Security surveillance companies: access and use of content.

All amendments to Civil Code Section 1798.29 (data breach notification requirements for state and local agencies) were removed from the bill entirely.

The bill's scope expanded from 'security cameras' to 'security camera surveillance systems,' covering any video, audio, or photographic recording device installed to surveil activity at a residential property.

A new definition of 'express consent' was added requiring affirmative written authorization in response to a clear, meaningful, and prominent notice. It explicitly excludes consent inferred from inaction, obtained through dark patterns (per Civil Code Section 56.18), or buried in general terms and conditions.

A new definition of 'third party' was added, excluding the business the consumer is directly interacting with, its service providers, and contractors from the prohibition.

The definition of 'content' was expanded to explicitly include audio in addition to video, images, and data.

The definition of 'security camera surveillance company' was expanded to include entities that install, sell, or lease security surveillance systems for residential properties, including self-installed systems, and those that store data or provide other services associated with residential surveillance.

The consent requirement was strengthened from general 'consumer's consent' to 'express consent of the consumer AND the adult residents of a residential rental property,' meaning all adults in a rental unit must consent. An exception was added for court orders, subpoenas, or arbitrator orders.

A new Chapter 43 (Section 22949.100) is added to Division 8 of the Business and Professions Code, creating an entirely new regulatory framework for security camera companies that did not exist in the introduced version.

New definitions are established: 'content' (video, images, or data from a security camera), 'security camera' (a device sold to monitor property or a structure for security purposes that captures or records videos or images viewable live or later), and 'security camera company' (an entity that sells security cameras or monitors content obtained from one).

A security camera company is prohibited from distributing, selling, or otherwise authorizing a third party to access, use, or distribute content obtained from a consumer's security camera without first obtaining the consumer's consent.

A security camera company is prohibited from, by default, opting a consumer in to any feature that would distribute, sell, or otherwise authorize a third party to access, use, or distribute content obtained from the consumer's security camera. This means consumers must affirmatively opt in rather than being opted in automatically.

In Section 1798.29 of the Civil Code, the phrase 'Any An agency' is corrected to 'An agency' throughout, fixing a grammatical artifact from prior amendments. No substantive change to the data breach notification requirements.