Connected devices: device protection requests.

A 'designated representative of a survivor' can now submit a device protection request to an account manager, expanding who is authorized to act on behalf of a survivor beyond just the survivor or an eligible organization.

New explicit two-business-day deadline: the account manager must either terminate the perpetrator's access and notify the survivor, OR provide a factory reset method. The reset method specifically cannot require a PIN, password, or other access credential, and must be available solely through the survivor's physical proximity to the device.

An account manager shall not deny a device protection request due to arrears accrued by the account or associated with the connected device. This is now a standalone prohibition rather than being buried in a list of conditions.

The list of conditions an account manager cannot impose for processing a request has been expanded with a catch-all: 'any other limitation or requirement not listed under subdivision (b),' making it impossible to add new barriers outside the specified documentation requirements.

The public disclosure requirement has been strengthened from making 'information about the options and process' publicly available to requiring the account manager to 'clearly describe the process...including required documentation and available remedies' on its website and mobile application.

A survivor shall not be financially responsible for any amount incurred or charged to the connected device or associated account by the perpetrator after the perpetrator's access has been terminated under this chapter.

The prohibition on disclosing information to the perpetrator has been strengthened. The old version prohibited providing 'specified information' to the person whose access was terminated; the new version explicitly prohibits notifying the perpetrator of the access termination AND disclosing any data, credentials, or account changes relating to the survivor or any new account created after removal.

Header changed from 'Senate Bill No. 50' with passage dates (Senate Sept 9, Assembly Sept 8) to 'STATE OF CALIFORNIA AUTHENTICATED ELECTRONIC LEGAL MATERIAL' with 'CHAPTER 676' and the Governor's approval date of October 13, 2025.

Page numbering changed from 'SB 50' references starting at page 93 to 'Ch. 676' references starting at page 92, reflecting re-pagination in the chaptered format.

Minor typographic difference in Section 4: 'Article XIIIB' in the enrolled version became 'Article XIII B' (with a space) in the chaptered version.

The bill no longer allows 'eligible organizations' (service providers meeting specific criteria related to domestic violence experience) to submit device protection requests on behalf of survivors. Instead, only a survivor or a 'designated representative of a survivor' may submit a request. The entire definition of 'eligible organization' is removed.

A new exclusion is added to the 'connected device' definition: peripheral or component devices that are solely dependent on a primary connected device for internet connectivity and cannot be independently accessed, remotely disabled, or disconnected by a user or service provider are not covered. This narrows the scope of devices subject to the law.

The old version included a standalone section (22948.33) that allowed an account manager to fully comply with the chapter simply by including a factory reset option accessible via physical proximity to the device. This alternative compliance path is removed in the new version. Factory reset now only serves as a fallback within the main provision when the account manager is unable to directly terminate access.

The list of conditions an account manager may not impose on processing a request is simplified. The old version explicitly prohibited conditioning the request on 'a prohibition or limitation on the ability to deny device or account access to a perpetrator as a result of arrears.' This specific item is removed from the list and instead covered by a separate standalone provision stating the account manager shall not deny a request due to arrears.

Section 22948.31(d)(2) no longer requires the account manager to first be unable to terminate the perpetrator's access before informing the survivor of factory reset methods. Previously, option (2) was conditional: 'If the account manager is unable to terminate the perpetrator's access, the account manager shall provide the survivor with a method...' Now it simply reads: 'Inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or to a similar state that removes all account holders.' This gives account managers a direct choice between terminating access or informing about reset options without needing to demonstrate inability to terminate first.

The definition of 'connected device' now excludes devices that are more than 10 years old or no longer supported by the account manager, in addition to the existing exclusion for peripheral/component devices solely dependent on a primary device. This narrows which devices fall under the bill's protections.

When an account manager is unable to terminate a perpetrator's access, the requirement changed from actively providing the survivor with a reset method to merely informing the survivor, in a clear and conspicuous manner, of any available methods to reset the device. The reset method must still not require a PIN, password, or other credential and must be available by physical proximity alone.

New subdivision (f) in Section 22948.31 prohibits an account manager from providing notice to the person whose access was terminated, and from providing that person any data or information regarding the requester, the device, or any new connected account generated after termination. This prevents perpetrators from learning a survivor filed a protection request.

Subdivision (e) of Section 22948.31 was restructured to more clearly specify that the account manager must notify the survivor or eligible organization of both the intended date of formal notice to the perpetrator and the option to confirm access denial or receive notice that the request is incomplete.

Subdivision (a) of Section 22948.31 had redundant language removed ('Commencing Except as provided' changed to 'Except as provided') and the reference structure was clarified for readability.

A new definition of 'eligible organization' is added, covering governmental or nongovernmental organizations with experience serving victims of domestic violence. These organizations can now submit device protection requests on behalf of survivors, expanding who can trigger the account manager's obligation to terminate a perpetrator's access.

A new section (22948.33) allows an account manager to comply with the device termination requirement by providing a means for a person with physical access to the connected device to reset it to factory settings or a similar state that removes existing account holders, offering an alternative to directly disabling the perpetrator's access.

The fee prohibition is clarified to explicitly cover charges both for submitting a request and for the account manager to carry out the request, applying to both survivors and eligible organizations.

A new exemption (22948.37) carves out entities subject to Chapter 6 of Division 12 of the Vehicle Code (connected and autonomous vehicles) from the bill's requirements, limiting the scope to non-vehicle connected devices.

The 'covered act' definition is broadened: subparagraph (C) now references federal, tribal, or military acts similar to any of subparagraphs (A), (B), (D), or (E), rather than only (A) and (B). This means acts analogous to domestic violence and misdemeanor battery under other legal systems also qualify.

The civil penalty provision is modified to specify 'per violation for each connected device' and adds a requirement that if multiple violations are alleged in a civil action, they must be specifically alleged and the court must make specific findings as to each violation. The injunction language is also expanded from 'prevent a violation' to 'prevent or remedy a violation.'