Reporting mechanism: child sexual abuse material.

The bill now amends Sections 3273.65, 3273.66, 3273.67, and 3345.1 of the Civil Code in addition to Section 3110, expanding from a pure AI definitions bill to one covering social media platform obligations regarding child sexual abuse material and commercial sexual exploitation.

New definitions added for 'child pornography,' 'child sexual abuse material,' 'identifiable minor,' 'clear and conspicuous,' 'depicted user,' 'minor,' 'obscene matter,' 'reporting user,' 'social media company,' and 'social media platform.' Notably, 'social media company' excludes 501(c)(3) nonprofits, and 'social media platform' excludes end-to-end encrypted direct messaging services and nonprofit-operated platforms.

'Commercial sexual exploitation' is defined as an act committed for the purpose of obtaining property, money, or anything of value in exchange for a sexual act of a minor or nonminor dependent, including sex trafficking, pimping, pandering, procurement of a child under 16 for lewd acts, solicitation of a child, and other specified acts.

The CSAM reporting mechanism must now be 'clear and conspicuous' (previously only 'reasonably accessible'), and platforms must ensure every report receives review by a natural person. Platforms must permanently block reported CSAM, provide written confirmation within 36 hours, send status updates every 7 days, and issue a final written determination, all within 30 days (or 60 days with advance notice of delay).

Social media platforms are prohibited from knowingly facilitating, aiding, or abetting commercial sexual exploitation. A platform is deemed to have knowledge if CSAM was reported through the required mechanism for four consecutive months meeting statutory criteria and the material was first displayed after January 1, 2025.

A safe harbor from the commercial sexual exploitation prohibition is available if a platform submits to biannual third-party audits of its designs, algorithms, practices, affordances, and features; takes mitigating action within 30 days of audit completion; provides audit copies to its board within 90 days; and makes audit reports public within 90 days (with trade secret redactions).

Civil penalties up to $250,000 per day are imposed on social media companies whose reporting mechanism is unavailable or nonfunctional, enforceable by the Attorney General, district attorneys, city attorneys, or county counsel. The Attorney General may also seek injunctive relief to compel restoration of a functional reporting mechanism.

Statutory damages for depicted users range up to $250,000 per violation, reduced to $125,000 if the platform blocked the material before a complaint was filed, or further reduced to $75,000 if the platform participates in NCMEC's Take It Down service, receives hash updates every 36 hours, removes identified CSAM within 36 hours of receiving hashes, reports to CyberTipline, and provides timely confirmations and determinations.

A rebuttable presumption of liability arises if a social media platform fails to comply with reporting obligations within 60 days of material being first reported.

Statutory damages of $1,000,000 to $4,000,000 per act of commercial sexual exploitation are imposed on social media platforms that knowingly facilitate, aid, or abet such exploitation.

A severability clause is added as Section 5, stating that if any provision or its application is held invalid, the remaining provisions continue in effect.

The original AI definitions amendment to Section 3110 is retained but moved from Section 1 to a later section number, and the language 'shall apply' is changed to 'apply' in the introductory clause.