Deepfake pornography.

The bill text was reformatted from the official chaptered document layout (with page numbers, 'STATE OF CALIFORNIA / AUTHENTICATED' header, and legislative formatting) to a web page version that includes site navigation elements such as menus, search fields, and version history links. No changes were made to the substantive legal content.

Fixed a drafting error in Civil Code section 1708.86(c)(2)(A)(ii): changed 'may shall be submitted' to 'shall be submitted' and removed a duplicated word 'entity' that appeared due to a prior amendment.

The legislative counsel's digest was revised from 'knowing and reckless facilitation, aiding, or abetting' to 'knowing facilitation or reckless aiding or abetting,' clarifying that the mental state of 'knowing' applies specifically to facilitation while 'reckless' applies to aiding or abetting. This matches the statutory text in subsection (b)(3) which already used this pairing.

The facilitation standard was simplified from 'knowingly or recklessly facilitates, aids, facilitates or recklessly aids or abets' to 'knowingly facilitates or recklessly aids or abets,' removing redundant language and clarifying that the mental state requirement differs by verb: knowledge for facilitating, recklessness for aiding or abetting.

The evidence submission process for service providers was significantly expanded. Previously, evidence 'may be submitted through a customer service email.' Now it 'shall be submitted through a customer service email or other designated process' that must be prominently displayed on the provider's website. The evidence must include: (1) the name of the deepfake pornography service, (2) a general description of services provided, and (3) contact information of the reporter, which may only be used to seek additional information needed to respond.

The federal law carve-out was clarified by explicitly naming Section 230 of Title 47 of the United States Code (the Communications Decency Act provision), making it clear that conduct protected under Section 230 is exempt from this section's requirements.

The separate cause of action for minors (old subdivision c) was eliminated. All depicted individuals, regardless of age, now fall under a single cause of action in subdivision (b). Previously, adults needed to show the person knew or should have known about lack of consent, while minors had a stricter standard where no knowledge requirement applied at all.

The service provider safe-harbor presumption no longer requires that the provider 'knowingly or recklessly' provided the service. Any person providing a service that enables a deepfake pornography service is now presumed to be in violation if they fail to stop within 30 days of receiving evidence, making it easier to establish liability.

The right to provide evidence triggering the 30-day safe-harbor period was expanded from 'a plaintiff' to 'a depicted individual or public prosecutor,' allowing law enforcement to trigger the clock even when no private plaintiff has filed suit.

The definition of 'depicted individual' was broadened by removing the phrase 'as a result of digitization.' It now simply means 'an individual who is portrayed in sexually explicit material,' potentially covering a wider range of scenarios.

The definition of 'deepfake pornography service' was cleaned up to read 'the primary purpose of which is to create digitized sexually explicit material,' removing contradictory language that had both 'that, through digitization, creates' and 'the primary purpose of which is to create' in the same sentence.

The knowledge standard was changed from 'reasonably should have known' (past tense) to 'reasonably should know' (present tense) throughout, which may affect when the knowledge assessment is made relative to the conduct.

The maximum statutory damages for malicious violations were increased from $150,000 to $250,000 (the non-malicious maximum of $50,000 was unchanged). This appears in both the bill summary and the operative text.

New subdivision (j) exempts internet service providers from liability for the mere transmission, routing, or provision of access to third-party content over their network, and clarifies the bill does not require ISPs to violate California's own internet privacy law (Title 15, Section 3100).

The federal law exemption in subdivision (i) now explicitly names Section 230 of Title 47 of the United States Code (the Communications Decency Act provision that shields online platforms from liability for user-generated content), making clear that conduct protected by Section 230 is not actionable under this bill.

The service provider presumption now applies only to services enabling the 'ongoing operation' of a deepfake pornography service, rather than any operation. The person must 'take all necessary steps to stop providing services' rather than simply 'stop providing services.'

New requirement that evidence demonstrating a violation may be submitted through a customer service email provided by the person or entity, giving victims and prosecutors a specific channel for notification.

Courts may now extend the 30-day compliance period if they find additional time is needed to conduct an ongoing law enforcement investigation or operation.

The person who can provide evidence triggering the presumption changed from 'a plaintiff depicted individual' to simply 'a depicted individual,' removing the requirement that the person be a party to a lawsuit.

In the damages section, the monetary gain recovery language was narrowed from 'creation, development, or creation and disclosure' to just 'creation and disclosure,' potentially limiting the scope of recoverable profits.

Maximum statutory damages for non-malicious violations increased from $30,000 to $50,000, and for malicious violations increased from $150,000 to $250,000.

A new ground for liability was added: an adult depicted individual can sue if the person who created or disclosed the material knew or should have known the individual was a minor when the material was created, even if the individual is now 18 or older.

The definition of 'deepfake pornography service' was narrowed from any service that 'creates digitized sexually explicit material' to one 'the primary purpose of which is to create digitized sexually explicit material,' potentially excluding general-purpose platforms.

The language regarding third-party service providers (such as hosting or infrastructure companies) was changed from a direct finding that they 'are engaged in knowing and reckless facilitation' to a presumption that they are 'in violation,' which may be more easily rebutted in court.

A new subsection (i) was added stating that the section does not apply to conduct that is protected by federal law, creating an explicit federal preemption savings clause.

Assembly Member Berman was added as a co-author along with seven additional coauthors (Bryan, Dixon, Irwin, Lowenthal, Ortega, Pellerin, and Wicks).