Existing law requires that a local agency that maintains an internet website for use by the public to ensure that the internet website uses a .gov top-level domain or a .ca.gov second-level domain no later than January 1, 2029. Existing law requires that a local agency that maintains public email addresses to ensure that each email address provided to its employees uses a .gov domain name or a .ca.gov domain name no later than January 1, 2029. Existing law defines local agency for these purposes as a city, county, or city and county.

This bill would expand the definition of local agency to include recast these provisions by instead requiring a city, county, or city and county to comply with the above-described domain requirements and by deleting the term local agency from the above-described provisions. The bill would also require a special district, school district, joint powers authority, or other political subdivision, thereby requiring those entities subdivision to comply with the above-described similar domain requirements. requirements no later than January 1, 2031. The bill would allow a community college district or community college to use a .edu domain to satisfy these requirements. requirements, and would specify that these requirements do not apply to a K12 public school district. By adding to the duties of local officials, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law requires that a local agency that maintains an internet website for use by the public to ensure that the internet website uses a .gov top-level domain or a .ca.gov second-level domain no later than January 1, 2029. Existing law requires that a local agency that maintains public email addresses to ensure that each email address provided to its employees uses a .gov domain name or a .ca.gov domain name no later than January 1, 2029. Existing law defines local government agency for these purposes. purposes as a city, county, or city and county.

This bill would allow a community college district, community college, or other postsecondary institution to use a .edu domain to satisfy these requirements. The bill would also add to expand the definition of local government agency to include a special district, school district, joint powers authority, or other political subdivision. subdivision, thereby requiring those entities to comply with the above-described domain requirements. The bill would allow a community college district or community college to use a .edu domain to satisfy these requirements. By adding to the duties of local officials, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law requires that a local agency that maintains an internet website for use by the public to ensure that the internet website uses a .gov top-level domain or a .ca.gov second-level domain no later than January 1, 2029. Existing law requires that a local agency that maintains public email addresses to ensure that each email address provided to its employees uses a .gov domain name or a .ca.gov domain name no later than January 1, 2029. Existing law defines local government for these purposes.

This bill would allow a community college district, community college, or other postsecondary institution to use a .edu domain to satisfy these requirements. The bill would also add to the definition of local government to include a special district, school district, joint powers authority, or other political subdivision. By adding to the duties of local officials, the bill would impose a state-mandated local program.

The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement.

This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Date of Hearing: May 7, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 810

Author:(Irwin) – As Amended Ver:April 10, 2025

Urgency: No State Mandated Local Program: Yes Reimbursable: Yes

SUMMARY:

This bill adds special districts, joint powers authorities (JPAs), and other political subdivisions to the list of local agencies required to use “.gov” or “.ca.gov” domain names for internet websites and email addresses accessible to the public. This bill allows a community college and community college district to satisfy these requirements with a “.edu” domain.

Specifically, this bill:

1. Requires, no later than January 1, 2031, a special district, joint powers authority, or other political subdivision that maintains a public internet website to use a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Specifies that if a special district, JPA, or other political subdivision that maintains a website for use by the public does not comply with item 1, above, after January 1, 2031, then the special district, JPA, or other political subdivision must redirect that website to a domain name that does comply with item 1, above.
3. Requires, no later than January 1, 2031, a special district, JPA, or other political subdivision that maintains public email addresses for its employees to ensure that each email address provided to its employees uses a “.gov” domain name or a “.ca.gov” domain name.
4. Allows a community college district or community college to use a “.edu” domain name to meet the requirements of items 1 through 3, above.
5. Exempts K-12 public school districts from the bill’s provisions.

FISCAL EFFECT:

Local costs to special districts, JPAs, and others impacted by this bill are unknown, but likely in the high-tens of millions to low-hundreds of millions of dollars statewide. The bulk of these costs will be one-time, likely spread over several years. Although this bill contains local mandate fee disclaimer language, it is unclear on what basis a local agency may charge a fee or other assessment to recover the costs of migrating to a .gov or .ca.gov domain. If this disclaimer does not apply, these costs are potentially reimbursable by the state General Fund, subject to a determination by the Commission on State Mandates (Commission). See comments below.

COMMENTS:

1. Purpose. According to the author:

The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 810 requires special districts, school districts, and JPAs to join cities and counties in the transition of their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.

1. Background. AB 1637 (Irwin), Chapter 586, Statutes of 2023, required city and county government websites to use the “.gov” or “.ca.gov” domain address. Special districts, JPAs, school districts, and other political subdivisions were originally included in AB 1637, but were removed by this committee due to cost and implementation concerns. Community college districts were maintained, but were allowed to use a “.edu” domain. This bill expands the requirements of AB 1637 to re-include special districts, JPAs, and other political subdivisions. K-12 school districts were originally included, but were removed from the bill by the Assembly Committee on Local Government.

Test Claim. In December of 2024, the County of Santa Clara filed a test claim with the Commission seeking a decision regarding the state’s obligation to reimburse the costs of implementing AB 1637. The claim estimates the county’s costs to comply with the mandate at nearly $1 million. The activities necessary to comply with the mandate specified in the claim also apply to special districts under this bill and serve as a reasonable proxy for expected costs.

The Commission has not yet made a decision on this test claim, so it is unknown what level of reimbursement by the state, if any, will be approved and can therefore be expected for other local agencies. Any costs not covered by the state will fall to the local jurisdiction.

Domain names. The top-level domain “.gov” was originally meant to be used by federal, state, and local government entities. The other original top-level domains each had their own particular functions: “.com” was meant for commercial use; “.org” was for nonprofits; “.edu” was for institutions of higher education; “net” was for internet service providers and other entities providing network infrastructure; and “.mil” was for the U.S. Department of Defense (DOD). Some of the original domain requirements remain strictly enforced; no one but the DOD can get a “.mil” domain, and it is difficult for non-educational institutions to obtain an “.edu” domain. Other requirements have not been strictly enforced; anyone can quickly obtain a “.com,” “.net,” or “.org” domain if it is available.

According to the author, it is relatively easy for a fraudulent actor to obtain a domain name similar to that of an existing local governmental agency, also using a non-.gov top level domain, and set up a fake website at that domain. If its content is sufficiently similar to a real government website, search engines may pick up the fake website and display it when people search for the entity.

The Cybersecurity and Infrastructure Security Agency, part of the U.S. Department of Homeland Security, oversees the administration of the .gov domain program. “.gov” is reserved for U.S.-based government organizations and publicly controlled entities. This includes state, tribal, interstate, independent intrastate, city, and county governments.

The California Department of Technology (CDT) administers the “.ca.gov” second-level domain. “.ca.gov” may be used by any state entity, county, city, state-recognized tribal government, JPA, or independent local district within the state. There is no annual fee associated with a .gov or .ca.gov domain name.

EDUCAUSE, a nonprofit association, manages the “.edu” top-level domain, which is intended for accredited U.S. postsecondary institutions and is managed under the authority of the U.S. Department of Commerce, which retains final authority over the membership and operations of the “.edu” domain. EDUCAUSE is authorized to assess a $77 annual registration fee to cover the expenses of managing the domain.

Costs to special districts. California is home to approximately 5,000 special districts, including both independent and dependent districts, JPAs, and others. Special districts’ costs to migrate their systems to a new domain include IT costs, often for vendors, as well as labor costs and indirect costs. Indirect costs may include changes to outreach and promotional materials, business cards, letter head, and elections materials, as well as overall rebranding efforts and media campaigns to alert the public to the name changes. According to CSDA, because special districts provide direct specialized services to residents, many districts rely on customized name identification and brand recognition for outreach and ongoing communication with costumers.

CSDA, which represents over 1,300 organizations, solicited their members for estimated compliance costs for this bill. For small to medium single-focused special districts, the informal sample revealed estimates ranging from $6,000, for a very small sanitary district, to $100,000 for a mosquito and vector control district and several medium-sized water districts. For larger special districts, primarily water and sanitation districts, estimates ranged from $500,000 to $1 million, similar to the estimated costs for larger counties. According to one large water district, “The cost of staff and consulting time, replacement of office supplies, staff apparel, promotional items, and rebuild and rebranding effort just to make the transition would be about $1 million and may impact our water conservation program which requires active customer engagement.”

1. Arguments in Opposition. There is no registered support for this bill. This bill is opposed by CSDA, the Association of California Water Agencies (ACWA), the California Association of Recreation & Park Districts (CARPD), and numerous individual districts. CSDA, ACWA, and CARPD jointly assert:

While applying for and obtaining a .gov domain requires no fees, there are significant costs that an agency must budget for to recode, implement the corresponding e-mail and network login changes, single sign on/multi-factor authentication, encryption keys, revising and redesigning website URLs, and updating public materials, social media, and external entities. The cost of staff and consulting time and rebranding efforts just to make the transition have been identified as major cost drivers by public agencies.

In addition to the fiscal impacts, special district public outreach would be affected by this bill. Special districts intentionally undertake public awareness and outreach campaigns to reduce uncertainty around jurisdictional boundaries and improve familiarity with provided services. AB 810 would require special districts opting for a ca.gov domain to observe the website naming conventions established by the CDT… Unfortunately … various special district outreach websites would be subject to rejection, hindering those outreach programs.

Compounding these concerns is that fact that special districts are more numerous than cities or counties; the potential for conflicts due to sharing similar names or initialisms is increased with the larger population of special districts, which may result in special districts adopting website URLs that are further removed from their previously established identities. Special districts opting for a .gov domain are also not guaranteed requests for their organization’s initials or an abbreviated name.

Analysis Prepared by: Jennifer Swenson / APPR. / (916) 319-2081

Date of Hearing: April 22, 2025

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 810 (

Author:Irwin) – As Amended Ver:April 10, 2025

SUBJECT: Local government: internet websites and email addresses

SYNOPSIS

The internet has enabled the widespread dissemination of information, which governments have leveraged to expand access to programs and keep constituents informed about local events. However, a major challenge remains: ensuring that the information people find online is accurate and trustworthy. To address this, the federal government uses “.gov” and California state government entities use “.ca.gov” domain names, which not only signal legitimacy but also come with built-in cybersecurity protections.

Despite this, not all government agencies are required to use these domains. As a result, many local government entities have adopted alternative domain types such as “.com,” “.net,” or “.org.” This inconsistency has created opportunities for fraudulent actors to register similar-looking domain names, potentially misleading users into sharing personal information, making payments, or consuming false information.

To mitigate this risk, AB 1637 (Irwin, Ch. 586, 2023) was enacted, requiring cities and counties to transition their websites to “.gov” or “.ca.gov” domain names by January 1, 2029, ensuring users can more confidently access authentic government websites.

This author-sponsored bill would, by January 1, 2031, expand that requirement to include special districts, joint powers authorities, and other political subdivisions. The bill allows community colleges and community college districts to continue using “.edu” domains and exempts K–12 school districts. The bill is opposed by a coalition of water districts and the City of Garden Grove.

This bill previously passed the Assembly Local Government Committee on a 9-1 vote.

THIS BILL:

1. Requires, no later than January 1, 2031, a special district, joint powers authority, or other political subdivision that maintains a public internet website to use a “.gov” top-level domain or a “.ca.gov” second-level domain.
2. Requires a special district, joint powers authority, or other political subdivision that maintains an internet website that does not comply with 1) after January 1, 2031 to redirect that internet website to a domain name that does use a “.gov” top-level domain or a “.ca.gov” ” second-level domain.
3. Requires a special district, joint powers authority, or other political subdivision that maintains public email addresses for its employees to ensure that each email address provided to its employees uses a “.gov” domain name or a “.ca.gov” second-level domain no later than January 1, 2031.
4. Permits a community college district or community college to use an “.edu” domain name in place of a “.gov” top-level domain or a “.ca.gov”.
5. Exempts K-12 public school districts.

EXISTING LAW:

1. Establishes the California Department of Technology in the Government Operations Agency (GovOps). (Gov. Code § 11545)
2. Requires a local agency – defined as a city, county, or city and county – that maintains an internet website for use by the public to utilize a “.gov” top-level domain or a “.ca.gov” second-level domain by January 1, 2029. (Gov. Code § 50034)
3. Requires that a local agency that maintains public email addresses for its employees ensure that each email address provided to its employees utilizes a “.gov” domain name or a “.ca.gov” domain name January 1, 2029. (Gov. Code § 50034)
4. Requires a local agency that maintains an internet website for use by the public that does not have a “.gov” top-level domain or a “.ca.gov” to redirect that internet website to a domain name that does use a a “.gov” top-level domain or a “.ca.gov” second-level domain no later than January 1, 2029. (Gov. Code § 50034)
5. Requires every independent special district to maintain an Internet website, but provides an exemption for hardship such as inadequate broadband availability, limited financial resources, or insufficient staff resources. (Gov. Code § 53087.8)

COMMENTS:

1) Author’s statement. According to the author:

The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 810 requires special districts, school districts, and JPAs to join cities and counties in the transition of their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.

2) The Need for this Bill. Last session, the author carried AB 1637, which required city and county government websites to use the “.gov” or “.ca.gov” domain address. This bill would expand this requirement to include special districts, joint powers authorities, and other political subdivisions, except for K-12 school districts..

When one types a URL like https://www.assembly.ca.gov into a Web browser or emails someone at an address such as [email protected], they are implicitly relying on the internet’s domain name system (DNS). The DNS is based on computers, called domain name servers, distributed throughout the global internet to translate human-readable domain names like “assembly.ca.gov” and “asm.ca.gov” into numeric Internet Protocol (IP) addresses. Once the numeric IP address is acquired, data sent on the internet to a particular domain (such as “asm.ca.gov”) can be routed to the computer or network where it is meant to be delivered.

The top-level domain “.gov” was originally meant to be used by federal, state, and local government entities. The other original top-level domains each had their own particular functions: “.com” was meant for commercial use; “.org” was for nonprofits; “.edu” was for institutions of higher education; “net” was for internet service providers and other entities providing network infrastructure; and “.mil” was for the U.S. Department of Defense (DOD). Since then, a plethora of other top-level domains have emerged, such as “.info,” “.biz,” and even “.beer.” Some of the original domain requirements remain strictly enforced; no one but the DOD can get a “.mil” domain, and it is difficult for non-educational institutions to obtain a “.edu” domain. Other requirements have not been strictly enforced; anyone can quickly obtain a “.com,” “.net,” or “.org” domain (to say nothing of “.beer”) if it is available.

It would have been helpful for internet cybersecurity if government entities had been legally required to obtain .gov domain names decades ago. Unfortunately, these requirements were not placed into law, meaning that there has been a proliferation of local government entities using .com, .net, and .org addresses. In part, this is because the process for obtaining a .gov domain can be time-consuming (because the applicant must verify that it is actually a governmental entity), whereas a .com, .net, or .org, domain can be obtained in minutes.

As a result, we now live in a world where Sacramento-Yolo Mosquito and Vector Control District uses the domain “fightthebite.net,” the Metropolitan Water District of Southern California uses the domain “mwdh2o.com,” and the Golden Gate Bridge Highway and Transportation District uses the domain “goldengate.org.” Many other local government agencies have also foregone .gov domains for these quicker-to-obtain alternatives.

The problem is that it is a trivial matter for a fraudulent actor to obtain similar domain names and set up a fake website at that domain. If its content is sufficiently similar to a real website, search engines may pick up the fake website and display it when people search for the entity. Take, for example, Metropolitan Water District of Southern California’s “mwdh2o.com” domain. A search on GoDaddy, a popular, low-cost domain name registrar, revealed that “mwd-h2o.com”, “h2omwd.com”, and “mwdh2o.org” were available. Each could be an easy way to set up a fake Metropolitan Water District of Southern California website.

Because so many local governmental entities don’t have .gov domain names, visitors have no reason to be suspicious of such domains; moreover, there is no quick, convenient way for users to verify the authenticity of the website they are visiting. A fake website that lures in real users who believe they are visiting a legitimate government website could then lure those users into sharing personal information, making payments, and conducting other compromising activities. A fake site could also spread misinformation, such as providing erroneous dates and addresses for voting sites or touting the supposed dangers of vaccines.

In response, this bill would require special districts, joint powers authorities, and other political subdivisions, except for K-12 school districts, to ensure that their public-facing internet websites and email addresses use a “.gov” or “.ca.gov” domain name, no later than January 1, 2031. Under the circumstances that a local government entity already has a website, this bill would require that the original website redirect users to the mandated “.gov” or “ca.gov”. This would ensure that there is no confusion over which website is official for an agency. Community college districts and community colleges may satisfy this requirement using “.edu” domain names.

3) How local governments can obtain .gov and .ca.gov domains. The Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security, leads the federal government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. In 2020, administration of the .gov domain program was transferred from the federal General Services Administration to CISA. The “.gov” domain has been reserved for U.S.-based government organizations and publicly controlled entities. This includes state, tribal, interstate, independent intrastate, city, and county governments. If a local government wishes to obtain a .gov domain, it may follow the instructions available at https://get.gov/registration/requirements/.

The California Department of Technology (CDT) administers the .ca.gov second-level domain. The “.ca.gov” domain may be used by any state entity, county, city, state-recognized tribal government, Joint Powers Authority, or independent local district within the State of California. If a local government wishes to obtain a .ca.gov domain, it can use CDT’s Domain Name Request System, available at https://domainnamerequest.cdt.ca.gov/.

There is no annual fee associated with a .gov or .ca.gov domain name.

4) The contested aspects of this measure are largely in other Committees’ jurisdictions. Most of the opposition’s arguments raise issues that lie in other Committees’ jurisdictions. For example, the Elsinore Valley Municipal Water District writes:

The proposed requirement would be costly to implement. Although changing a domain name may seem simple, in practice it involves updating all public-facing digital and printed materials, migrating employee email systems, coordinating with external vendors, retraining staff, and conducting public outreach. These tasks come with a substantial cost that would ultimately be passed on to local ratepayers.

The question of whether this measure would be a worthwhile use of local government resources for the Assembly Local Government Committee, which heard and passed the bill on a 9-1 vote.

If passed by this Committee, the bill will next be heard by the Assembly Appropriations Committee, which will consider its fiscal impact. Accordingly, the sole focus of this Committee’s analysis are the bill’s impacts on cybersecurity. In this respect, the bill’s benefits undoubtedly outweigh its costs.

5) What are the benefits of this measure for cybersecurity? As discussed above under “Need for this bill,” the main benefit of this measure will be to ensure that members of the public know that when they access a California local governmental website with an internet address ending with “.gov” or “.ca.gov,” or email a government employee at such an address, that they are not going to be the victim of a hacker’s fake website.

While it is of course possible for a “.gov” or “.ca.gov” website to be hacked, this is much more difficult than setting up a fake website using a “.org” or “.net” top-level domain. Moreover, as noted in the Assembly Local Government Committee analysis:

Using a “.gov” domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the “.gov” registrar, which is different than commercial registrars.
2. All new domains are “preloaded.” This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor’s privacy and ensures the content [published on the website] is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.

Eligibility for a “.gov” domain is attested through a letter signed by the public agency. CISA reviews the letter, may review or request founding documentation, and may review or request additional records to verify the public agency’s claim that they are a United States based government organization. There are requirements for choosing a name, and activities that are required and prohibited, among others, for local governments. Requests from non-federal organizations are reviewed in approximately 20 business days, but may take longer in some instances.

The California Special Districts Association, Association of California Water Agencies, and California Association of Recreation and Park Districts in a coalition letter objects on the grounds that the transition could be difficult because the domain name change may be very different from the current domain, writing:

Compounding [our] concerns is the fact that special districts are more numerous than cities or counties; the potential for conflicts due to sharing similar names or initialisms is increased with the larger population of special districts, which may result in special districts adopting website URLs that are further removed from their previously established identities. Special districts opting for a .gov domain are also not guaranteed requests for their organization’s initials or an abbreviated name; districts are similarly admonished that only federal agencies can request generic terms, and URLs must include California’s two-letter state abbreviation or clearly spell out the state name unless city or county exceptions apply.

However, as noted above, similar domain names remain readily available and can be used to deceive or scam individuals within special districts. This transition to standardized domains should also serve to make domain names more intuitive and clearly tied to the purpose of the special district. For example, while “fightthebite.net” used by the Sacramento-Yolo Mosquito and Vector Control District is snappy, it does not clearly convey that it represents a legitimate government agency. Under current rules for “.gov” domains, names must “[r]elate to your organization’s name, location, and/or services.”^[1] This requirement would help ensure that the new “.gov” domains established under this bill are both recognizable and relevant to the jurisdictions they represent. Lastly, this bill requires the redirection of users from previous web addresses to the new “.gov” or “.ca.gov” domains, meaning that the original website would no longer be in use nor accessible, which should dispel any confusion regarding which website is real or correct.

ARGUMENTS IN SUPPORT: None on file.

ARGUMENTS IN OPPOSITION: In opposition to the bill, the City of Garden Grove writes:

While we appreciate the intended goal of this measure and the perceived benefits that utilizing a new domain may provide, we remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses, the confusion that will be created by forcing a new website to be utilized, and the absence of any resources to better assist local agencies with this mandate. Local agencies, including cities and counties, across the state have worked hard to establish reliable websites that are known and trusted by the communities they serve. AB 810 will result in confusion and compromise local communities’ trust in their local leaders, creating frustration in administering a transparent and user-focused government website.

Additionally, while applying for and obtaining a .gov domain requires no fees, there are significant costs that an agency must budget for to recode, implement the corresponding e-mail and network login changes, single sign on/multi-factor authentication, encryption keys, revising and redesigning website URLs, and updating public materials, social media, and external entities. The cost of staff and consulting time and rebranding efforts just to make the transition have been identified as major cost drivers by public agencies. One larger agency has relayed that its tentative estimated costs to implement the transition called for in AB 810 would be between $500,000 to $600,000, plus an added 2,000 staff hours.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

Association of California Water Agencies
California Association of Recreation & Park Districts
California Special Districts Association
City of Garden Grove
El Dorado Irrigation District
Elsinore Valley Municipal Water District
Inland Empire Utilities Agency
Kern County Superintendent of Schools Office
Solano County Water Agency
Water Replenishment District
Water Replenishment District of Southern California

Oppose Unless Amended

California Central Valley Flood Control Association

Analysis Prepared by: John Bennett / P. & C.P. / (916) 319-2200

1. Information regarding “.gov” domain rules can be found at https://get.gov/. ↑

Date of Hearing: April 9, 2025

ASSEMBLY COMMITTEE ON LOCAL GOVERNMENT

Juan Carrillo, Chair

ABPCA Bill Id:AB 810 (

Author:Irwin) – As Amended Ver:March 27, 2025

SUBJECT: Local government: internet websites and email addresses.

SUMMARY: Expands the list of local agencies that are required to use “.gov” or “.ca.gov” domain names for websites and email addresses, and permits community colleges to satisfy these requirements with a “.edu” domain. Specifically, this bill:

1. Applies the expanded definition in 2), below, to the existing requirement for local agencies to, by January 1, 2029, use a “.gov” top-level domain or a “.ca.gov” second-level domain for an internet website maintained by the agency for use by the public and for public email addresses maintained by the agency for its employees.
2. Expands the definition of a “local agency” to include:
3. Special districts;
4. School districts;
5. Joint powers authorities (JPAs); and
6. Other political subdivisions.
7. Permits community college districts and community colleges to use a “.edu” domain name for their internet websites and email addresses.
8. Makes non-substantive technical changes.
9. Provides that if the Commission on State Mandates determines that this bill contains costs mandated by the state, reimbursement to local agencies and school districts for those costs shall be made pursuant to Part 7 (commencing with Section 17500) of Division 4 of Title 2 of the Government Code.

EXISTING LAW: Requires cities and counties that maintain websites for use by the public or public email addresses for use by its employees to utilize a ".gov" or ".ca.gov" domain name. Cities and counties must comply with these requirements by January 1, 2029. (Government Code Section 50034)

FISCAL EFFECT: This bill is keyed fiscal and contains a state-mandated local program.

COMMENTS:

1. Bill Summary and Author’s Statement. This bill adds special districts, school districts, JPAs, and other political subdivisions to the list of local agencies that are required to use “.gov” or “.ca.gov” domain names for internet websites maintained for use by the public and for email addresses maintained for employees. This bill permits community colleges and community college districts to satisfy these requirements with a “.edu” domain. This bill is sponsored by the author.

According to the author, “The public’s trust in government is foundational for a healthy democracy. With rising levels of misinformation and fraud perpetrated online, and more sophisticated threat actors intending to confuse and mislead, we can no longer be haphazard about how governments are presented online. California’s public agencies should take every effort to safeguard the public’s trust in our institutions, especially when they are recommended and offered free of charge by federal and state authorities. AB 810 requires special districts, school districts, and JPAs to join cities and counties in the transition of their websites and e-mails to the .gov or ca.gov domain, so when Californians look for government information or services, they can know with confidence they are receiving official information.”

1. Domain Names. A domain name is a simple, easy-to-remember web address that people use to visit a specific website. Computers translate domain names into numerical identifiers called Internet Protocol (IP) addresses. For example, the domain name “google.com” corresponds to the IP address 142.251.32.46, allowing users to access the same website using either method.

Since desirable domain names are limited, a system called the top-level domain (TLD) was developed to expand available options based on categories and geography. The TLD is the final part of a website name, such as “.com” for commercial sites, “.org” for organizations, “.gov” for government entities, and “.edu” for educational institutions.

Domain names are structured into hierarchical fields separated by periods. The field to the farthest right is the TLD. The field to the immediate left of the TLD is the second-level domain, and so on. For example, the domain name for the California Department of Motor Vehicles (DMV) is dmv.ca.gov, where “gov” is the TLD, “ca” is the second level-domain, and “dmv” is the third-level domain. Additional parts of a web address that follow a forward slash ("/") are called subdirectories. For instance, dmv.ca.gov/portal directs users to a specific section (“portal”) of the DMV website.

1. Cybersecurity and Infrastructure Security Agency and the “.gov” Domain. The Cybersecurity and Infrastructure Security Agency (CISA) leads the federal government’s effort to understand, manage, and reduce risk to cyber and physical infrastructure. CISA sponsors the “.gov” TLD and makes it available solely to United States-based government organizations and publicly controlled entities, including special districts and school districts. According to CISA, “.Gov exists so that the online services of bona fide U.S.-based government organizations are easy to identify on the internet. Increasing and normalizing its use helps the public know where to find official government information – and where not to.”

Upon receiving a request for a “.gov” domain, CISA uses the U.S. Census Bureau’s criteria for classifying governments to help determine eligibility. CISA may ask the applicant for information such as legislation, a charter, or bylaws to verify eligibility. CISA’s review process can take 30 business days, but may take longer depending on the details of the request and volume of requests CISA is receiving. A “.gov” domain is available without a fee for those that qualify.

According to CISA, using a “.gov” domain increases security in the following ways:

1. Multi-factor authentication is enforced on all accounts in the “.gov” registrar, which may not be the case for other commercial registrars.
2. All new domains are “preloaded.” This requires browsers to only use a hypertext transfer protocol secure (HTTPS) connection with a website. This protects a visitor’s privacy and ensures the content published is exactly what is received.
3. A security contact can be added for the domain, making it easier for the public to report potential security issues with the online services.
4. California Department of Technology and the “.ca.gov” Domain. The mission of the California Department of Technology (CDT) is to “partner with state, local government, and educational entities to advance California’s technology and ensure secure, equitable, and reliable solutions through effective policy and oversight, statewide strategies, and innovative services.”

According to CDT, “In order to extend the use of [the .gov] domain to state and local entities, CISA has delegated the State of California authority to administer the “ca.gov” second-level domain.” As part of this delegated authority, the Government Operations Agency (GovOps) is responsible for overseeing the “ca.gov” domain name program and CDT manages the registration, change, and certification process for “ca.gov” domains.

CDT approval is required for any state entity, city, county, and government group that requests to use the ca.gov web domain. Web domains occupying the “ca.gov” domain zone must comply with specific requirements similar to those for “.gov” domains. For example, permitted domain names for local agencies such as JPAs and special districts may include the group’s formal full name per their charter or the acronym of the group’s formal full name.

All entities that use the “.ca.gov” internet domain are required to annually re-certify compliance with state and federal policies. The annual re-certification process validates whether the domain(s) are still in use and the domain complies with federal policy and guidelines. The re-certification also confirms that the contact information associated with the domain is still current. Failure to complete the annual re-certification requirement within ten days of the domain’s expiration date may result in removal of the domain name.

1. EDUCAUSE and the “.edu” Domain. The “.edu” TLD is administered by EDUCAUSE, a nonprofit association whose mission is to advance the strategic use of technology and data to further the promise of higher education. According to the EDUCAUSE website, the .edu domain is one of the seven original top-level subdivisions of the Internet Domain Name System (DNS). The .edu domain is intended for accredited U.S. postsecondary institutions. It is managed under the authority of the United States Department of Commerce, which retains final authority over the membership and operations of the .edu domain. EDUCAUSE administers the .edu domain under a cooperative agreement with the Department of Commerce that requires the approval of both parties in order for substantive changes in domain policies and procedures to take effect.

Under the terms of Amendment 11 of the .edu Cooperative Agreement with the U.S. Department of Commerce, EDUCAUSE is authorized to assess a $77.00 per year registration fee to recoup the expenses of managing the domain.

1. Cybersecurity for School Districts. According to CISA, “There is nothing more important than ensuring the safety and security of our schools from physical and cybersecurity threats alike. Unfortunately, adversaries have targeted our Kindergarten to Twelfth (K-12) education system due to the extensive amounts of personal and financial data they maintain about our kids, teachers, school staff and records on the schools themselves. Yet, most educational districts lack the resources to put in place a comprehensive cybersecurity program. So many of our schools across the nation are, what we call, ‘target rich, cyber poor’ in that they are often a frequent target for ransomware and other cyberattacks due to the extensive data kept on school networks, often without the proper protection. For K-12 schools, cyber incidents are so prevalent that, on average, there is more than one incident per school day.”

CISA recommends that schools take steps to enhance their cybersecurity, including implementing multifactor authentication, identifying and fixing known security flaws, performing backups, minimizing exposure to common attacks, developing a cyber incident response plan, and creating a training and awareness campaign.

1. Impact to K-12 public schools. According to the Assembly Education Committee, “School districts are one type of local educational agency (LEA) that serves kindergarten through grade 12 public school students. Other types of LEAs serving public school students include county offices of education (COEs) and charter schools. It is unclear if the bill also applies to COEs and charter schools.

“LEAs utilize their websites for a number of purposes, but the primary function of a LEA website is to convey information to the public they serve. Information regarding school and LEA boundaries, school calendars, and programs offered often receives the most traffic from users. An LEA is statutorily required to post certain information on their website: two of the most well-known include the LEA’s 3-year plan (also known as the Local Control and Accountability Plan [LCAP]), and information related to filing a complaint (also known as the Uniform Complaint Process [UCP]). As most modes of communication are now provided digitally, rather than through paper and other means, an LEA website is a vital resource for the public school system.

“If this bill were adopted as written, many LEAs report they would be required to abandon their current domain name and find a compliant one. The resulting impact has the potential to be confusing for a community, and particularly for the families served by the LEA. It may take time to transition to a new domain name, and families could be without necessary information for a period of time. Further, with approximately 1,000 school districts, 58 COEs and nearly 1,300 charter schools, it may prove to be challenging finding domain names that are compliant with the bill for all of these LEAs. For example, there are three COEs with names that lend themselves to the same acronym: Alameda COE, Alpine COE, and Amador COE. As a result, their current domain names help to differentiate between the three: www.acoe.org (Alameda COE), www.alpinecoe.k12.ca.us (Alpine COE), and amadorcoe.org (Amador COE). Finally, the impact to this change may be costly for the LEA, and require that the use of already limited funds be directed towards changing domain names that could instead be directed to provide direct resources to students and staff.”

1. State and Local Cybersecurity Grant Program. Through the Infrastructure Investment and Jobs Act (IIJA) of 2021, Congress established the State and Local Cybersecurity Improvement Act, which established the State and Local Cybersecurity Grant Program (SLCGP). The SLCGP helps eligible entities address cybersecurity risks and threats to information systems owned or operated by – or on behalf of – state, local, and territorial governments.

Congress appropriated $200 million for the SLCGP for fiscal year (FY) 2022, $400 million for FY 2023, $300 million for FY 2024, and $100 million for FY 2025. On December 7, 2022, the federal government awarded California $8 million in first-year funding for the SLCGP. The funds are administered by the California Office of Emergency Services (CalOES) and are required to be allocated according to a Cybersecurity Plan, which was developed by a subcommittee of the California Cybersecurity Task Force called the Cybersecurity Investment Planning Subcommittee. The Cybersecurity Plan was approved by the federal government in September 2023.

80% of total state allocations of the SLCGP must support local governments, who are eligible to apply as subapplicants of CalOES and must work with the Cybersecurity Investment Planning Subcommittee to receive subawards. Local agencies may be awarded up to $250,000. In 2024, SLCGP awards were received by 95 local and tribal governments, ranging from elementary schools and community colleges to cities and irrigation districts.

The SLCGP has stated that they will be releasing funding opportunities in 2025 and 2026. It is unclear whether federal funding for local agency cybersecurity will be available beyond 2026.

1. AB 1637 of 2023. AB 1637 (Irwin), Chapter 586, Statutes of 2023, required cities and counties that maintain websites to utilize a “.gov” or “.ca.gov” domain.

On December 16, 2024, the County of Santa Clara filed a test claim with the Commission on State Mandates to seek a decision regarding whether the state must reimburse the costs of implementing AB 1637. According to the test claim, compliance with the mandate requires new activities to be undertaken by employees and third-party professionals working in areas including change management; network, development operations, testing, and security engineering; user experience design; business systems analysis; cloud infrastructure; information security operations; quality assurance; project and change management; solution architecture; and system and application administration. The County must also undertake new activities to inform its employees and the public about its web and email migration, including designing and initiating a public relations campaign; replacing references and links to legacy websites, web applications, and email addresses in the County’s internet resources; and redesigning and reprinting paper documents containing the legacy addresses. As reported in the test claim, the County estimated that the new activities to comply with the mandates will cost the county approximately $918,868. The County estimated statewide costs for all cities and counties to implement AB 1637 to be $90.9 million per fiscal year until the compliance deadline of January 1, 2029, resulting in a total statewide estimated cost of $454.5 million. While the impact to each agency is likely different, it is possible that similar new activities will be required for special districts, school districts, and JPAs to comply with this mandate as were reported in the County of Santa Clara’s test claim. The Commission on State Mandates has not yet made a decision on this test claim, so it is unclear what level of reimbursement will be approved and can therefore be expected for other local agencies.

1. Estimated Costs to Special Districts. The California Special District’s Association (CSDA), which represents over 1,300 organizations, solicited their members for estimated compliance costs for this mandate. The estimates ranged widely, from $6,000 for a small sanitary district with 7 full-time employees, to $1 million for a large water district. Several estimates fell between $50,000 and $100,000. The large water district that estimated $1 million stated, “The cost of staff and consulting time, replacement of office supplies, staff apparel, promotional items, and rebuild and rebranding effort just to make the transition would be about $1M. May impact water conservation program which requires active customer engagement.” One large sanitation agency estimated that implementing this mandate would require approximately 2,000 staff hours and $500,000-$600,000. One small community services district providing water, wastewater and fire services, serving fewer than 500 customers, estimated a cost of $20,000-$25,000 and stated, “Plus, this would add incremental on-going support costs that we do not have today. We may even need to do another rate case to reflect increased operating costs.”
2. Policy Considerations. The Committee may wish to consider the following:
3. Unique Impact to Schools. In addition to the technical, financial, and naming redundancy concerns raised by many local agencies, schools have unique challenges due to their distinct role in the community. A coalition of school districts and educational management organizations note that the staff time and financial resources required to implement AB 810 would divert funds away from the classroom—at a time when many schools are already struggling to balance their budgets. Unlike other local governments, schools generally lack the ability to generate their own revenue.

Moreover, the coalition emphasizes that public schools strive to be seen as part of the “community” rather than the “government.” While this bill aims to improve public confidence in local agencies' websites, the coalition argues that it could have the opposite effect for schools. The coalition also notes that, given that students and families rely on schools for a broad range of essential services, any decrease in trust could have serious implications. The Committee may wish to consider these unique impacts on schools as it evaluates this bill.

1. Timeline. When AB 1637 was chaptered in 2023, it gave cities and counties until January 1, 2029, to transition their domains. This bill extends the same domain change requirement to special districts, school districts, JPAs, and other political subdivisions—but with the same January 1, 2029, deadline. As a result, these local agencies effectively have two fewer years to comply than do cities and counties. The Committee may wish to consider whether the local agencies added by this bill would benefit from additional time to complete the transition.
2. Too Soon to Expand the Scope? When AB 1637 was heard in this committee just two years ago, it applied to counties, cities (including charter cities), towns, schools districts, municipal corporations, districts, political subdivisions, boards, commissions, and other local agencies, but was later amended in the Assembly Appropriations Committee to only apply to cities and counties. While some cities and counties have begun the process of implementing AB 1637, the full scope of the transition’s effects cannot yet be evaluated. The Committee may wish to consider whether the Legislature would benefit from additional time to evaluate the effects of AB 1637 before requiring additional entities to meet these mandates.
3. Committee Amendments. In order to address some of the policy considerations raised above, the Committee may wish to consider the following amendments:
4. Removing school districts from the list of local agencies required to comply with the bill’s mandates.
5. Extending the compliance deadline to January 1, 2031 for special districts, JPAs, and other political subdivisions, not including K-12 public school districts.
6. Previous Legislation. AB 1637 (Irwin), Chapter 586, Statutes of 2023, required cities and counties that maintain websites for use by the public or public email addresses for its employees to utilize a ".gov" or ".ca.gov" domain name.

SB 929 (McGuire), Chapter 408, Statutes of 2018, required all independent special districts, with certain exceptions, to maintain a website.

1. Arguments in Support. None on file.
2. Arguments in Opposition. The California Special Districts Association (CSDA), Association of California Water Districts (ACWA), and California Association of Recreation and Park Districts (CARPD), state, “We remain deeply concerned about the added costs associated with migrating to a new domain and corresponding email addresses, the confusion that will be created by forcing a new website to be utilized, and the absence of any resources to better assist local agencies with this mandate.

“While applying for and obtaining a .gov domain requires no fees, there are significant costs that an agency must budget for to recode, implement the corresponding e-mail and network login changes, single sign on/multi-factor authentication, encryption keys, revising and redesigning website URLs, and updating public materials, social media, and external entities.

“In addition to the fiscal impacts, special district public outreach would be affected by this bill… Special districts intentionally undertake public awareness and outreach campaigns to reduce uncertainty around jurisdictional boundaries and improve familiarity with provided services. AB 810 would require special districts opting for a ca.gov domain to observe the website naming conventions established by the California Department of Technology… Unfortunately … various special district outreach websites would be subject to rejection, hindering those outreach programs.

“Compounding these concerns is the fact that special districts, like school districts, are more numerous than cities or counties; the potential for conflicts due to sharing similar names or initialisms is increased with the larger population of special districts, which may result in special districts adopting website URLs that are further removed from their previously established identities.

“Finally, it is important to note that Assembly Bill 1637 (Chapter 586, Statutes of 2023), the legislation that established these website requirements for cities and counties, provided those types of agencies with over five years’ time to bring their websites and emails into compliance. AB 810 instead would provide special districts, school districts, joint powers authorities, or other political subdivisions with approximately three years to bring their websites into compliance.”

A coalition of school districts and educational management organizations state, “Due to the substantial workload imposed upon districts by this bill, it will pull away the very limited number of IT staff available to our schools. The sheer number of hours and staff time needed to implement the provisions of AB 810 reduces the technology department’s ability to assist other departments – many of which ensure students’ access to educational content and quality instruction.

“To that end, we would point out that AB 810 provides no funding mechanisms to help school agencies implement the provisions of the bill. At a time when many of our schools are already struggling to balance their local budgets, AB 810 would impose yet another unfunded mandate that will siphon dollars away from the classroom where they belong. Furthermore, based on the .gov program parameters it is not clear if schools are eligible to access the limited resources currently available through federal and state programs that provide either direct resources or technical assistance.

“School community members are facing deep fears about the actions of government agencies; to the point of not sending their students to school when there is reported activity by federal immigration agents…We contend that shifting school domains to “.ca.gov” or “.gov” would have the opposite impact of the stated goal of the bill and would in fact decrease trust between us and our local families.

“In addition, schools have the added burden of providing student email addresses. While AB 810 would only apply to employee email addresses this means LEAs will have to maintain two separate domains in order to provide the “.gov” address to employees and the current or alternative domain for student emails. Providing students, who are minors, with “.gov” emails draws out many potential scenarios that run counter to cybersecurity best practices.”

1. Double-Referral. This bill is double-referred to the Assembly Committee on Privacy and Consumer Protection.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file

Opposition

Alameda County Office of Education
Association of California School Administrators
Association of California Water Agencies
California Association of Recreation & Park Districts
California Association of School Business Officials
California County Superintendents
California It in Education
California School Boards Association
California Special Districts Association
El Dorado Irrigation District
Kern County Superintendent of Schools Office
Los Angeles County Office of Education
Los Angeles Unified School District
Office of the Riverside County Superintendent of Schools
San Joaquin County Office of Education
Solano County Water Agency
Water Replenishment District of Southern California

California Central Valley Flood Control Association (unless amended)
Desert Water Agency (unless amended)

Analysis Prepared by: Julia Mouat / L. GOV. / (916) 319-3958