

This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.

Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specifies the damages and costs authorized to be recovered.

This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide exceptions that authorize specified that these provisions do not alter applicable law regarding use by a law enforcement officials to collect, use, or retain the agency, as defined, of personal information of specified individuals who are on parole, probation, or other types of release and are subject to generated by an electronic monitoring. monitoring device. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.

This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.

Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and not sold or shared. prohibits a person or business from selling or sharing this personal information. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specify specifies the damages and costs authorized to be recovered.

This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except under certain circumstances, including, among others, for the collection or use as necessary to perform the services or provide the goods requested. The bill would also provide exceptions that authorize specified law enforcement officials to collect, use, or retain the personal information of specified individuals who are on parole, probation, or other types of release and are subject to electronic monitoring. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.

This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would require those penalties to be awarded by the State Department of Public Health for grants to implement a program or to fund an existing program that provides and promotes medically accurate and comprehensive reproductive and sexual health education, as provided. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.

Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and not sold or shared. Existing law authorizes an aggrieved person or entity to institute and prosecute a civil action against a person or business for a violation of these provisions and specify damages and costs authorized to be recovered.

This bill would recast the above-described provisions, and instead prohibit the collection, use, disclosure, sale, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except collection or use as necessary to perform the services or provide the goods requested. The bill would authorize an aggrieved person to institute and prosecute a civil action against a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert for a violation of these provisions. The bill would also make other nonsubstantive changes.

This bill would, subject to specified exceptions, prohibit geofencing, or selling or sharing personal information with a third party to geofence, as defined, an entity that provides in-person health care services in California for specified purposes, and would prohibit the use of personal information obtained in violation of this provision. The bill would provide that violators are subject to an injunction and liable for a civil penalty assessed and recovered in a civil action brought by the Attorney General, and deposited in the California Reproductive Justice and Freedom Fund. The bill would also provide that a statement signed under penalty of perjury, as specified, that the personal information will not be used for selling or sharing personal information in violation of these geofencing provisions is prima facie evidence that the personal information was not sold or shared in violation of these geofencing provisions. By expanding the crime of perjury, this bill would impose a state-mandated local program.

Existing law, the Confidentiality of Medical Information Act (CMIA), generally prohibits a provider of health care, a health care service plan, or a contractor from disclosing medical information regarding a patient, enrollee, or subscriber without first obtaining an authorization, unless a specified exception applies. The CMIA prohibits a provider of health care, a health care service plan, a contractor, or an employer from releasing medical information that would identify an individual or related to an individual seeking or obtaining an abortion in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

This bill would, similar to the provisions of the CMIA, prohibit the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, in response to a subpoena or a request or to law enforcement if that subpoena, request, or the purpose of law enforcement for the medical information is based on, or for the purpose of enforcement of, either another states laws that interfere with a persons rights to choose or obtain an abortion or a foreign penal civil action.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that no reimbursement is required by this act for a specified reason.

Under the California Constitution, the state is prohibited from denying or interfering with an individuals reproductive freedom in their most intimate decisions, including their fundamental right to choose to have an abortion. Existing law, the Reproductive Privacy Act, prohibits the state from denying or interfering with a pregnant persons right to choose or obtain an abortion prior to viability of the fetus, or when the abortion is necessary to protect the life or health of the pregnant person.

Existing law prohibits a person or business, as defined, from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, as defined, except as necessary to perform the services or provide the goods requested and not sold or shared.

This bill would state the intent of the Legislature to enact legislation to make it unlawful to geofence an entity that provides in-person health care services and to prohibit health care providers from releasing medical research information related to an individual seeking or obtaining an abortion in response to a subpoena or request if that subpoena or request is based on another states laws that interfere with a persons rights under the Reproductive Privacy Act.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 45

Author:(Bauer-Kahan)

As Amended Ver:September 9, 2025

Majority vote

SUMMARY

This bill would prohibit geofencing near healthcare facilities and expand protections for personally identifiable data collected within them, covering both patients and visitors. Secondly, this bill would strengthen research privacy protections by preventing the release of personally identifiable information if the subpoena is issued under a law that conflicts with California′s legal standards.

Senate Amendments

Clarifies that this bill does not alter any applicable law regarding a law enforcement agency′s use of personal information, including geolocation information generated by an electronic monitoring device.

Clarifies that this bill does not prohibit geofencing activities conducted by a labor organization if the geofencing does not result in the labor union′s collection of names or personal information without the expressed consent of the individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing.

Further clarifies that if a third party vendor, such as a social media platform, is contracted to collect personal information on behalf of a labor or employee organization is prohibited from selling, using, or sharing the collected personal information for any purpose other than the activities describe above.

COMMENTS

1) Research Privacy. Currently, research data is protected under Certificates of Confidentiality (CoCs) only if the research is federally funded. These certificates, issued by agencies such as the National Institutes of Health (NIH) or the Centers for Disease Control and Prevention (CDC), are designed to safeguard identifiable, sensitive information collected during research. Privately funded research, however, does not automatically receive the same protections. Although such projects can apply for a CoC, approval is at the discretion of the issuing agency, a process that may be especially difficult under the current federal administration that has taken a more critical stance toward certain areas of research. Even when a CoC is granted, disclosure of protected information can still be required under specific federal, state, or local laws. As a result, the current framework for protecting research records could allow for compliance with subpoenas issued by other states, even when those subpoenas are based on laws that contradict California′s legal protections.

2) Geofencing. Geofencing is the practice of creating a virtual perimeter around a specific geographic area. These perimeters can range in size from entire states to a single business or building.^[1] Geofencing works by tracking the IP addresses of devices that enter the defined location. Data brokers can purchase this information and combine it with other consumer data to identify individuals and package the information for various uses. Some businesses use geofencing data to determine which consumers are near their locations, allowing them to send targeted coupons or advertisements to encourage in-store visits. On a more granular level, businesses can analyze movement patterns within a store to determine where customers spend the most time and tailor advertisements or store layouts accordingly.

In a healthcare setting, geofencing is often used to enhance patient safety. Some healthcare facilities use it to monitor who enters and exits, helping to prevent individuals with a history of violence from reentering the premises. Geofencing can also be employed to track patients with neurodegenerative conditions, such as Alzheimer′s disease, to ensure they remain within the facility and receive appropriate care.^[2] Additionally, hospitals may use geofencing to ensure that infants are transported only by authorized personnel, helping to prevent mismatches or abductions.^[3] While these applications offer clear benefits, they also raise concerns. The vast amount of data collected and the relative ease with which it can be accessed push this technology toward a more dystopian territory, especially when considering issues of privacy and surveillance.

Geofencing can become highly punitive when used to enforce laws like the Texas Heartbeat Act. For instance, an individual in Texas could geofence a healthcare facility in California that provides abortion services and track who enters and exits the premises. If they are able to identify a patient from Texas, this data could form the basis of a civil lawsuit under the law′s private right of action provision. That suit could not only endanger the patient, but also the doctor and any individual who ″aids or abets″ the patient in obtaining abortion care. This kind of surveillance represents a serious threat to privacy and bodily autonomy and directly undermines California′s constitutional protections to the right to privacy and the right to access abortion care.

This can become even more worrisome if extrajudicial means are used to obtain geofenced location data. Specifically, location data brokers collect billions of location data points linked to unique persistent identifiers and timestamps that could give detailed insights into people′s movements. This information is then repackaged and sold to their clients, who often use it to trace the movements of individuals to and from sensitive locations. These include medical facilities, places of religious worship, places used to infer an LGBTQ+ identification, domestic abuse shelters, substance use disorder treatment facilities, and homeless shelters. Further, data collected is not anonymized, it is possible to identify the exact identity of the mobile device owner.

Please see the policy committee analysis for a full analysis of this bill.

According to the Author

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states′ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services

Arguments in Support

University of California Office of the President writes in support:

Many UC researchers conduct survey- and interview-based research on people about their reproductive health experiences, including research specifically evaluating the effects of new state laws enacted since the Dobbs v. Jackson Supreme Court decision. This data can include information about contraception, abortion care and other individual care information. For example, the UCSF Advancing New Standards in Reproductive Health research program conducted a longitudinal study, known as the Turnaway Study, which examines the effects of unwanted pregnancies on women′s lives. Research assistants interviewed participants by phone over a period of 5 years, and nearly 8,000 interviews were conducted over the course of the project. The main finding of the Turnaway Study is that receiving an abortion does not harm the health and wellbeing of women, but in fact, being denied an abortion results in worse financial, health, and family outcomes. UCSF has published over 50 scientific papers in peer-reviewed journals using data from the Turnaway Study.

Generally, both state and federal laws protect against the disclosure of any medical information relating to seeking or obtaining an abortion that is collected in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. It is critically important that additional protections be in place to ensure that information shared by study participants in the context of a research study be fully protected from subpoena by out-of-state actors seeking to criminalize them for care they might have obtained that is legal in California. Without these protections, the risk to participant confidentiality might be too great, and it might not be possible to continue this kind of research.

AB 45 provides critical privacy protections for researchers, study participants, and patients such as those involved with the Turnaway Study. The research occurring across UC campuses is vital for improving public health, supporting informed decision-making, addressing health disparities and understanding the impact of the Dobbs decision. As a top-tier research institution and a leading health care provider, UC is committed to ensuring that this critical research continues. Protecting sensitive reproductive information in research records is not anticipated to have any fiscal impact on the state. These protections may make it more appealing for funders to support this type of research in California.

While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 protects research records from disclosure in response to a subpoena or other law enforcement request based on another state′s laws that interfere with a person′s right to obtain an abortion and prohibits geofencing an entity that provides in-person health care services.

For these reasons, we urge your support on AB 45.

Arguments in Opposition

The Association of National Advertisers writes:

On behalf of the advertising industry, we respectfully oppose AB 45, and we offer this letter to express our concerns about this legislation. We and the companies we represent, many of whom do substantial business in California, strongly believe consumers deserve meaningful privacy protections supported by reasonable laws and industry policies. However, as drafted, AB 45 would have an overbroad effect by impeding legitimate advertising to Californians if they are merely near a family planning center. The bill also raises First Amendment concerns by blocking advertising to medical professionals and others inside of entities that provide in-person health care services. Moreover, the bill would permit a private right of action for certain violations, creating the possibility of extensive monetary penalties for well-meaning companies who inadvertently violate the bill′s terms.

FISCAL COMMENTS

According to the Senate Appropriations Committee:

1. Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. By creating a new cause of action and authorizing a new civil penalty with statutory damages, this bill may lead to additional case filings that otherwise would not have been commenced and could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.
2. The Department of Justice (DOJ) reports that while the impact of AB 45 would not pose a significant impact to the DOJ, as numerous bills this session may result in no significant impact to the DOJ, should an aggregate of these bills chapter, the DOJ would submit a workload BCP for additional resources to process the increase to the DOJ workload.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 10-2-3

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks

NO: DeMaio, Macedo

ABS, ABST OR NV: Dixon, Patterson, Wilson

ASM JUDICIARY: 9-2-1

YES: Kalra, Bauer-Kahan, Bryan, Connolly, Harabedian, Pacheco, Papan, Stefani, Zbur

NO: Macedo, Sanchez

ABS, ABST OR NV: Dixon

ASM APPROPRIATIONS: 11-2-2

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

NO: Ta, Tangipa

ABS, ABST OR NV: Sanchez, Dixon

ASSEMBLY FLOOR: 63-11-5

YES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO: Castillo, DeMaio, Ellis, Flora, Gallagher, Hadwick, Lackey, Macedo, Sanchez, Ta, Tangipa

ABS, ABST OR NV: Chen, Dixon, Jeff Gonzalez, Hoover, Patterson

UPDATED

VERSION: September 9, 2025

CONSULTANT: John Bennett / P. & C.P. / (916) 319-2200 FN: 0002109

1. Rahul Awati, “geofencing”, TechTarget (December 2022), accessed at https://www.techtarget.com/whatis/definition/geofencing. ↑

2. Securitas Healthcare, “Location Tracking for Alzheimer’s and Dementia Residents”, (Feb. 17, 2022), accessed at https://www.securitashealthcare.com/blog/location-tracking-alzheimers-and-dementia-residents. ↑

3. Claire Swedberg, “Hybrid RTLS Solution Tracks Infants in Hospitals”, RFID Journals (Oct. 28, 2024), accessed at https://www.rfidjournal.com/news/hybrid-rtls-solution-tracks-infants-in-hospitals/222010/. ↑

 THIRD READING  

Bill No: AB 45

Author: Bauer-Kahan (D), et al.

Amended: 9/9/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-1, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello

NO VOTE RECORDED: Valladares

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/29/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto, Dahle

ASSEMBLY FLOOR: 63-11, 6/3/25 - See last page for vote

SUBJECT: Privacy: health data: location and research

SOURCE: University of California

DIGEST:

This bill strengthens existing law protecting health and location data privacy with regard to those seeking reproductive health services.

Senate Floor amendments of 9/5/25 provide a series of carve outs from the protections of the bill, including for the Department of Corrections and Rehabilitation and probation departments. narrow the scope of the bill by including a number of exemptions and indicate where collected civil penalties will be awarded.

Senate Floor amendments of 9/9/25 remove exemptions and instead clarify the impact of the bill on other relevant laws.

ANALYSIS:

Existing law:

1. Provides that all people are by nature free and independent and have inalienable rights including, among others, the right to privacy. (California Constitution (Cal. Const.), art. I, § 1.)
2. Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
3. Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
4. Provides that a person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information. (Civil Code (Civ. Code) § 1798.99.90.)
5. Authorizes an aggrieved person or entity, including a family planning center, to institute and prosecute a civil action against any person or business who violates the above provision for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. If the court finds for the petitioner, recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (Civ. Code § 1798.99.90.)
6. Establishes the Reproductive Privacy Act and provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions. (Health & Safety Code (Health & Saf. Code) § 123460 et. seq.)
7. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466.)
8. Provides that a law of another state that authorizes a person to bring a civil action against a person or entity who does any of the following is contrary to the public policy of this state:
   1. Receives or seeks an abortion;
   2. Performs or induces an abortion;
   3. Knowingly engages in conduct that aids or abets the performance or inducement of an abortion; or
   4. Attempts or intends to engage in the conduct described above. (Health & Saf. Code § 123467.5(a).)
9. Provides various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California. (Civ. Code § 56.109, Code of Civil Procedure (Code Civ. Proc.) §§ 2029.300, 2029.350, Family Code (Fam. Code) §§ 3421, 3424, 3427, 3428, 3453.5.)
10. Establishes the California Consumer Privacy Act (CCPA), as amended by Proposition 24 (2020), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)

This bill:

1. Prohibits a person from collecting, using, disclosing, selling, sharing, or retaining the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified.
2. Provides that it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Establishes that an aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this bill for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Prohibits a person from geofencing an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services.
   2. To collect personal information from a person seeking, receiving, or providing health care services.
   3. To send notifications to a person related to their personal information or health care services.
   4. To send advertisements to a person related to the person’s personal information or health care services.
5. Defines “geofence” as any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.
6. Prohibits the selling of personal information to, or sharing of personal information with, a third party for the use of such information to violate the above provision.
7. Establishes that any person that violates these geofencing provisions shall be subject to an injunction and liable for a civil penalty of $25,000 for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
8. Establishes that any civil penalty recovered and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund, as provided.
9. Permits any person that owns, operates, manages, or otherwise provides services to an in-person health care entity to geofence the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
10. Permits any person that provides reproductive health care services to utilize geofencing for the purpose of providing security services to protect patients.
11. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released in response to a subpoena or request if that subpoena or request is based on another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act.
12. Defines the relevant terms.
13. Provides that it does not prohibit geofencing activities conducted by a labor organization, as defined in Section 1117 of the Labor Code, or an employee organization, as defined in subdivision (a) of Section 3501 of, subdivision (a) of Section 3513 of, or subdivision (f) of Section 3562 of, the Government Code, if geofencing does not result in the labor union’s collection of names or personal information without the express consent of an individual and is for activities concerning workplace conditions, worker or patient safety, labor disputes, or organizing.
14. Clarifies that it shall not be construed to alter applicable law, including pursuant to Section 3010 of the Penal Code, regarding use by a law enforcement agency of personal information, including geolocation information, generated by an electronic monitoring device.
15. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited:
    1. Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
    2. Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

Background

Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022, the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion. As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. A growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.

California has enacted numerous laws to protect the right to gender-affirming care and the fundamental right to reproductive freedom, including laws prohibiting a person or business from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified. Concerns have been raised about new insidious tactics to target individuals exercising these rights. This bill responds by restricting the use of geofencing technology around specified health facilities and adding protections for research records related to those seeking specified health care services with exceptions.

This bill is sponsored by the University of California and is supported by various organizations, including Planned Parenthood and Attorney General Rob Bonta. The Association of National Advertisers is opposed. For a more thorough discussion, please see the Senate Judiciary Committee analysis of this bill.

Comments

According to the author:

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states’ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

The Contractors State License Board (CSLB) reports:

• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. By creating a new cause of action and authorizing a new civil penalty with statutory damages, this bill may lead to additional case filings that otherwise would not have been commenced and could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.
• The Department of Justice (DOJ) reports that while the impact of AB 45 would not pose a significant impact to the DOJ, as numerous bills this session may result in no significant impact to the DOJ, should an aggregate of these bills chapter, the DOJ would submit a workload BCP for additional resources to process the increase to the DOJ workload.

SUPPORT: (Verified 9/9/25)

University of California (Source)

American College of Obstetricians & Gynecologists - District IX

Attorney General Rob Bonta

California Civil Liberties Advocacy

California Hospital Association

California Medical Association

California Pan-Ethnic Health Network

California Women's Law Center

Essential Access Health

Planned Parenthood Affiliates of California

Reproductive Freedom for All California

OPPOSITION: (Verified 9/9/25)

Association of National Advertisers

ARGUMENTS IN SUPPORT: Planned Parenthood Affiliates of California writes:

Existing law protects against the disclosure of medical information related to an abortion in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. Given the personal nature of this data and the current federal political atmosphere, worrying about privacy protections and risking confidentiality of one’s personal information should not be a reason to cease research or participation in critical women’s health studies.

Additionally, the same concerns extend to personal privacy through geofencing, which tracks and uses an individual’s location data to trigger a response when in a specific place. Geolocation data has been used to target and spread misinformation about abortion, which can be harmful to patients. For example, in Massachusetts, anti-abortion groups targeted the area around reproductive health clinics with pop-up ads promoting “abortion alternatives.”

AB 45 fills gaps in privacy protections for health research records and prohibits geofencing around health centers. These changes proactively address privacy concerns to protect personal health information from misuse or abuse.

ARGUMENTS IN OPPOSITION: The Association of National Advertisers writes:

On behalf of the advertising industry, we respectfully oppose AB 45, and we offer this letter to express our concerns about this legislation. We and the companies we represent, many of whom do substantial business in California, strongly believe consumers deserve meaningful privacy protections supported by reasonable laws and industry policies. However, as drafted, AB 45 would have an overbroad effect by impeding legitimate advertising to Californians if they are merely near a family planning center. The bill also raises First Amendment concerns by blocking advertising to medical professionals and others inside of entities that provide in-person health care services. Moreover, the bill would permit a private right of action for certain violations, creating the possibility of extensive monetary penalties for well-meaning companies who inadvertently violate the bill’s terms.

ASSEMBLY FLOOR: 63-11, 6/3/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NOES: Castillo, DeMaio, Ellis, Flora, Gallagher, Hadwick, Lackey, Macedo, Sanchez, Ta, Tangipa

NO VOTE RECORDED: Chen, Dixon, Jeff Gonzalez, Hoover, Patterson

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/11/25 10:08:39

**** END ****

 THIRD READING  

Bill No: AB 45

Author: Bauer-Kahan (D), et al.

Amended: 9/5/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-1, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello

NO VOTE RECORDED: Valladares

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/29/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto, Dahle

ASSEMBLY FLOOR: 63-11, 6/3/25 - See last page for vote

SUBJECT: Privacy: health data: location and research

SOURCE: University of California

DIGEST:

This bill strengthens existing law protecting health and location data privacy with regard to those seeking reproductive health services.

Senate Floor amendments of 9/5/25 provide a series of carve outs from the protections of the bill, including for the Department of Corrections and Rehabilitation and probation departments. narrow the scope of the bill by including a number of exemptions and indicate where collected civil penalties will be awarded.

ANALYSIS:

Existing law:

1. Provides that all people are by nature free and independent and have inalienable rights including, among others, the right to privacy. (California Constitution (Cal. Const.), art. I, § 1.)
2. Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
3. Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
4. Provides that a person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information. (Civil Code (Civ. Code) § 1798.99.90.)
5. Authorizes an aggrieved person or entity, including a family planning center, to institute and prosecute a civil action against any person or business who violates the above provision for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. If the court finds for the petitioner, recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (Civ. Code § 1798.99.90.)
6. Establishes the Reproductive Privacy Act and provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions. (Health & Safety Code (Health & Saf. Code) § 123460 et. seq.)
7. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466.)
8. Provides that a law of another state that authorizes a person to bring a civil action against a person or entity who does any of the following is contrary to the public policy of this state:
   1. Receives or seeks an abortion;
   2. Performs or induces an abortion;
   3. Knowingly engages in conduct that aids or abets the performance or inducement of an abortion; or
   4. Attempts or intends to engage in the conduct described above. (Health & Saf. Code § 123467.5(a).)
9. Provides various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California. (Civ. Code § 56.109, Code of Civil Procedure (Code Civ. Proc.) §§ 2029.300, 2029.350, Family Code (Fam. Code) §§ 3421, 3424, 3427, 3428, 3453.5.)
10. Establishes the California Consumer Privacy Act (CCPA), as amended by Proposition 24 (2020), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)

This bill:

1. Prohibits a person from collecting, using, disclosing, selling, sharing, or retaining the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified. It includes a series of carve outs for activities carried out by specified entities, including labor organizations, sheriffs, and probation departments.
2. Provides that it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Establishes that an aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this bill for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Prohibits a person from geofencing an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services.
   2. To collect personal information from a person seeking, receiving, or providing health care services.
   3. To send notifications to a person related to their personal information or health care services.
   4. To send advertisements to a person related to the person’s personal information or health care services.
5. Defines “geofence” as any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.
6. Prohibits the selling of personal information to, or sharing of personal information with, a third party for the use of such information to violate the above provision.
7. Establishes that any person that violates these geofencing provisions shall be subject to an injunction and liable for a civil penalty of $25,000 for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
8. Establishes that any civil penalty recovered and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund, as provided.
9. Permits any person that owns, operates, manages, or otherwise provides services to an in-person health care entity to geofence the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
10. Permits any person that provides reproductive health care services to utilize geofencing for the purpose of providing security services to protect patients.
11. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released in response to a subpoena or request if that subpoena or request is based on another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act.
12. Defines the relevant terms.
13. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited:
    1. Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
    2. Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

Background

Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022, the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion. As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. A growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.

California has enacted numerous laws to protect the right to gender-affirming care and the fundamental right to reproductive freedom, including laws prohibiting a person or business from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified. Concerns have been raised about new insidious tactics to target individuals exercising these rights. This bill responds by restricting the use of geofencing technology around specified health facilities and adding protections for research records related to those seeking specified health care services with numerous exceptions.

This bill is sponsored by the University of California and is supported by various organizations, including Planned Parenthood and Attorney General Rob Bonta. The Association of National Advertisers is opposed. For a more thorough discussion, please see the Senate Judiciary Committee analysis of this bill.

Comments

According to the author:

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states’ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

The Contractors State License Board (CSLB) reports:

• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. By creating a new cause of action and authorizing a new civil penalty with statutory damages, this bill may lead to additional case filings that otherwise would not have been commenced and could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.
• The Department of Justice (DOJ) reports that while the impact of AB 45 would not pose a significant impact to the DOJ, as numerous bills this session may result in no significant impact to the DOJ, should an aggregate of these bills chapter, the DOJ would submit a workload BCP for additional resources to process the increase to the DOJ workload.

SUPPORT: (Verified 9/8/25)

University of California (Source)

American College of Obstetricians & Gynecologists - District IX

Attorney General Rob Bonta

California Civil Liberties Advocacy

California Hospital Association

California Medical Association

California Pan-Ethnic Health Network

California Women's Law Center

Essential Access Health

Planned Parenthood Affiliates of California

Reproductive Freedom for All California

OPPOSITION: (Verified 9/8/25)

Association of National Advertisers

ARGUMENTS IN SUPPORT: Planned Parenthood Affiliates of California writes:

Existing law protects against the disclosure of medical information related to an abortion in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. Given the personal nature of this data and the current federal political atmosphere, worrying about privacy protections and risking confidentiality of one’s personal information should not be a reason to cease research or participation in critical women’s health studies.

Additionally, the same concerns extend to personal privacy through geofencing, which tracks and uses an individual’s location data to trigger a response when in a specific place. Geolocation data has been used to target and spread misinformation about abortion, which can be harmful to patients. For example, in Massachusetts, anti-abortion groups targeted the area around reproductive health clinics with pop-up ads promoting “abortion alternatives.”

AB 45 fills gaps in privacy protections for health research records and prohibits geofencing around health centers. These changes proactively address privacy concerns to protect personal health information from misuse or abuse.

ARGUMENTS IN OPPOSITION: The Association of National Advertisers writes:

On behalf of the advertising industry, we respectfully oppose AB 45, and we offer this letter to express our concerns about this legislation. We and the companies we represent, many of whom do substantial business in California, strongly believe consumers deserve meaningful privacy protections supported by reasonable laws and industry policies. However, as drafted, AB 45 would have an overbroad effect by impeding legitimate advertising to Californians if they are merely near a family planning center. The bill also raises First Amendment concerns by blocking advertising to medical professionals and others inside of entities that provide in-person health care services. Moreover, the bill would permit a private right of action for certain violations, creating the possibility of extensive monetary penalties for well-meaning companies who inadvertently violate the bill’s terms.

ASSEMBLY FLOOR: 63-11, 6/3/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NOES: Castillo, DeMaio, Ellis, Flora, Gallagher, Hadwick, Lackey, Macedo, Sanchez, Ta, Tangipa

NO VOTE RECORDED: Chen, Dixon, Jeff Gonzalez, Hoover, Patterson

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/9/25 10:10:00

**** END ****

 THIRD READING  

Bill No: AB 45

Author: Bauer-Kahan (D), et al.

Amended: 4/9/25 in Assembly

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-1, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NOES: Niello

NO VOTE RECORDED: Valladares

SENATE APPROPRIATIONS COMMITTEE: 5-2, 8/29/25

AYES: Caballero, Cabaldon, Grayson, Richardson, Wahab

NOES: Seyarto, Dahle

ASSEMBLY FLOOR: 63-11, 6/3/25 - See last page for vote

SUBJECT: Privacy: health data: location and research

SOURCE: University of California

DIGEST:

This bill strengthens existing law protecting health and location data privacy with regard to those seeking reproductive health services.

ANALYSIS:

Existing law:

1. Provides that all people are by nature free and independent and have inalienable rights including, among others, the right to privacy. (California Constitution (Cal. Const.), art. I, § 1.)
2. Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
3. Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
4. Provides that a person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information. (Civil Code (Civ. Code) § 1798.99.90.)
5. Authorizes an aggrieved person or entity, including a family planning center, to institute and prosecute a civil action against any person or business who violates the above provision for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. If the court finds for the petitioner, recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (Civ. Code § 1798.99.90.)
6. Establishes the Reproductive Privacy Act and provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions. (Health & Safety Code (Health & Saf. Code) § 123460 et. seq.)
7. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466.)
8. Provides that a law of another state that authorizes a person to bring a civil action against a person or entity who does any of the following is contrary to the public policy of this state:
   1. Receives or seeks an abortion;
   2. Performs or induces an abortion;
   3. Knowingly engages in conduct that aids or abets the performance or inducement of an abortion; or
   4. Attempts or intends to engage in the conduct described above. (Health & Saf. Code § 123467.5(a).)
9. Provides various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California. (Civ. Code § 56.109, Code of Civil Procedure (Code Civ. Proc.) §§ 2029.300, 2029.350, Family Code (Fam. Code) §§ 3421, 3424, 3427, 3428, 3453.5.)
10. Establishes the California Consumer Privacy Act (CCPA), as amended by Proposition 24 (2020), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)

This bill:

1. Prohibits a person from collecting, using, disclosing, selling, sharing, or retaining the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified.
2. Provides that it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Establishes that an aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this bill for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Prohibits a person from geofencing an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services.
   2. To collect personal information from a person seeking, receiving, or providing health care services.
   3. To send notifications to a person related to their personal information or health care services.
   4. To send advertisements to a person related to the person’s personal information or health care services.
5. Defines “geofence” as any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.
6. Prohibits the selling of personal information to, or sharing of personal information with, a third party for the use of such information to violate the above provision.
7. Establishes that any person that violates these geofencing provisions shall be subject to an injunction and liable for a civil penalty of $25,000 for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
8. Establishes that any civil penalty recovered and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund.
9. Permits any person that owns, operates, manages, or otherwise provides services to an in-person health care entity to geofence the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
10. Permits any person that provides reproductive health care services to utilize geofencing for the purpose of providing security services to protect patients.
11. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released in response to a subpoena or request if that subpoena or request is based on another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act.
12. Defines the relevant terms.
13. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited:
    1. Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
    2. Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

Background

Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022, the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion. As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. A growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.

California has enacted numerous laws to protect the right to gender-affirming care and the fundamental right to reproductive freedom, including laws prohibiting a person or business from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified. Concerns have been raised about new insidious tactics to target individuals exercising these rights. This bill responds by restricting the use of geofencing technology around specified health facilities and adding protections for research records related to those seeking specified health care services.

This bill is sponsored by the University of California and is supported by various organizations, including Planned Parenthood and Attorney General Rob Bonta. The Association of National Advertisers is opposed. For a more thorough discussion, please see the Senate Judiciary Committee analysis of this bill.

Comments

According to the author:

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states’ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: Yes

According to the Senate Appropriations Committee:

The Contractors State License Board (CSLB) reports:

• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. By creating a new cause of action and authorizing a new civil penalty with statutory damages, this bill may lead to additional case filings that otherwise would not have been commenced and could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.
• The Department of Justice (DOJ) reports that while the impact of AB 45 would not pose a significant impact to the DOJ, as numerous bills this session may result in no significant impact to the DOJ, should an aggregate of these bills chapter, the DOJ would submit a workload BCP for additional resources to process the increase to the DOJ workload.

SUPPORT: (Verified 8/29/25)

University of California (Source)

American College of Obstetricians & Gynecologists - District IX

Attorney General Rob Bonta

California Civil Liberties Advocacy

California Hospital Association

California Medical Association

California Pan-Ethnic Health Network

California Women's Law Center

Essential Access Health

Planned Parenthood Affiliates of California

Reproductive Freedom for All California

OPPOSITION: (Verified 8/29/25)

Association of National Advertisers

ARGUMENTS IN SUPPORT: Planned Parenthood Affiliates of California writes:

Existing law protects against the disclosure of medical information related to an abortion in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. Given the personal nature of this data and the current federal political atmosphere, worrying about privacy protections and risking confidentiality of one’s personal information should not be a reason to cease research or participation in critical women’s health studies.

Additionally, the same concerns extend to personal privacy through geofencing, which tracks and uses an individual’s location data to trigger a response when in a specific place. Geolocation data has been used to target and spread misinformation about abortion, which can be harmful to patients. For example, in Massachusetts, anti-abortion groups targeted the area around reproductive health clinics with pop-up ads promoting “abortion alternatives.”

AB 45 fills gaps in privacy protections for health research records and prohibits geofencing around health centers. These changes proactively address privacy concerns to protect personal health information from misuse or abuse.

ARGUMENTS IN OPPOSITION: The Association of National Advertisers writes:

On behalf of the advertising industry, we respectfully oppose AB 45, and we offer this letter to express our concerns about this legislation. We and the companies we represent, many of whom do substantial business in California, strongly believe consumers deserve meaningful privacy protections supported by reasonable laws and industry policies. However, as drafted, AB 45 would have an overbroad effect by impeding legitimate advertising to Californians if they are merely near a family planning center. The bill also raises First Amendment concerns by blocking advertising to medical professionals and others inside of entities that provide in-person health care services. Moreover, the bill would permit a private right of action for certain violations, creating the possibility of extensive monetary penalties for well-meaning companies who inadvertently violate the bill’s terms.

ASSEMBLY FLOOR: 63-11, 6/3/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Davies, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NOES: Castillo, DeMaio, Ellis, Flora, Gallagher, Hadwick, Lackey, Macedo, Sanchez, Ta, Tangipa

NO VOTE RECORDED: Chen, Dixon, Jeff Gonzalez, Hoover, Patterson

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/29/25 20:24:11

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

AB 45 (Bauer-Kahan) - Privacy: health data: location and research

Bill Summary:

AB 45 prohibits the collection, use, and disclosure of specified personal data relating to the provision of reproductive and other health services.

Fiscal Impact:

• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. By creating a new cause of action and authorizing a new civil penalty with statutory damages, this bill may lead to additional case filings that otherwise would not have been commenced and could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. This is a conservative estimate, based on the hourly rate of court personnel including at minimum the judge, clerk, bailiff, court reporter, jury administrator, administrative staff, and jury per-diems. If court days exceed 10, costs to the trial courts could reach hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.
  
• The Department of Justice (DOJ) reports that while the impact of AB 45 would not pose a significant impact to the DOJ, as numerous bills this session may result in no significant impact to the DOJ, should an aggregate of these bills chapter, the DOJ would submit a workload BCP for additional resources to process the increase to the DOJ workload.

Background:

A geofence is a virtually-designated space around a geographic feature or landmark. Geofencing technology uses a person’s location data to determine when they enter and leave a particular geofence. This technology was originally developed by retailers to send targeted ads to consumers who visit their stores. However, especially since 2022, when the U.S. Supreme Court overturned the legal right to obtain an abortion, geofencing has been used to identify and target people who seek or use reproductive health care services. For example, a person’s cell phone location data can be used to tell when they approached a Planned Parenthood, how long they stayed there, and when they left. This data could be used to identify and prosecute someone who came to California to have an abortion because doing so is illegal in their home state.

Proposed Law:

• Prohibits the collection, use, disclosure, sale, sharing, or retention of the personal information of a person who is physically located at or near a family planning center, as defined, except by a health care provider, health care service plan, or contractor.
• Allows collection and use of a person's data described above, as necessary to perform the services or provide the goods requested by the person.
• Allows an aggrieved person or entity, including a family planning center, to bring a civil action against any person who violates this prohibition within three years of discovery of the violation.
• Prohibits, except as specified, the geofencing of an entity that provides in-person health care services in California for specified purposes, including to identify or track a person seeking or receiving health care services, to collect such a person's personal information, or to send notifications or advertisements to a person, and prohibits any entity from selling or sharing personal information with a third party for such a purpose.
• Authorizes the Attorney General to bring a civil action to enforce a violation of, and specifies a person who violates the prohibition is subject to an injunction and civil penalty of $25,000.
• Prohibits release of specified personally identifying research records in response to a subpoena or request, or to law enforcement, if the inquiry is based on another state's laws that interfere with a person's rights under the California Reproductive Privacy Act, or based on a foreign penal civil action

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2025-2026 Regular Session

Bill No: AB 45 (Author:Bauer-Kahan)

Version: April 9, 2025

Hearing Date: July 15, 2025

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Privacy: health data: location and research

DIGEST

This bill strengthens existing law protecting health and location data privacy with regard to those seeking reproductive health services.

EXECUTIVE SUMMARY

Since the 1973 holding in Roe v. Wade, the U.S. Supreme Court has continuously held that it is a constitutional right to access abortion before fetal viability. However, on June 24, 2022, the Court voted 6-3 to overturn the holding in Roe and found that there is no federal constitutional right to an abortion. As a result of the Dobbs decision, people in roughly half the country may lose access to abortion services or have them severely restricted. A growing number of states have been passing laws putting residents who seek essential gender-affirming care at risk of being prosecuted. States are attempting to classify the provision and seeking of gender-affirming health care as a crime warranting prison time and are threatening parents with criminal penalties if they attempt to travel to another state in order to secure life-saving gender-affirming care for their child.

California has enacted numerous laws to protect the right to gender-affirming care and the fundamental right to reproductive freedom, including laws prohibiting a person or business from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified. Concerns have been raised about new insidious tactics to target individuals exercising these rights. This bill responds by restricting the use of geofencing technology around specified health facilities and adding protections for research records related to those seeking specified health care services.

This bill is sponsored by the University of California and is supported by various organizations, including Planned Parenthood and Attorney General Rob Bonta. The Association of National Advertisers is opposed.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Provides that all people are by nature free and independent and have inalienable rights including, among others, the right to privacy. (Cal. Const., art. I, § 1.)
2. Prohibits the state from denying or interfering with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
3. Holds that the state constitution’s express right to privacy extends to an individual’s decision about whether or not to have an abortion. (People v. Belous (1969) 71 Cal.2d 954.)
4. Provides that a person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information. (Civ. Code § 1798.99.90.)
5. Authorizes an aggrieved person or entity, including a family planning center, to institute and prosecute a civil action against any person or business who violates the above provision for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation. If the court finds for the petitioner, recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation. (Civ. Code § 1798.99.90.)
6. Establishes the Reproductive Privacy Act and provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions. (Health & Saf. Code § 123460 et. seq.)
7. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Health & Saf. Code § 123466.)
8. Provides that a law of another state that authorizes a person to bring a civil action against a person or entity who does any of the following is contrary to the public policy of this state:
   1. receives or seeks an abortion;
   2. performs or induces an abortion;
   3. knowingly engages in conduct that aids or abets the performance or inducement of an abortion; or
   4. attempts or intends to engage in the conduct described above. (Health & Saf. Code § 123467.5(a).)
9. Provides various safeguards against the enforcement of other states’ laws that purport to penalize individuals from obtaining gender-affirming care that is legal in California. (Civ. Code § 56.109, Code Civ. Proc. §§ 2029.300, 2029.350, Fam. Code §§ 3421, 3424, 3427, 3428, 3453.5.)
10. Establishes the California Consumer Privacy Act (CCPA), as amended by Proposition 24 (2020), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)

This bill:

1. Prohibits a person from collecting, using, disclosing, selling, sharing, or retaining the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified.
2. Provides that it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Establishes that an aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this bill for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Prohibits a person from geofencing an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services.
   2. To collect personal information from a person seeking, receiving, or providing health care services.
   3. To send notifications to a person related to their personal information or health care services.
   4. To send advertisements to a person related to the person’s personal information or health care services.
5. Defines “geofence” as any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation” as defined in subdivision (w) of Section 1798.140.
6. Prohibits the selling of personal information to, or sharing of personal information with, a third party for the use of such information to violate the above provision.
7. Establishes that any person that violates these geofencing provisions shall be subject to an injunction and liable for a civil penalty of $25,000 for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
8. Establishes that any civil penalty recovered and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund.
9. Permits any person that owns, operates, manages, or otherwise provides services to an in-person health care entity to geofence the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
10. Permits any person that provides reproductive health care services to utilize geofencing for the purpose of providing security services to protect patients.
11. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released in response to a subpoena or request if that subpoena or request is based on another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act.
12. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited:
    1. Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
    2. Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.
13. Defines the relevant terms.

COMMENTS

1. Post-Dobbs access to reproductive healthcare is being restricted across the nation

Roe v. Wade (1973) 410 U.S. 113, was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision whether to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated U.S. Supreme Court decisions and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022, the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe.^[1] The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability.^[2] The majority opinion upholds the Mississippi law finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.^[3]

Currently, most states have limitations on access to abortion with over one third enacting total, or near total, bans.

The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when and if to have children and prevented the criminalization of having an abortion or providing an abortion.

1. Location information: protecting reproductive rights in California

Given the increasingly hostile landscape to accessing reproductive rights in this country and the criminalization of seeking attendant health care services in some states, California has responded with a swath of laws to protect these rights in California. This effort includes laws strengthening privacy protections for reproductive healthcare data, limiting cooperation with out-of-state investigations, and creating legal shields for patients and providers. However, the patchwork of state laws creates an evolving and complex legal landscape that continues to affect people across state lines.

The importance of privacy, especially with respect to location information, has never been more urgent. Precise geolocation information can expose intimate details of individuals’ lives, revealing where they live, work, worship, seek medical care, and spend their personal time. This information can uncover sensitive details about political affiliations, religious beliefs, health conditions, and personal relationships. Unlike other forms of data, location information is continuously generated and can be tracked in real-time, creating comprehensive surveillance profiles.

Specifically for reproductive rights, location information falling into the wrong hands can subject an individual to legal liability and even criminal prosecution in other states. It is not a hypothetical that individuals can also have their locations tracked and be subject to harassment or targeted advertising based on their proximity to specific health care facilities. Short of that, simply the fear of surveillance can deter many from seeking basic reproductive healthcare.

Relevant here, SB 345 (Skinner, Ch. 260, Stats. 2023), among other things, sought to protect the health and privacy rights of those seeking reproductive health care services. That law prohibits a person or business from collecting, using, disclosing, or retaining the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business cannot sell or share this personal information. The law provides an enforcement action for any violations.

1. Bolstering protections for reproductive freedom

Despite the existing protections, the collection, use, and sharing of sensitive location information regarding reproductive health care remains a problem:

Reproductive healthcare facilities are a frequent target for geofencing and geolocation tracking, which allows anyone to easily purchase records of women’s locations and determine when they’ve been near a reproductive health center. Geofencing uses locational data to establish virtual “fences” around a designated geographic area, such as a store or an arena; when an individual enters or exits the geofence, an action is automatically triggered (such as an advertisement being loaded on a website). Geofencing is enabled by tracking geolocation data—precise information collected from an individual's location from GPS, WiFi, or cellular data. Though geofencing and geolocation tracking are interconnected, data brokers can use each method differently to surveil, commodify, and exploit women’s locations.

Geofencing’s preset boundaries allow data brokers to make dangerous assumptions about women based on their locations within a particular geofence, leading to invasive ads and digital harassment. For example, Andrea Campbell, Massachusetts Attorney General, said that the data broker Copley Advertising was contracted by Bethany Christian Services, an adoption agency, and RealOptions, a California-based network of crisis pregnancy centers in 2015 to “direct targeted advertisements—using geofencing—to ‘abortion-minded women’ sitting in waiting rooms at health clinics.” Earlier this year, Sen. Wyden (D-OR) disclosed in a letter that Near Intelligence, a data broker, used “mobile phone location data to send targeted misinformation to people who visited any of 600 reproductive health clinics in 48 states.”^[4]

This bill responds by making it unlawful to geofence an entity that provides in-person health care services in California for any of the following purposes:

• To identify or track a person seeking, receiving, or providing health care services.
• To collect personal information from a person seeking, receiving, or providing health care services.
• To send notifications to a person related to their personal information or health care services.
• To send advertisements to a person related to the person’s personal information or health care services.

The bill also makes it unlawful to sell personal information to, or share personal information with, a third party for the use of such information to violate this prohibition on geofencing.

To ensure comprehensive protection, the bill further makes it unlawful to use personal information obtained in violation of these provisions. Violations are subject to civil penalties and other relief in actions brought by the Attorney General.

The bill includes a number of exceptions, including compliance with a lawfully executed search warrant or a lawful subpoena issued pursuant to existing California law. The relevant health facilities and providers can continue to use geofencing technology for security and monitoring purposes.

1. Protecting research records

According to the University of California, the sponsor of the bill:

Many UC researchers conduct survey- and interview-based research on people about their reproductive health experiences, including research specifically evaluating the effects of new state laws enacted since the Dobbs v. Jackson Supreme Court decision. This data can include information about contraception, abortion care and other individual care information. For example, the UCSF Advancing New Standards in Reproductive Health research program conducted a longitudinal study, known as the Turnaway Study, which examines the effects of unwanted pregnancies on women’s lives. Research assistants interviewed participants by phone over a period of 5 years, and nearly 8,000 interviews were conducted over the course of the project. The main finding of the Turnaway Study is that receiving an abortion does not harm the health and wellbeing of women, but in fact, being denied an abortion results in worse financial, health, and family outcomes. UCSF has published over 50 scientific papers in peer-reviewed journals using data from the Turnaway Study.

Generally, both state and federal laws protect against the disclosure of any medical information relating to seeking or obtaining an abortion that is collected in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. It is critically important that additional protections be in place to ensure that information shared by study participants in the context of a research study be fully protected from subpoena by out-of-state actors seeking to criminalize them for care they might have obtained that is legal in California. Without these protections, the risk to participant confidentiality might be too great, and it might not be possible to continue this kind of research.

In response to these concerns, this bill implements protections for research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information. The bill prohibits the release of such records in response to a subpoena or request if that subpoena or request is based on either another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act or a foreign penal civil action, as defined. In addition, the bill prohibits releasing these records to law enforcement for the enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act or enforcement of a foreign penal civil action, except pursuant to a subpoena not otherwise prohibited.

The University of California explains:

AB 45 provides critical privacy protections for researchers, study participants, and patients such as those involved with the Turnaway Study. The research occurring across UC campuses is vital for improving public health, supporting informed decision-making, addressing health disparities and understanding the impact of the Dobbs decision. As a top-tier research institution and a leading health care provider, UC is committed to ensuring that this critical research continues. Protecting sensitive reproductive information in research records is not anticipated to have any fiscal impact on the state. These protections may make it more appealing for funders to support this type of research in California.

1. Stakeholder positions

Planned Parenthood Affiliates of California:

Existing law protects against the disclosure of medical information related to an abortion in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. Given the personal nature of this data and the current federal political atmosphere, worrying about privacy protections and risking confidentiality of one’s personal information should not be a reason to cease research or participation in critical women’s health studies.

Additionally, the same concerns extend to personal privacy through geofencing, which tracks and uses an individual’s location data to trigger a response when in a specific place. Geolocation data has been used to target and spread misinformation about abortion, which can be harmful to patients. For example, in Massachusetts, anti-abortion groups targeted the area around reproductive health clinics with pop-up ads promoting “abortion alternatives.”

AB 45 fills gaps in privacy protections for health research records and prohibits geofencing around health centers. These changes proactively address privacy concerns to protect personal health information from misuse or abuse.

The Association of National Advertisers writes in opposition:

On behalf of the advertising industry, we respectfully oppose AB 45, and we offer this letter to express our concerns about this legislation. We and the companies we represent, many of whom do substantial business in California, strongly believe consumers deserve meaningful privacy protections supported by reasonable laws and industry policies. However, as drafted, AB 45 would have an overbroad effect by impeding legitimate advertising to Californians if they are merely near a family planning center. The bill also raises First Amendment concerns by blocking advertising to medical professionals and others inside of entities that provide in-person health care services. Moreover, the bill would permit a private right of action for certain violations, creating the possibility of extensive monetary penalties for well-meaning companies who inadvertently violate the bill’s terms. We therefore urge the Senate Judiciary Committee (“Committee”) to decline to advance the bill any further in the legislative process.

Writing in support, Attorney General Rob Bonta explains the need for the bill:

The Dobbs v. Jackson Women’s Health Organization decision overturned Roe v. Wade in June 2022, and created a climate of uncertainty and fear among reproductive health care seekers and providers throughout the country. In this new climate, those seeking reproductive care need better protections against disclosures of personal information to ensure they are not targets of out-of-state law enforcement, misinformation, or scare tactics.

SUPPORT

University of California (sponsor)
American College of Obstetricians & Gynecologists - District IX

Attorney General Rob Bonta

California Civil Liberties Advocacy

California Hospital Association

California Medical Association

California Women's Law Center

Essential Access Health

Planned Parenthood Affiliates of California

Reproductive Freedom for All California

OPPOSITION

Association of National Advertisers

RELATED LEGISLATION

Pending Legislation:

SB 361 (Becker, 2025) fortifies the Data Broker Registry law by requiring additional disclosures from data brokers on the types of information collected. SB 361 is currently in the Assembly Appropriations Committee.

AB 322 (Ward, 2025) amends the CCPA to provide enhanced protections for consumers’ precise geolocation information. It requires greater transparency around its collection and places guardrails on its collection and use. AB 322 prohibits businesses from selling precise geolocation information. AB 322 is currently in this Committee and is set to be heard the same day as this bill.

AB 1337 (Ward, 2025) amends the Information Practices Act (IPA) by expanding the definition of “personal information,” extending its scope to cover local governmental entities, and bolstering protections regarding disclosures and accounting. AB 1337 is currently in this Committee and is being heard the same day as this bill.

Prior Legislation:

SB 345 (Skinner, Ch. 260, Stats. 2023) See Comment 2.

SCA 10 (Atkins and Rendon, Ch. 87, Stats. 2022) expressly provided that the state shall not deny or interfere with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives, and states the measure is intended to further the right to privacy and the right to not be denied equal protection, as guaranteed by the California Constitution and that it does not narrow or limit the right to privacy or equal protection.

AB 1242 (Bauer-Kahan, Ch. 627, Stats. 2022) prohibited law enforcement from knowingly arresting a person for performing or aiding in the performance of a lawful abortion or for obtaining an abortion and prohibits specified entities from providing information to another state or political subdivision thereof regarding an abortion that is lawful under California law, except as provided.

AB 1666 (Bauer-Kahan, Ch. 42, Stats. 2022) prohibited the enforcement in this state of out-of-state laws authorizing a civil action against a person or entity that receives or seeks, performs or induces, or aids or abets the performance of an abortion, or who attempts or intends to engage in those actions and declares those out-of-state laws to be contrary to the public policy of this state.

AB 2091 (Mia Bonta, Ch. 628, Stats. 2022), among other things, prohibited compelling a person to identify or provide information that would identify an individual who has sought or obtained an abortion in a state, county, city, or other local criminal, administrative, legislative, or other proceeding if the information is being requested based on another state’s laws that interfere with a person’s right to choose or obtain an abortion or a foreign penal civil action.

AB 2223 (Wicks, Ch. 629, Stats. 2022), among other things, authorized a party aggrieved by a violation of the Reproductive Privacy Act to bring a civil action against an offending state actor, as specified, and provides that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care.

PRIOR VOTES:

Assembly Floor (Ayes 63, Noes 11)

Assembly Appropriations Committee (Ayes 11, Noes 2)

Assembly Judiciary Committee (Ayes 9, Noes 2)

Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 2)

**************

1. Dobbs v. Jackson Women’s Health (2022) 597 U.S. _ (142 S.Ct. 2228) at p. 5, available at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf. ↑

2. See Miss. Code Ann. §41-41-191. ↑

3. Id. at 77. ↑

4. Cecilia Marrinan, Geofencing: The Overlooked Barrier to Reproductive Freedom (October 30, 2024) Council on Foreign Relations, https://www.cfr.org/blog/geofencing-overlooked-barrier-reproductive-freedom. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 45

Author:(Bauer-Kahan)

As Amended Ver:April 9, 2025

Majority vote

SUMMARY

This bill prohibits the collection, use, and disclosure of specified personal data relating to the provision of reproductive and other health services, enforceable by the Attorney General and through a private right of action.

Major Provisions

1. Prohibits the collection, use, disclosure, sale, sharing, or retention of the personal information of a person who is physically located at or near a family planning center, as defined, except by a health care provider, health care service plan, or contractor.
2. Allows collection and use of a person's data described in item 1), above, as necessary to perform the services or provide the goods requested by the person.
3. Allows an aggrieved person or entity, including a family planning center, to bring a civil action against any person who violates this prohibition within three years of discovery of the violation.
4. Prohibits, except as specified, the geofencing of an entity that provides in-person health care services in California for specified purposes, including to identify or track a person seeking or receiving health care services, to collect such a person's personal information, or to send notifications or advertisements to a person, and prohibits any entity from selling or sharing personal information with a third party for such a purpose.
5. Authorizes the Attorney General to bring a civil action to enforce a violation of the prohibition in item 4), above, and specifies a person who violates the prohibition is subject to an injunction and civil penalty of $25,000.
6. Prohibits release of specified personally identifying research records in response to a subpoena or request, or to law enforcement, if the inquiry is based on another state's laws that interfere with a person's rights under the California Reproductive Privacy Act, or based on a foreign penal civil action.

COMMENTS

1. Research Privacy. Currently, research data is protected under Certificates of Confidentiality (CoCs) only if the research is federally funded. These certificates, issued by agencies such as the National Institutes of Health (NIH) or the Centers for Disease Control and Prevention (CDC), are designed to safeguard identifiable, sensitive information collected during research. Privately funded research, however, does not automatically receive the same protections. Although such projects can apply for a CoC, approval is at the discretion of the issuing agency, a process that may be especially difficult under the current federal administration that has taken a more critical stance toward certain areas of research. Even when a CoC is granted, disclosure of protected information can still be required under specific federal, state, or local laws. As a result, the current framework for protecting research records could allow for compliance with subpoenas issued by other states, even when those subpoenas are based on laws that contradict California's legal protections.
2. Geofencing. Geofencing is the practice of creating a virtual perimeter around a specific geographic area. These perimeters can range in size from entire states to a single business or building.^[1] Geofencing works by tracking the IP addresses of devices that enter the defined location. Data brokers can purchase this information and combine it with other consumer data to identify individuals and package the information for various uses. Some businesses use geofencing data to determine which consumers are near their locations, allowing them to send targeted coupons or advertisements to encourage in-store visits. On a more granular level, businesses can analyze movement patterns within a store to determine where customers spend the most time and tailor advertisements or store layouts accordingly.

In a healthcare setting, geofencing is often used to enhance patient safety. Some healthcare facilities use it to monitor who enters and exits, helping to prevent individuals with a history of violence from reentering the premises. Geofencing can also be employed to track patients with neurodegenerative conditions, such as Alzheimer's disease, to ensure they remain within the facility and receive appropriate care.^[2] Additionally, hospitals may use geofencing to ensure that infants are transported only by authorized personnel, helping to prevent mismatches or abductions.^[3] While these applications offer clear benefits, they also raise concerns. The vast amount of data collected and the relative ease with which it can be accessed push this technology toward a more dystopian territory, especially when considering issues of privacy and surveillance.

Geofencing can become highly punitive when used to enforce laws like the Texas Heartbeat Act. For instance, an individual in Texas could geofence a healthcare facility in California that provides abortion services and track who enters and exits the premises. If they are able to identify a patient from Texas, this data could form the basis of a civil lawsuit under the law's private right of action provision. That suit could not only endanger the patient, but also the doctor and any individual who "aids or abets" the patient in obtaining abortion care. This kind of surveillance represents a serious threat to privacy and bodily autonomy and directly undermines California's constitutional protections to the right to privacy and the right to access abortion care.

This can become even more worrisome if extrajudicial means are used to obtain geofenced location data. Specifically, location data brokers collect billions of location data points linked to unique persistent identifiers and timestamps that could give detailed insights into people's movements. This information is then repackaged and sold to their clients, who often use it to trace the movements of individuals to and from sensitive locations. These include medical facilities, places of religious worship, places used to infer an LGBTQ+ identification, domestic abuse shelters, substance use disorder treatment facilities, and homeless shelters. Further, data collected is not anonymized, it is possible to identify the exact identity of the mobile device owner.

Please see the policy committee analysis for a full analysis of this bill.

According to the Author

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states' laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services

Arguments in Support

University of California Office of the President writes in support:

AB 45 provides critical privacy protections for researchers, study participants, and patients such as those involved with the Turnaway Study. The research occurring across UC campuses is vital for improving public health, supporting informed decision-making, addressing health disparities and understanding the impact of the Dobbs decision. As a top-tier research institution and a leading health care provider, UC is committed to ensuring that this critical research continues.

While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 protects research records from disclosure in response to a subpoena or other law enforcement request based on another state's laws that interfere with a person's right to obtain an abortion and prohibits geofencing an entity that provides in-person health care services. For these reasons, we urge your support on AB 45.

Arguments in Opposition

None on file.

FISCAL COMMENTS

According to the Appropriation Committee:

1. Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate civil actions authorized by this bill. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.
3. Possible future revenues to the California Reproductive Justice and Freedom Fund, to the extent DOJ recovers civil penalties for violations of the bill's prohibition on geofencing.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 10-2-3

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks

NO: DeMaio, Macedo

ABS, ABST OR NV: Dixon, Patterson, Wilson

ASM JUDICIARY: 9-2-1

YES: Kalra, Bauer-Kahan, Bryan, Connolly, Harabedian, Pacheco, Papan, Stefani, Zbur

NO: Macedo, Sanchez

ABS, ABST OR NV: Dixon

ASM APPROPRIATIONS: 11-2-2

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

NO: Ta, Tangipa

ABS, ABST OR NV: Sanchez, Dixon

UPDATED

VERSION: April 9, 2025

CONSULTANT: John Bennett / P. & C.P. / (916) 319-2200 FN: 0000813

1. Rahul Awati, "geofencing", TechTarget (December 2022), accessed at https://www.techtarget.com/whatis/definition/geofencing. ↑

2. Securitas Healthcare, "Location Tracking for Alzheimer's and Dementia Residents", (Feb. 17, 2022), accessed at https://www.securitashealthcare.com/blog/location-tracking-alzheimers-and-dementia-residents. ↑

3. Claire Swedberg, "Hybrid RTLS Solution Tracks Infants in Hospitals", RFID Journals (Oct. 28, 2024), accessed at https://www.rfidjournal.com/news/hybrid-rtls-solution-tracks-infants-in-hospitals/222010/. ↑

Date of Hearing: May 7, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 45

Author:(Bauer-Kahan) – As Amended Ver:April 9, 2025

Urgency: No State Mandated Local Program: Yes Reimbursable: No

SUMMARY:

This bill prohibits the collection, use, and disclosure of specified personal data relating to the provision of reproductive health services, enforceable by the Attorney General and through a private right of action.

Specifically, among other provisions, this bill:

1. Prohibits the collection, use, disclosure, sale, sharing, or retention of the personal information of a person who is physically located at or near a family planning center, as defined, except by a health care provider, health care service plan, or contractor.
2. Allows collection and use of a person’s data described in item 1), above, as necessary to perform the services or provide the goods requested by the person.
3. Allows an aggrieved person or entity, including a family planning center, to bring a civil action against any person who violates this prohibition within three years of discovery of the violation.
4. Prohibits, except as specified, the geofencing of an entity that provides in-person health care services in California for specified purposes, including to identify or track a person seeking or receiving health care services, to collect such a person’s personal information, or to send notifications or advertisements to a person, and prohibits any entity from selling or sharing personal information with a third party for such a purpose.
5. Authorizes the Attorney General to bring a civil action to enforce a violation of the prohibition in item 4), above, and specifies a person who violates the prohibition is subject to an injunction and civil penalty of $25,000.
6. Prohibits release of specified personally identifying research records in response to a subpoena or request, or to law enforcement, if the inquiry is based on another state’s laws that interfere with a person’s rights under the California Reproductive Privacy Act, or based on a foreign penal civil action.

FISCAL EFFECT:

1. Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount.  Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload.  If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum.  If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate civil actions authorized by this bill. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.
3. Possible future revenues to the California Reproductive Justice and Freedom Fund, to the extent DOJ recovers civil penalties for violations of the bill’s prohibition on geofencing.

COMMENTS:

A geofence is a virtually-designated space around a geographic feature or landmark. Geofencing technology uses a person’s location data to determine when they enter and leave a particular geofence. This technology was originally developed by retailers to send targeted ads to consumers who visit their stores. However, especially since 2022, when the U.S. Supreme Court overturned the legal right to obtain an abortion, geofencing has been used to identify and target people who seek or use reproductive health care services. For example, a person’s cell phone location data can be used to tell when they approached a Planned Parenthood, how long they stayed there, and when they left. This data could be used to identify and prosecute someone who came to California to have an abortion because doing so is illegal in their home state.

This bill prohibits, subject to some exceptions, the collection, use, disclosure, sales, sharing, or retention of personal data collected at or near a family planning center. A family planning center includes, but is not limited to, a clinic or center that provides reproductive health care. Anyone who violates this prohibition may be sued by an aggrieved party – likely an individual person who suffered harm as a result of the violation or the family planning center from which data was collected. The bill also prohibits unauthorized geofencing at or near a health care facility for the purpose of identifying or tracking a person seeking care at the facility, collecting personal information from such a person, or sending specified notifications or advertisements to a person. The bill also prohibits selling or sharing data with any third party for these prohibited purposes. These prohibitions are enforced through civil actions filed by the Attorney General. Each violation is subject to a $25,000 civil penalty. Any penalty revenue recovered through these actions is deposited into a fund that finances grants from the Department of Public Health to organizations that promote medically accurate, comprehensive reproductive and sexual health education.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 29, 2025

ASSEMBLY COMMITTEE ON JUDICIARY

Ash Kalra, Chair

ABPCA Bill Id:AB 45

Author:(Bauer-Kahan) – As Amended Ver:April 9, 2025

SUBJECT: Privacy: health data: location and research

KEY ISSUES:

1. should the use of geofencing technology be limited in AND around surrounding facilities that provide family planning services?
2. Should sensitive healthcare information contained in research records be protected from disclosure to out-of-state law enforcmeent seeking to enforce laws that punish conduct that is legal in california?

SYNOPSIS

After the United States Supreme Court moved to end federal protections for abortion services (Dobbs v. Jackson Women’s Health Organization (2022) 597 U.S. 215), California has stepped up to protect reproductive freedom in this state. Since 2022, the Legislature has enacted dozens of bills to protect reproductive healthcare including blocking out-of-state lawsuits for “aiding and abetting” a person receiving an abortion, protecting medical records from out-of-state subpoenas, and protecting the licenses of medical professions.

This bill builds on the Legislature’s recent attempts to bolster reproductive freedom by closing potential loopholes in existing law. First, the bill significantly limits the use of geofencing technology around healthcare facilities and imposes civil lability on any person determined to have collected, used, disclosed, sold, shared, or retained personal geofence data. Secondly, the bill limits disclosure of healthcare data found within research records even if the data is requested by another’s states subpoena.

This measure is sponsored by the University of California, and its University operated healthcare systems, and supported by a coalition of healthcare providers and reproductive choice advocates. The proponents highlight California’s leadership as a reproductive freedom state and contend that this bill is needed to ensure that loopholes in existing law do not undermine California’s robust protections for reductive healthcare. This measure has no known opposition and was previously heard and approved by the Committee on Privacy and Consumer Protection on a vote of 10-2.

SUMMARY: Prohibits the collection, use, and disclosure of specified sensitive data, including location data, related to the provision of family planning services and authorizes a civil action should the prohibition be violated. Specifically, this bill:

1. Prohibits the collection, use, disclosure, sales, sharing, or retention of the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in 2).
2. Provides that, notwithstanding 1), it is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Permits an aggrieved person or entity, including a family planning center, to institute and prosecute a civil action against any person who violates the prohibition in 1) for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Provides that if a court rules in favor of a plaintiff filing suit pursuant to 3), recovery is to be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation.
5. Exempts from the provisions of 3) and 4) a provider of health care, a health care service plan, or contractor.
6. Prohibits, except as specified, the geofencing of an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services;
   2. To collect personal information from a person seeking, receiving, or providing health care services;
   3. To send notifications to a person related to their personal information or health care services;
   4. To send advertisements to a person related to the person’s personal information or health care services.
7. Prohibits any entity from selling or sharing personal information with a third party if the use of such information would violate 6).
8. Provides that the prohibition in 6) does not prohibit any person that owns, operates, manages, or otherwise provides services to an in-person health care entity from geofencing the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
9. Provides that the prohibition in 6) does not prohibit any person that provides reproductive health care services from utilizing geofencing for the purpose of providing security services to protect patients, staff, or property.
10. Provides that the prohibition in 6) does not apply to the following:
    1. A lawfully executed search warrant;
    2. A lawful subpoena issued pursuant to existing California law; or
    3. Law enforcement if law enforcement, in good faith, believes that an emergency involving danger of death or serious physical injury to any person requires access to such geofencing data.
11. Provides that any person that violates 6) is subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which is to be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General, as specified.
12. Provides that any recovery stemming from an action commenced pursuant to 11) is to be deposited in the California Reproductive Justice and Freedom Fund.
13. Provides that nothing in the bill abrogates or limits the requirements of the Electronic Communications Privacy Act.
14. Prohibits the release of research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information.
15. Prohibits any person holding the records specified in 14) from releasing the records in order to comply with another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act or a foreign penal civil action.
16. Defines the following terms:
    1. “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior;
    2. “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services;
    3. “Geofence” means any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation,” as specified;
    4. “Health care services” means any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature;
    5. “Person” means a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert;
    6. “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person;
    7. “Sell,” “selling,” “sale,” or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration; and
    8. “Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration.

EXISTING LAW:

1. Establishes the Confidentiality of Medical Information Act. (Civil Code Section 56 et seq.)
2. Provides that any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage the individual’s information, or for the diagnosis and treatment of the individual, is deemed to be a provider of health care subject to the requirements of the Confidentiality of Medical Information Act. (Civil Code Section 56.06 (a).)
3. Prohibits, generally, a provider of health care, health care service plan, or contractor from disclosing medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization from the patient or authorized representative. (Civil Code Section 56.10 (a).)
4. Requires, notwithstanding 3), a provider of health care, a health care service plan, or a contractor to disclose medical information when compelled to do so by the following:
   1. A court order;
   2. A board, commission, or administrative agency for purposes of adjudication pursuant to its lawful authority;
   3. A party to a proceeding before a court or administrative agency pursuant to a subpoena, subpoena duces tecum, notice to appear served pursuant to Section 1987 of the Code of Civil Procedure, or any provision authorizing discovery in a proceeding before a court or administrative agency;
   4. A board, commission, or administrative agency pursuant to an investigative subpoena, as specified;
   5. An arbitrator or arbitration panel, when arbitration is lawfully requested by either party, pursuant to a subpoena duces tecum, or another provision authorizing discovery in a proceeding before an arbitrator or arbitration panel;
   6. A search warrant lawfully issued to a governmental law enforcement agency;
   7. A request of the patient or patient’s representative, as specified;
   8. A medical examiner, forensic pathologist, or coroner, when requested in the course of an investigation by a medical examiner, forensic pathologist, or coroner’s office for the purpose of identifying the decedent or locating next of kin, or when investigating deaths that may involve public health concerns, organ or tissue donation, child abuse, elder abuse, suicides, poisonings, accidents, sudden infant deaths, suspicious deaths, unknown deaths, or criminal deaths, or upon notification of, or investigation of, imminent deaths that may involve organ or tissue donation, or when otherwise authorized by the decedent’s representative; and
   9. When otherwise specifically required by law. (Civil Code Section 56.10 (b).)
5. Authorizes, notwithstanding 3), 24 instances in which a provider of health care, health care service plan, or contractor may disclose medical information for the purposes of diagnosis or treatment of the patient, as specified. (Civil Code Section 56.10 (c).)
6. Defines for the purpose of 1) through 5), “health care service plan” to mean an entity regulated pursuant to the Knox-Keene Health Care Service Plan Act of 1975. (Civil Code Section 56.05 (g).)
7. Defines for the purposes of 1) through 5), “provider of healthcare” to mean a person licensed or certified through various healing arts professional statutes as provided in the Business and Professions Code. (Civil Code Section 56.05 (h).)
8. Defines for the purposes of 1) through 5) “contractor” to mean a person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a medical service organization and is not a health care service plan or provider of health care.
9. Defines a "search warrant" as a written order in the name of the people, signed by a magistrate and directed to a peace officer, commanding them to search for a person or persons, a thing or things, or personal property, and in the case of a thing or things or personal property, bring the same before the magistrate. (Penal Code Section 1523.)
10. Provides the specific grounds upon which a search warrant may be issued, including when the property or things to be seized consist of any item or constitute any evidence that tends to show a felony has been committed, or tends to show that a particular person has committed a felony. (Penal Code Section 1524.)
11. Provides that a search warrant cannot be issued but upon probable cause, supported by affidavit, naming or describing the person to be searched or searched for, and particularly describing the property, thing, or things and the place to be searched. (Penal Code Section 1525.)
12. Requires a provider of wire or electronic communication services or a remote computing service, upon the request of a peace officer, to take all necessary steps to preserve records and other evidence in its possession pending the issuance of a search warrant or a request in writing and an affidavit declaring an intent to file a warrant to the provider. Records shall be retained for a period of 90 days, which shall be extended for an additional 90-day period upon a renewed request by the peace officer. (Penal Code Section 1524.3 (d).)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: Following the United States Supreme Court’s unprecedented overturning of a previously constitutionally protect right in Dobbs v. Jackson Women’s Health Organization (2022) 597 U.S. 215, those who oppose the right to seek reproductive healthcare have enacted hundreds of cruel and overreaching laws across the nation seeking to punish those seeking abortion care. California, rightfully, has moved in the opposite direction, enacting dozens of new laws to protect reproductive freedom since 2022. However, the author and proponents of this bill contend that modern technology is undermining the protections of California law. One aspect of modern technology that is particularly worrisome is the use of geolocation data. Especially in light of other state’s laws that deputize any citizen to punish those seeking an abortion, geolocation data must be protected. This bill does just that. The measure would prohibit the collection, use, and disclosure of specified location data related to the provision of family planning services. Additionally, the bill ensures that information collected for valid scientific research cannot be weaponized against researchers or research subjects. In support of this critical measure to protect reproductive freedom, the author states:

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states’ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services.

The rise of geolocation technology can inadvertently undermine patient privacy. Geolocation technology, sometimes referred to as geofencing, is a location-based GPS technology that utilizes RFID, Wi-Fi, or cellular data to determine who was near a specified location. Retailers and other merchants originally developed geofencing to target specific ads to customers when there are in their store. As geofencing technology has grown more affordable and widespread, the use of the technology for nefarious purposes is also growing. For example, anti-choice activists can now establish a geofence around a family planning clinic. They can then comb the cell phone data to determine if any out-of-state residents visited the clinic and provide that information to out-of-state law enforcement. If the out-of-state law enforcement work for a jurisdiction that has banned abortion and prohibits its citizens from traveling outside the state for reproductive healthcare, the geofence data enables those authorities to charge their citizens with receiving abortion services in California.

Research data is not entitled to the same degree of privacy as most other healthcare information. Under existing law, the Health Insurance Portability and Accountability Act (HIPAA) and the California Medical Information Act protect medical information for disclosure to third parties. The acts essentially codifies the longstanding doctor-patient privilege. However, medical data utilized in research is not afforded as many protections, in part due to the need to justify scientific findings through peer review processes. Although federally funded research is protected by Certificates of Confidentiality, privately funded research has no such protections, and there is no guarantee the current federal administration will continue to uphold Certificates of Confidentiality. Given the somewhat public nature of research data, there are few tools that can be utilized to stop disclosure of this information, particularly if the information is sought through a warrant or subpoena.

This bill. Seeking to close gaps surround geolocation data privacy and disclosure of sensitive medical information utilized in scientific research this bill advances two new policies to protect Californians sensitive data. First, the bill prohibits the selling, sharing, disclosure, or retention of any personal information of individuals present within a healthcare facility. The bill permits a healthcare facility to use a geofence for its own security, but provides that the unauthorized use of a geofence near a healthcare facility exposes the person using the geofence to civil liability. Secondly, this bill adopts a framework for protecting sensitive personal medical information held in research records. The bill explicitly prohibits the disclosure of these records to out-of-state entities seeking the information for purposes that violate California law, including the Reproductive Privacy Act, or another state’s foreign penal civil statutes.

American legal history and case law suggests that California is not obligated to assist in out-of-state vigilante lawsuits. Article IV, Section 1 of the United States Constitution, generally referred to as the Full Faith and Credit Clause, requires every state to give full faith and credit to the public acts (statutes), records, and judicial proceedings of every other state. By refusing to recognize the laws, regulatory body rulings, and judgments of another state, this bill potentially implicates the Full Faith and Credit Clause. Several legal scholars have suggested that the Full Faith and Credit Clause was originally intended to ensure that statutes, records, and judgments from one state merely be accepted as evidence in the proceedings of another state as to the proof of their existence, especially in light of how the phrase was used in English common law. (Whitten, Full Faith and Credit for Dummies (2005) 38 Creighton L. Rev. 465.) However, in 1813, Justice Story had other ideas and opted to significantly strengthen the effect of the clause and the corresponding Congressional implementing statute. In ruling that the Circuit Court for the District of Columbia was incorrect for refusing to recognize a judgment debt from the State of New York the Supreme Court ruled the law “declares that the record duly authenticated shall have such faith and credit as it taken. If in such court it has the faith and credit of evidence of the highest nature…it must have the same faith and credit in every other court,” and that “the constitution contemplated a power in Congress to give conclusive effect to such judgments.” (Mills v. Duryee (1813) 7 Cranch 481, 484-485.)

Despite the seemingly bright line put forward by Justice Story, in the 200 years since the Mills decision, three distinct tracks have begun to develop in the jurisprudence of the Full Faith and Credit Clause. To this day, the strict application of res judicata generally applies to determinative judicial proceedings; as the Supreme Court reiterated, “for claim and issue preclusion purposes…the judgement of the rendering state gains nationwide force.” (Baker v. General Motors Corp., supra 522 U.S. at pp. 222, 233.)

However, the law has moved well away from the strict rule when it comes to public acts or statutes. In upholding the application of California law to settle a dispute of conflicting workers compensation statutes, the Supreme Court ruled, “A rigid and literal enforcement of the Full Faith and Credit Clause, without regard to the statute of the forum, would lead to the absurd result that wherever a conflict arises, the statute of each state must be enforced in the courts of the other, but cannot be in its own.” (Alaska Packers Association v. Industrial Accident Commission (1935) 294 U.S. 532, 547.) Thus, the law now acknowledges a preference to uphold the public policy of the forum state when a conflict of laws arises, recognizing that, “the Full Faith and Credit Clause is not an inexorable and unqualified command. It leaves some scope for state control within its borders…” (Pink v. AAA Highway Express, Inc. (1941) 314 U.S. 201,210.).

The Supreme Court has also begun to move away from the strict ruling of Mills as it pertains to state records. In determining the applicability of an equity decree in Michigan that prevented a former General Motors employee from testifying against the company, to a subpoena for testimony issues in Missouri, the Supreme Court held, “we simply recognize that just as the mechanisms for enforcing a judgment do not travel with the judgment itself for the purposes of Full Faith and Credit … similarly the Michigan decree cannot determine the evidentiary issues in a lawsuit brought by parties who were not subject to the jurisdiction of the Michigan court.” (Baker v. General Motors, supra, 522 U.S. 222 at p. 239.) The handling of records has been further expanded upon by appellate courts in a manner that mixes the approach to judgments and public policy. In 2011, the Fifth Circuit upheld the Louisiana Department of Vital Records and Statistics refusal to amend the Louisiana birth certificate of a child who was legally adopted by a non-married gay couple in New York on the grounds that it violated Louisiana’s public policy. Building upon the notion that the manner of a judgment’s enforcement does not travel with the judgment, the court held, “obtaining a birth certificate falls in the heartland of enforcement, and therefore outside the Full Faith and Credit obligation of recognition.” (Adar v. Smith (5th Cir. 2011) 639 F.3d 146,160.) It should be noted that the Supreme Court appears to endorse this view as it denied certiorari in the Adar case.

Thus, when looking at the case law as a whole, legal scholars are beginning to argue that the Full Faith and Credit Clause applies differently to each aspect of the Clause. The jurisprudence would seem to indicate that public acts are subject to the public policy exemption, permitting states to generally apply local laws to cases in their jurisdiction; records are subject to recognition, but not clear enforcement; and judicial proceedings generally are required to be enforced. (Redpath, Between Judgment and Law: Full Faith and Credit, Public Policy, and State Records (2013) 62 Emory L.J. 639.)

By prohibiting the enforcement of out-of-state laws that run counter to California law, the bill is essentially determining that these out-of-state laws are against the public policy of California, thereby precluding California courts from applying those laws to cases brought in this state. The bill simply directs California courts to apply this state’s laws over a foreign jurisdiction. It can thus be argued that by adopting this measure, the Legislature would simply be avoiding the “absurd result” of this state’s courts not being able to enforce their own laws as envisioned in Alaska Packers Association.

ARGUMENTS IN SUPPORT: The bill is sponsored by the University of California and is supported by a coalition of healthcare professionals and reproductive healthcare advocates. In support of this bill, the University of California writes:

UC Health’s mission is to improve the health and well-being of all people living in California now and in the future by educating and training the inclusive workforce of tomorrow; delivering exceptional and equitable care; and discovering life-changing treatments and cures. UC plays a key role in advancing research on reproductive health.

Many UC researchers conduct survey- and interview-based research on people about their reproductive health experiences, including research specifically evaluating the effects of new state laws enacted since the Dobbs v. Jackson Supreme Court decision. This data can include information about contraception, abortion care and other individual care information. For example, the UCSF Advancing New Standards in Reproductive Health research program conducted a longitudinal study, known as the Turnaway Study, which examines the effects of unwanted pregnancies on women’s lives. Research assistants interviewed participants by phone over a period of 5 years, and nearly 8,000 interviews were conducted over the course of the project. The main finding of the Turnaway Study is that receiving an abortion does not harm the health and wellbeing of women, but in fact, being denied an abortion results in worse financial, health, and family outcomes. UCSF has published over 50 scientific papers in peer-reviewed journals using data from the Turnaway Study.

Generally, both state and federal laws protect against the disclosure of any medical information relating to seeking or obtaining an abortion that is collected in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. It is critically important that additional protections be in place to ensure that information shared by study participants in the context of a research study be fully protected from subpoena by out-of-state actors seeking to criminalize them for care they might have obtained that is legal in California. Without these protections, the risk to participant confidentiality might be too great, and it might not be possible to continue this kind of research.

AB 45 provides critical privacy protections for researchers, study participants, and patients such as those involved with the Turnaway Study. The research occurring across UC campuses is vital for improving public health, supporting informed decision-making, addressing health disparities and understanding the impact of the Dobbs decision. As a top-tier research institution and a leading health care provider, UC is committed to ensuring that this critical research continues.

Additionally, the California Hospitals Association notes:

Hospitals are deeply committed to protecting patient privacy and the confidentiality of personal health information. Every day, patients place their trust in hospitals, often during their most vulnerable moments, and hospitals take their confidentiality responsibilities seriously. Safeguarding patient data is not only a legal obligation — it is a core part of our mission to provide safe, respectful, and compassionate care. That’s why the California Hospital Association (CHA), on behalf of more than 400 hospitals and health systems, supports Assembly Bill (AB) 45 to add additional legal protections to patient information regarding reproductive care.

AB 45 would prohibit the use of geofencing technology around health care facilities. Geofencing creates a virtual boundary around a specific geographic area, triggering software actions — such as targeted advertising or data collection — when a mobile device enters or exits the defined zone. This technology can be misused to collect geolocation data near sensitive sites like abortion clinics and then deploy targeted ads designed to mislead, intimidate, or harass patients seeking care.

REGISTERED SUPPORT / OPPOSITION:

Support

University of California (sponsor)

American College of Obstetricians & Gynecologists - District IX
California Hospital Association
California Pan - Ethnic Health Network
Citizens for Choice

Electronic Frontier Foundation (if amended)

Planned Parenthood Affiliates of California
Secure Justice

Opposition

None on file

Analysis Prepared by: Nicholas Liedtke / JUD. / (916) 319-2334

Date of Hearing: April 22, 2025

Fiscal: Yes

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 45 (

Author:Bauer-Kahan) – As Amended Ver:April 9, 2025

SUBJECT: Privacy: health data: location and research

SYNOPSIS

In 2022, the Supreme Court ruling in Dobbs v. Jackson Women’s Health overturned a decades-old precedent protecting the fundamental right to abortion. Since then, many states have enacted strict restrictions or outright bans on abortion, threatening both patients and providers of critical reproductive care. Similarly, numerous states have imposed punitive restrictions on gender-affirming care.

Despite these challenges, California remains a leader in protecting reproductive freedom and transgender rights. However, these protections face potential legal threats from other states. For instance, the Texas Heartbeat Act allows private citizens to file civil lawsuits against anyone who aids or performs an abortion for a Texas resident. This framework could exploit gaps in California’s privacy laws, undermining its status as an abortion safe haven.

One such vulnerability is geofencing, a surveillance technique that creates virtual boundaries to track individuals entering or exiting specific locations. If used around healthcare facilities providing abortions or gender-affirming care, geofencing could enable enforcement of restrictive laws from other states. Additionally, current safeguards for personally identifiable research records are inadequate against out-of-state subpoenas, potentially weaponizing critical research on reproductive and gender-affirming care against the very patients it aims to help.

To address these issues, this bill, sponsored by University of California Office of the President, would prohibit geofencing near healthcare facilities and expand protections for personally identifiable data collected within them, covering both patients and visitors. Secondly, this bill would strengthen research privacy protections by preventing the release of personally identifiable information if the subpoena is issued under a law that conflicts with California’s legal standards. This bill is supported by American College of Obstetricians and Gynecologists District IX, the California Hospital Association, and Secure Justice.

THIS BILL:

1. Defines the following terms:
   1. “Collect,” “collected,” or “collection” to mean the buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a natural person by any means. This includes receiving information from the natural person, either actively or passively, or by observing the natural person’s behavior.
   2. “Family planning center” means a facility categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services.
   3. “Geofence” to mean any technology that enables spatial or location detection to establish a virtual boundary around, and detect an individual’s presence within, a “precise geolocation”
   4. “Health care services” to mean any service provided to a natural person of a medical, surgical, psychiatric, therapeutic, diagnostic, mental health, behavioral health, preventative, rehabilitative, supportive, consultative, referral, or prescribing nature.
   5. “Person” to mean to a natural person, association, proprietorship, corporation, trust, foundation, partnership, or any other organization or group of people acting in concert.
   6. “Research” to mean the systematic investigation, including research development, testing, and evaluation, that has as its primary purpose the development of, or contribution to, generalizable knowledge.
   7. “Sell,” “selling,” “sale,” or “sold” to mean the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party for monetary or other valuable consideration.
   8. “Share,” “shared,” or “sharing” to mean the sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a natural person’s personal information by another person to a third party, whether or not for monetary or other valuable consideration.
2. Prohibits a person from collecting, using, disclosing, selling, sharing, or retaining the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, except as specified below:
   1. It is permissible to collect or use the personal information of a natural person who is physically located at, or within a precise geolocation of, a family planning center, but only as necessary to perform the services or provide the goods requested by the natural person.
3. Establishes that an aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person who violates this bill for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
4. Prohibits a person from geofencing an entity that provides in-person health care services in California for any of the following purposes:
   1. To identify or track a person seeking, receiving, or providing health care services.
   2. To collect personal information from a person seeking, receiving, or providing health care services.
   3. To send notifications to a person related to their personal information or health care services.
   4. To send advertisements to a person related to the person’s personal information or health care services.
5. Prohibits the selling of personal information to, or sharing of personal information with, a third party for the use of such information for the purposes above.
6. Establishes that any person that violates this section shall be subject to an injunction and liable for a civil penalty of twenty-five thousand dollars ($25,000) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the entity or person in determining the amount of the civil penalty.
7. Establishes that any civil penalty recovered by an action brought by the Attorney General for a violation of this section, and the proceeds of any settlement of any said action, shall be deposited in the California Reproductive Justice and Freedom Fund established pursuant to Section 140 of the Health and Safety Code.
8. Permits any person that owns, operates, manages, or otherwise provides services to an in-person health care entity to geofence the entity’s own location to provide necessary health care services, including the use of location-based alarm devices to monitor newborns and memory-impaired individuals.
9. Permits any person that provides reproductive health care services to utilize geofencing for the purpose of providing security services to protect patients.
10. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released in response to a subpoena or request if that subpoena or request is based on another state’s laws that interfere with a person’s rights under the Reproductive Privacy Act.
11. Prohibits research records, in a personally identifying form, developed or acquired by a person in the course of conducting research relating to anyone seeking or obtaining health care services, or relating to personal information, from being released to law enforcement for either of the following purposes, unless that release is pursuant to a subpoena not otherwise prohibited:
    1. Enforcement of another state’s law that interferes with a person’s rights under the Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code).
    2. Enforcement of a foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure.

EXISTING LAW:

1. Provides the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, from being violated, and prohibits warrants from being issued, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (US. Const., Amend. IV).
2. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
3. Provides that the state shall not deny or interfere with an individual’s reproductive freedom in their most intimate decisions, which includes their fundamental right to choose to have an abortion and their fundamental right to choose or refuse contraceptives. (Cal. Const., art. I, § 1.1.)
4. Establishes under federal law, the Health Information Portability and Accountability Act of 1996 (HIPAA), which sets standards for the privacy of individually identifiable health information and security standards for the protection of electronic protected health information, including, through regulations, that a HIPAA-covered entity may not condition the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits on the provision of an authorization, except under specified circumstances. Provides that if HIPAA’s provisions conflict with state law, the provision that is most protective of patient privacy prevails. (42 U.S.C. § 1320d, et seq.; 45 Code Fed. Regs. Part 164.)
5. Prohibits a health facility to deny staff privileges to, remove from medical staff, or restrict the staff privileges of a person licensed by a healing arts board in this state on the basis of a civil judgment, criminal conviction, or disciplinary action imposed by another state if that judgment, conviction, or disciplinary action is based solely on the application of another state’s law that interferes with a person’s right to receive sensitive services that would be lawful if provided in this state. (BPC § 805.9(a).)
6. Establishes that a licensed physician in Arizona may register and may practice medicine in California through November 30, 2024, solely for the purpose of providing abortions, as defined in Section 123464 of the Health and Safety Code, and abortion-related care to patients who are Arizona residents traveling from Arizona seeking abortions or abortion-related care in California. (BPC § 2076.6(a).)
7. Prohibits, under the state Confidentiality of Medical Information Act (CMIA), a health care provider, a health care service plan, a contractor, a corporation and its subsidiaries and affiliates, or any business that offers software or hardware to consumers, including a mobile application or other related device, as defined, from intentionally sharing, selling, using for marketing, or otherwise using any medical information, as defined, for any purpose not necessary to provide health care services to a patient, except as expressly authorized by the patient, enrollee, or subscriber, as specified, or as otherwise required or authorized by law. States that a violation of these provisions that results in economic loss or personal injury to a patient is a crime. (Civ. Code § 56, et. seq.)
8. Defines, for purposes of the CMIA, medical information to mean any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient’s medical history, mental health application information, reproductive or sexual health application information, mental or physical condition, or treatment. (Civ. Code § 56.05(j).)
9. Defines “sensitive services” to mean all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care, and intimate partner violence. (Civ. Code § 56.05(p).)
10. Prohibits health care providers, health care service plans, or contractors, as defined, from sharing medical information without the patient’s written authorization, subject to certain exceptions. (Civ. Code § 56.10(a).)
11. Deems any business organized for the purpose of maintaining medical information in order to make the information available to an individual or to a provider of health care at the request of the individual or the provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis and treatment of the individual, to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(a).)
12. Deems any business that offers software or hardware to consumers, including a mobile application or other related device that is designed to maintain medical information in order to make the information available to an individual or a provider of health care at the request of the individual or a provider of health care, for purposes of allowing the individual to manage their information, or for the diagnosis, treatment, or management of a medical condition of the individual, to be deemed to be a health care provider subject to the requirements of the CMIA. (Civ. Code § 56.06(b).)
13. Require that a provider of health care, health care service plan, pharmaceutical company, contractor, or employer shall not knowingly disclose, transmit, transfer, share, or grant access to medical information in an electronic health records system or through a health information exchange that would identify an individual and that is related to an individual seeking, obtaining, providing, supporting, or aiding in the performance of an abortion that is lawful under the laws of this state to any individual or entity from another state, unless the disclosure, transmittal, transfer, sharing, or granting of access is lawfully authorized in accordance with California Law. (Civ. Code § 56.110(a).)
14. Defines “precise geolocation” to mean any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations. (Civ. Code § 1798.140.(w).)
15. Establishes the Reproductive Privacy Act, which provides that the Legislature finds and declares that every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy, including prenatal care, childbirth, postpartum care, contraception, sterilization, abortion care, miscarriage management, and infertility care. Accordingly, it is the public policy of the State of California that:
    1. Every individual has the fundamental right to choose or refuse birth control;
    2. Every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion, with specified limited exceptions; and,
    3. The state shall not deny or interfere with a person’s fundamental right to choose to bear a child or to choose to obtain an abortion, except as specifically permitted. (Hlth & Saf. Code § 123462.)
16. Provides that the state may not deny or interfere with a person’s right to choose or obtain an abortion prior to viability of the fetus or when the abortion is necessary to protect the life or health of the person. (Hlth & Saf. Code § 123466(a).)
17. Prohibits a person from being compelled in a state, county, city, or other local criminal, administrative, legislative, or other proceeding to identify or provide information that would identify or that is related to an individual who has sought or obtained an abortion if the information is being requested based on either another state’s laws that interfere with a person’s rights under subdivision (a) or a foreign penal civil action. (Hlth & Saf. Code § 123466(b).)
18. Prohibits an insurer from refusing to issue or renew, nor shall terminate, professional liability insurance for a health care provider in this state, solely based on any prohibited bases for discrimination including:
    1. A health care provider offers or performs abortion, contraception, gender-affirming health care, or care related to those health care services, that are lawful in this state, including, but not limited to, those that may be unlawful in another state.
    2. Another state’s laws create potential or actual liability for abortion, contraception, gender-affirming health care, or care related to those health care services offered or performed in this state.
    3. Legal or administrative action taken in another state against a health care provider concerning abortion, contraception, gender-affirming health care, or care related to those health care services, results or resulted in a judgment, conviction, or disciplinary action against the provider, if those health care services, as provided, are or would be lawful and consistent with the applicable standard of care in this state. (Ins. Code § 11589.1.)

COMMENTS:

1) Author’s statement. According to the author:

In our current political climate where reproductive freedoms are constantly under threat, personal data privacy has become a key mechanism for defending access to health care. We have all seen the unabashed threat posed by the federal administration regarding reproductive healthcare and the ever-evolving ways used to prosecute individuals accessing these basic rights. In the last few months, it has also become clear the ways in which research projects and data are under threat and can be weaponized against researchers and participants. While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 closes these gaps and protects research records from disclosure in response to a subpoena or other law enforcement request based on other states’ laws interfering with abortion rights and prohibits geofencing an entity that provides in-person health care services.

2) Post-Dobbs access to reproductive healthcare is being restricted across the nation. Roe v. Wade (1973) 410 U.S. 113 was the landmark U.S. Supreme Court decision that held the implied constitutional right to privacy extended to a person’s decision to terminate a pregnancy, while allowing that some state regulation of abortion access could be permissible. Roe has been one of the most debated of all U.S. Supreme Court decisions, and its application and validity have been challenged numerous times, but its fundamental holding had continuously been upheld by the Court until June 2022. On June 24, 2022 the Court published its official opinion in Dobbs and voted 6-3 to overturn the holding in Roe.^[1]

The case involved a Mississippi law enacted in 2018 that banned most abortions after the first 15 weeks of pregnancy, which is before what is generally accepted as the period of viability. (See Miss. Code Ann. § 41-41-191.) The majority opinion in Dobbs upholds the Mississippi law, finding that, contrary to almost 50 years of precedent, there is no fundamental constitutional right to have an abortion. The opinion further provides that states should be allowed to decide how to regulate abortion and that a strong presumption of validity should be afforded to those state laws.

The Roe decision was the foundation for allowing people the ability to control their reproductive lives because it established a federal constitutional right for anyone who could become pregnant in the United States to decide when, and if, to have children and prevented criminalization of the acts of having an abortion or providing an abortion. Prior to Roe, legal abortion did exist in some states, but the choices available to those seeking to terminate an unwanted pregnancy were limited. Restrictions disproportionately affected those who were younger, lower income, and members of communities of color. In the wake of the Dobbs decision, 12 states have initiated near total abortion bans in effect and 6 other states have gestational limits in the first trimester.^[2]

With the announcement of the Dobbs decision, a number of states moved quickly to restrict abortions and punish those who are suspected of helping people obtain them. Oklahoma, for example, passed the nation’s strictest abortion ban in order to immediately end the ability of people in the state to obtain the procedure. The ban allows an abortion in the case of rape or incest, if the pregnant person reports the crime to law enforcement. In addition, the ban authorizes doctors to remove a "dead unborn child caused by spontaneous abortion," or miscarriage, or to remove an ectopic pregnancy, a potentially life-threatening emergency that occurs when a fertilized egg implants outside the uterus, often in a fallopian tube and early in pregnancy. A second Oklahoma bill went into effect in August 2022, which made performing an abortion a felony, with a punishment of up to 10 years in prison and a fine of up to $100,000.^[3]

Most recently, Florida reduced its 15 week abortion ban to six weeks. In response, former White House press secretary Karine Jean-Pierre noted:

This ban would prevent four million Florida women of reproductive age from accessing abortion care after six weeks — before many women even know they're pregnant. This ban would also impact the nearly 15 million women of reproductive age who live in abortion-banning states throughout the South, many of whom have previously relied on travel to Florida as an option to access care.^[4]

Along with the ban, the Florida legislation includes a particularly cruel provision requiring victims of incest or rape to provide written documentation of the crime in order to obtain an abortion between six and 15 weeks.^[5]

Not to be outdone, along with an existing ban on abortions after six weeks, the Governor of Idaho signed a bill into law that makes it illegal for an adult to help a minor get an abortion without parental consent. This law is the first of its kind in the nation, creating the new crime of “abortion trafficking” by barring adults from obtaining abortion pills for a minor or “recruiting, harboring or transporting the pregnant minor” without parental consent. Anyone convicted faces two to five years in prison and can be sued by the minor’s parent. However, parents who rape their child will not be able to sue, but the abortion trafficking criminal penalties will still apply. According to a 2023 Associated Press article, in order to sidestep violating a constitutional right to travel between states, the law makes illegal only the in-state portion of the trip to an out-of-state abortion provider.^[6]

3) California is a reproductive freedom state. The California Supreme Court held in 1969 that the state constitution’s implied right to privacy extends to an individual’s decision about whether or not to have an abortion.^[7] This was the first time an individual’s right to abortion was upheld in a court and came before the Roe decision. In 1972, the California voters passed a constitutional amendment that explicitly provided for the right to privacy in the state constitution.^[8] California statutory law provides, under the Reproductive Privacy Act, that the Legislature finds and declares every individual possesses a fundamental right of privacy with respect to personal reproductive decisions, which entails the right to make and effectuate decisions about all matters relating to pregnancy; therefore, it is the public policy of the State of California that every individual has the fundamental right to choose or refuse birth control, and every individual has the fundamental right to choose to bear a child or to choose to obtain an abortion. (Hlth & Saf. Code § 123462.) In 2019, Governor Newsom issued a proclamation reaffirming California’s commitment to making reproductive freedom a fundamental right in response to the numerous attacks on reproductive rights across the nation.^[9]

In September 2021, over 40 organizations came together to form the California Future Abortion Council (CA FAB) to identify barriers to accessing abortion services and to recommend policy proposals to support equitable and affordable access for not only Californians, but all who seek care in this state. CA FAB issued its first report in December 2021, which included 45 policy recommendations to protect, strengthen, and expand abortion access in California.^[10]

In response to the Dobbs decision and the CA FAB report, California enacted a comprehensive package of legislation, described below, that protects the rights of patients seeking abortion in the state and those supporting them. Additionally, the voters overwhelmingly approved Proposition 1, and enacted an express constitutional right in the state constitution that prohibits the state from interfering with an individual’s reproductive freedom in their most intimate decisions.^[11]

In the last session, several bills were enacted to further protect reproductive rights in California, among them:

1. AB 254 (Bauer-Kahan; Stats 2023, Ch. 254) protects reproductive and sexual health digital data included in personal health tracking applications.

2. AB 352 (Bauer-Kahan; Stats. 2023, Ch. 255) enhances privacy protections for electronic medical records related to abortion, gender affirming care, pregnancy loss, and other sensitive services, closing a major loophole in privacy protections for people traveling to California for abortion and gender affirming care.

3. AB 571 (Petrie-Norris; Stats. 2023, Ch. 256) prohibits an insurer from refusing to provide malpractice insurance to a provider on the basis of them offering abortion, contraception, or gender affirming care that is lawful in California but unlawful in another state.

4. AB 1707 (Pacheco; Stats. 2023, Ch. 258) protects health care providers and facilities in California from state licensing actions against them based on the enforcement of hostile laws that restrict abortion and gender affirming care in another state.

5. SB 345 (Skinner; Stats. 2023, Ch. 260) improves protections for providers against the enforcement of other states’ laws that criminalize or limit reproductive and gender affirming health care services.

7. AB 2085 (Bauer-Kahan; Stats. 2024, Ch. 82) simplifies the permitting process for establishing reproductive health clinics in commercially or medically zoned areas. By requiring ministerial approval, it removes unnecessary delays, facilitating the development of clinics in underserved regions.

8. SB 233 (Skinner; Stats. 2024, Ch. 11) allows Arizona-based abortion providers to obtain temporary licenses to practice in California, thereby expanding access to abortion services.

4) Interstate attacks on healthcare access. As detailed elsewhere in the analysis, many states have enacted reproductive healthcare prohibitions. For example, Texas’ SB 8, also known as the Texas Heartbeat Act, makes it illegal to obtain an abortion in Texas once fetal cardiac activity can be detected. Importantly, this law introduces a private right of action, allowing any citizen to sue someone who performs or assists with an abortion. If the lawsuit is successful, the plaintiff may be awarded a civil penalty of at least $10,000, effectively incentivizing vigilante enforcement of reproductive healthcare restrictions.^[12]

Similarly, 27 states have enacted laws that restrict youth access to gender affirming care.^[13] These laws serve as a basis to punitively target and intimidate patients and healthcare providers, which, regardless of if they are accessing or providing reproductive or gender affirming care, could have a chilling effect on all patients and healthcare providers.

This threat is not theoretical. A New York-based doctor was recently indicted by a grand jury in Louisiana for mailing abortion medication to a pregnant teenager in that state.^[14] The same doctor is also facing criminal charges in Texas for sending abortion medication to a pregnant woman. The Louisiana case is particularly notable, as state officials are seeking to extradite the doctor from New York for prosecution. However, New York, like California, has enacted shield laws that prohibit cooperation with out-of-state legal actions that violate their own state’s laws. These laws mean that New York will not cooperate with requests from either Texas or Louisiana. Governor Kathy Hochul has stated firmly that she will not approve the doctor’s extradition.^[15] Nonetheless, the fact that such cross-state litigation is occurring highlights the very real and harmful consequences for those seeking or providing essential medical care.

5) Geofencing. Geofencing is the practice of creating a virtual perimeter around a specific geographic area. These perimeters can range in size from entire states to a single business or building.^[16] Geofencing works by tracking the IP addresses of devices that enter the defined location. Data brokers can purchase this information and combine it with other consumer data to identify individuals and package the information for various uses. Some businesses use geofencing data to determine which consumers are near their locations, allowing them to send targeted coupons or advertisements to encourage in-store visits. On a more granular level, businesses can analyze movement patterns within a store to determine where customers spend the most time and tailor advertisements or store layouts accordingly.

In a healthcare setting, geofencing is often used to enhance patient safety. Some healthcare facilities use it to monitor who enters and exits, helping to prevent individuals with a history of violence from reentering the premises. Geofencing can also be employed to track patients with neurodegenerative conditions, such as Alzheimer’s disease, to ensure they remain within the facility and receive appropriate care.^[17] Additionally, hospitals may use geofencing to ensure that infants are transported only by authorized personnel, helping to prevent mismatches or abductions.^[18] While these applications offer clear benefits, they also raise concerns. The vast amount of data collected and the relative ease with which it can be accessed push this technology toward a more dystopian territory, especially when considering issues of privacy and surveillance.

This becomes particularly concerning when considering the use of geofencing warrants.^[19] These warrants are issued to tech companies that collect location data and are used after a crime has occurred to access information about every individual who was in the vicinity at the time. While this method can aid in identifying suspects, it also risks implicating innocent bystanders who happened to be nearby. The practice raises serious legal questions about balancing individual privacy rights with law enforcement interests.

Traditionally, law enforcement must demonstrate probable cause and obtain a warrant to investigate a specific suspect. Geofencing warrants, however, often function as broad, sweeping data requests that bypass those individualized requirements. Recently, the Fourth and Fifth Circuit Courts issued conflicting rulings on the constitutionality of geofencing warrants. In both cases, the warrants led to the identification of suspects who were later convicted of robbery. The Fourth Circuit upheld the use of geofencing warrants,^[20] while the Fifth Circuit ruled against that using them was unconstitutional.^[21] These opposing decisions highlight the ongoing uncertainty around how geofencing fits within the framework of Fourth Amendment protections.^[22]

Geofencing and geofencing warrants can become highly punitive when used to enforce laws like the Texas Heartbeat Act. For instance, an individual in Texas could geofence a healthcare facility in California that provides abortion services and track who enters and exits the premises. If they are able to identify a patient from Texas, this data could form the basis of a civil lawsuit under the law’s private right of action provision. That suit could not only endanger the patient, but also the doctor and any individual who “aids or abets” the patient in obtaining abortion care. This kind of surveillance represents a serious threat to privacy and bodily autonomy and directly undermines California’s constitutional protections to the right to privacy and the right to access abortion care.

This can become even more worrisome if extrajudicial means are used to obtain geofenced location data. Specifically, location data brokers collect billions of location data points linked to unique persistent identifiers and timestamps that could give detailed insights into people’s movements. This information is then repackaged and sold to their clients, who often use it to trace the movements of individuals to and from sensitive locations. These include medical facilities, places of religious worship, places used to infer an LGBTQ+ identification, domestic abuse shelters, substance use disorder treatment facilities, and homeless shelters. Further, data collected is not anonymized, it is possible to identify the exact identity of the mobile device owner.

As an example of the information location data brokers are capable of providing, a customer, law enforcement or otherwise, could request individualized data on someone that is traveling to California for reproductive healthcare. They could then ask the broker to track the movements of those mobile devices over a two week period, allowing them to determine where individual the member is staying in California. The customer could then ask the broker to geofence local healthcare facilities and identify if and when the person they are tracking enters into that healthcare facility. This could then be used as the basis for legal recourse. A prohibition of the selling and sharing of location data is also pending in this committee (AB 1355, Ward).

6) Research Privacy. Although patient data is typically protected under HIPAA and CMIA, research data does not have the same protections. The University of California Office of the President writes in a support letter:

Many UC researchers conduct survey- and interview-based research on people about their reproductive health experiences, including research specifically evaluating the effects of new state laws enacted since the Dobbs v. Jackson Supreme Court decision. This data can include information about contraception, abortion care and other individual care information. For example, the UCSF Advancing New Standards in Reproductive Health research program conducted a longitudinal study, known as the Turnaway Study, which examines the effects of unwanted pregnancies on women’s lives. Research assistants interviewed participants by phone over a period of 5 years, and nearly 8,000 interviews were conducted over the course of the project. The main finding of the Turnaway Study is that receiving an abortion does not harm the health and wellbeing of women, but in fact, being denied an abortion results in worse financial, health, and family outcomes. UCSF has published over 50 scientific papers in peer-reviewed journals using data from the Turnaway Study.

Generally, both state and federal laws protect against the disclosure of any medical information relating to seeking or obtaining an abortion that is collected in a clinical setting. However, when an individual discloses this information while participating in research, the same protections against disclosure do not exist. It is critically important that additional protections be in place to ensure that information shared by study participants in the context of a research study be fully protected from subpoena by out-of-state actors seeking to criminalize them for care they might have obtained that is legal in California. Without these protections, the risk to participant confidentiality might be too great, and it might not be possible to continue this kind of research.

Currently, research data is protected under Certificates of Confidentiality (CoCs) only if the research is federally funded. These certificates, issued by agencies such as the National Institutes of Health (NIH) or the Centers for Disease Control and Prevention (CDC), are designed to safeguard identifiable, sensitive information collected during research.^[23] Privately funded research, however, does not automatically receive the same protections. Although such projects can apply for a CoC, approval is at the discretion of the issuing agency, a process that may be especially difficult under the current federal administration that has taken a more critical stance toward certain areas of research. Even when a CoC is granted, disclosure of protected information can still be required under specific federal, state, or local laws. As a result, the current framework for protecting research records could allow for compliance with subpoenas issued by other states, even when those subpoenas are based on laws that contradict California’s legal protections.

7) What this bill would do. Currently, patient data is protected by the Health Insurance Portability and Accountability Act (HIPAA) and the California Medical Information Act (CMIA); however, these laws do not extend protections to information collected by entities that are not healthcare providers, nor do they cover data gathered through research. The policy goals of this bill are to establish stronger privacy protections for healthcare facilities, their patients and visitors, and the research conducted within these institutions.

First, the bill prohibits the selling, sharing, disclosure, or retention of any personal information of individuals present within a healthcare facility, except when necessary for the explicit purpose of providing care. This provision protects both patients and those aiding them, and it establishes a mechanism for legal recourse in cases where a healthcare facility improperly disseminates personal information.

Second, the bill bans the use of geofencing around medical facilities. Specifically, it prohibits the use of geofencing technologies to collect data for the purpose of identifying or tracking patients or healthcare professionals, or for sending notifications and advertisements based on that data. This serves a dual purpose: first, to prevent the use of targeted advertising aimed at discouraging individuals from seeking certain types of care, such as abortions or gender-affirming treatments, and second, to prevent geofenced data from being used as the basis for legal actions, which could be weaponized in other states to deter individuals from accessing healthcare. Importantly, the bill exempts healthcare facilities that use geofencing solely for security or patient protection purposes.

Lastly, the bill strengthens the privacy protections of personally identifiable research records collected at healthcare facilities. This would safeguard data from studies like the UCSF Turnaway Study by prohibiting the release of research records in response to subpoenas that violate California’s Reproductive Privacy Act. Such a provision protects individuals from punitive legal actions by other states seeking to target those receiving healthcare in California.

ARGUMENTS IN SUPPORT: University of California Office of the President writes in support:

AB 45 provides critical privacy protections for researchers, study participants, and patients such as those involved with the Turnaway Study. The research occurring across UC campuses is vital for improving public health, supporting informed decision-making, addressing health disparities and understanding the impact of the Dobbs decision. As a top-tier research institution and a leading health care provider, UC is committed to ensuring that this critical research continues.

While federal regulations cover most health care data privacy issues, there are gaps in coverage when it comes to personal information collected through research and geolocation data. AB 45 protects research records from disclosure in response to a subpoena or other law enforcement request based on another state’s laws that interfere with a person’s right to obtain an abortion and prohibits geofencing an entity that provides in-person health care services. For these reasons, we urge your support on AB 45.

REGISTERED SUPPORT / OPPOSITION:

Support

University of California (Sponsor)
American College of Obstetricians & Gynecologists - District Ix
California Hospital Association
Secure Justice

Opposition

None on file.

Analysis Prepared by: John Bennett / P. & C.P. / (916) 319-2200

1. Dobbs v. Jackson Women’s Health (2022) 597 U.S. __ (142 S.Ct. 2228), accessed at https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf.) ↑

2. KFF, “Abortion in the United States Dashboard” (December 20, 2024), accessed at ↑

3. Associated Press, “Oklahoma governor signs the nation’s strictest abortion ban”, NPR, (May 26, 2022), accessed at https://www.npr.org/2022/05/26/1101428347/oklahoma-governor-signs-the-nations-strictest-abortion-ban ↑

4. Anthony Izaguirre, “DeSantis signs Florida GOP’s 6-week abortion ban into law”, Associated Press (Apr. 14, 2023), accessed at https://apnews.com/article/florida-abortion-ban-approved-c9c53311a0b2426adc4b8d0b463edad1. ↑

5. Associated Press, “Florida has a new abortion ban after 6 weeks, but it can't go into effect yet”, NPR, (April 14, 2023) accessed at https://www.npr.org/2023/04/14/1169933395/florida-gov-desantis-signs-6-week-abortion-ban-bill.) ↑

6. Associated Press, “Idaho governor signs law banning adults from helping minors get abortions”, The Guardian (April 6, 2023), accessed at https://www.theguardian.com/us-news/2023/apr/06/idaho-abortion-trafficking-law-governor ↑

7. People v. Belous (1969) 71 Cal. 2d 954.) ↑

8. Prop. 11, Nov. 7, 1972 gen. elec. ↑

9. California Proclamation on Reproductive Freedom (May 31, 2019), accessed at https://www.gov.ca.gov/wp-content/uploads/2019/05/Proclamation-on-Reproductive-Freedom.pdf.) ↑

10. California Future of Abortion Council, Recommendations to Protect, Strengthen, and Expand Abortion Care in California (Dec. 2021), available at https://www.cafabcouncil.org/_files/ugd/ddc900_0beac0c75cb54445a230168863566b55.pdf.) ↑

11. Nov. 8, 2022 gen. elec. ↑

12. Texas State Law Library, “What does Senate Bill 8 say about abortions?”, (May 16, 2024), accessed at https://www.sll.texas.gov/faqs/abortion-senate-bill-8/. ↑

13. Human Rights Campaign, “Map: Attacks on Gender Affirming Care by State”, (Dec. 4, 2024), accessed at https://www.hrc.org/resources/attacks-on-gender-affirming-care-by-state-map. ↑

14. Pam Belluck, Benjamin Oreskes, and Emily Cochrane, “Abortion Provider Won’t Be Extradited to Louisiana, N.Y. Governor Says”, The New York Times (Feb. 13, 2025), accessed at https://www.nytimes.com/2025/02/13/nyregion/abortion-extradition-louisiana-doctor.html. ↑

15. Ibid. ↑

16. Rahul Awati, “geofencing”, TechTarget (December 2022), accessed at https://www.techtarget.com/whatis/definition/geofencing. ↑

17. Securitas Healthcare, “Location Tracking for Alzheimer’s and Dementia Residents”, (Feb. 17, 2022), accessed at https://www.securitashealthcare.com/blog/location-tracking-alzheimers-and-dementia-residents. ↑

18. Claire Swedberg, “Hybrid RTLS Solution Tracks Infants in Hospitals”, RFID Journals (Oct. 28, 2024), accessed at https://www.rfidjournal.com/news/hybrid-rtls-solution-tracks-infants-in-hospitals/222010/. ↑

19. Prathi Chowdri, “Emerging Tech and Law Enforcement: What Are Geofences and How Do They Work?”, Lexipol (Jan. 4, 2024), accessed at https://www.lexipol.com/resources/blog/emerging-tech-and-law-enforcement-what-are-geofences-and-how-do-they-work/. ↑

20. United States v. Chatrie, 107 F.4th 319 (4th Cir. 2024) ↑

21. United States v. Jamarr Smith, 110 F.4th 817 (5th Cir. 2024) ↑

22. Jackie O'Neil, “Much Ado About Geofence Warrants”, Harvard Law Review (Feb. 18, 2025), accessed at https://harvardlawreview.org/blog/2025/02/much-ado-about-geofence-warrants/. ↑

23. National Institutes of Health, “Certificates of Confidentiality”, (Aug. 2, 2024), accessed at https://grants.nih.gov/faqs#/certificates-of-confidentiality.htm?anchor=55551. ↑