The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer's personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA) , approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines "data broker" to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law requires a data broker, in registering with the agency, to pay a registration fee in an amount determined by the agency and provide specified information, including, among other things, the name of the data broker and its primary physical, email, and internet website addresses, and whether the data broker collects the personal information of minors, consumers' precise geolocation, or consumers' reproductive health care data. This bill would require a data broker to provide additional information to the agency, including whether the data broker collects consumers' names, dates of birth, ZIP Codes, email addresses, phone numbers, login or account information, various government identification numbers, mobile advertising, connected television, or vehicle identification numbers, citizenship data, union membership status, sexual orientation status, gender identity and gender expression data, biometric data, and up to 3, but no fewer than one, of the most common types of personal information that the data broker collects, as provided. The bill would also require a data broker to provide information regarding whether, in the past year, the data broker shared or sold consumers' data to a foreign actor, as defined, the federal government, other state governments, law enforcement, as provided, or a developer of a GenAI system, as defined. The bill would make changes to the administrative fines and costs that apply to data brokers who fail to register. Existing law requires, beginning January 1, 2026, the California Privacy Protection Agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, among other things, process a denied request to delete personal information as an opt-out of the sale or sharing of the consumer's personal information under the CCPA, as specified. This bill would require a data broker to process the above-described denied request within 45 days of receiving the request. Existing law requires the agency to create a page on its internet website where registration information provided by data brokers and the accessible deletion mechanism is accessible to the public. This bill would prohibit the agency from making accessible to the public on its internet website information regarding whether the data broker collects consumers' names, dates of birth, zip codes, email addresses, phone numbers, mobile advertising, connected television, or vehicle identification numbers, and the most common types of personal information that it collects. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. This bill would, beginning January 1, 2027, prohibit a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. The bill would require a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the opt-out preference signal. The bill would grant a business that develops or maintains a browser that includes this functionality immunity from liability for a violation of those provisions by a business that receives the opt-out preference signal. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.
Existing law establishes the Medi-Cal program, which is administered by the State Department of Health Care Services, under which qualified low-income individuals receive health care services. The Medi-Cal program is, in part, governed and funded by federal Medicaid program provisions. Under existing law, in-person, face-to-face contact is not required under the Medi-Cal program when covered health care services are provided by video synchronous interaction, asynchronous store and forward, audio-only synchronous interaction, remote patient monitoring, or other permissible virtual communication modalities, when those services and settings meet certain criteria. Existing law required the department, on or before January 1, 2023, to develop a research and evaluation plan that, among other things, proposes strategies to analyze the relationship between telehealth and access to care, quality of care, and Medi-Cal program costs, utilization, and program integrity. The department created that plan in December of 2022 and published the Biennial Telehealth Utilization Report in April of 2024. This bill, the Telehealth for All Act of 2025, would require the department, commencing in 2028 and every 2 years thereafter, to use Medi-Cal data and other data sources available to the department to produce analyses in a publicly available Medi-Cal telehealth utilization report. The bill would authorize the department to include those analyses in each of the department's Biennial Telehealth Utilization Reports, as specified. The bill would require the analyses to address telehealth access and utilization data, including various metrics on telehealth visits and claims, disaggregated by geographic, demographic, and social determinants of health categories to identify disparities. The bill would require the department to identify additional data elements for inclusion in future reports to help to identify and address access-to-care issues or provide greater insight into utilization of telehealth modalities.
Existing law generally governs the transactions between a rental car company, also referred to as a rental company, and its customers, as provided. Existing law prohibits a rental company from using, accessing, or obtaining any information relating to the renter's use of the rental vehicle that was obtained using electronic surveillance technology, as defined, except under specified circumstances. Existing law permits a rental company and a renter to limit the responsibilities of a renter in specified events, including loss due to theft of the rented vehicle up to its fair market value, as provided. Existing law establishes, in the situation described in the previous sentence, a presumption that the renter has no liability for loss due to theft if specified conditions are met, including that an authorized driver has possession of the ignition key or establishes that the ignition key was not in the vehicle at the time of the theft, as provided. This bill would allow a rental company to use geofence technology, as specified, to detect rental vehicle movement in prescribed circumstances. The bill, with respect to the above-described provisions relating to the renter's liability for loss due to theft, would revise the presumption that the renter has no liability for loss due to theft to instead apply this presumption if an authorized driver returns the ignition key.
Existing law provides that it is the intent of the Legislature that all public schools, teaching kindergarten or any of grades 1 to 12, inclusive, operated by a school district, in cooperation with specified entities and individuals, develop a comprehensive school safety plan, as provided. Existing law provides that school districts and county offices of education are responsible for the overall development of a comprehensive school safety plan for each of its schools, as provided. Existing law requires a comprehensive school safety plan to, among other things, identify appropriate strategies and programs that will provide or maintain a high level of school safety and address the school's procedures for complying with existing laws related to school safety. Existing law requires the governing board of a school district, a county board of education, and the governing body of a charter school to, by July 1, 2026, develop and adopt a policy to limit or prohibit the use by its pupils of smartphones while the pupils are at a schoolsite or while the pupils are under the supervision and control of an employee or employees of that school district, county office of education, or charter school. Existing law, however, specifies circumstances in which a pupil may not be prohibited from possessing or using a smartphone, including, among others, in the case of an emergency or in response to a perceived threat of danger. This bill would instead authorize the prohibition on the use of a smartphone by a pupil in the case of an emergency or in response to a perceived threat of danger if that circumstance is explicitly addressed in a comprehensive school safety plan.
Existing law requires an individual or a business that conducts business in California, and that owns or licenses computerized data that includes personal information, to disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was compromised, as specified, and requires that disclosure to be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as specified, or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. This bill would require that data breach disclosure to be made within 30 calendar days of discovery or notification of the data breach but would authorize an individual or business to delay the disclosure to accommodate the legitimate needs of law enforcement, as specified, or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Existing law also requires an individual or business that is required to issue the security breach notification described above to more than 500 California residents as a result of a single breach of the security system to electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General. This bill would require that submission to the Attorney General to be made within 15 calendar days of notifying affected consumers of the security breach.
Existing law establishes the Department of Health Care Access and Information to oversee and administer various health programs related to health care infrastructure, such as health policy and planning, health professions development, and facilities design review and construction, among others. Existing law requires the California Health and Human Services Agency to establish the California Health and Human Services Data Exchange Framework to require the exchange of health information among health care entities and government agencies in the state, among other things. Existing law requires the agency to convene a stakeholder advisory group to advise on the development, implementation, and administration of the California Health and Human Services Data Exchange Framework. This bill would require the Department of Health Care Access and Information, on or before January 1, 2026, to take over the establishment, implementation, and all of the functions related to the California Health and Human Services Data Exchange Framework, including the data sharing agreement and policies and procedures, from the agency. The bill would expand the entities that are specifically required to execute a data sharing agreement with the California Health and Human Services Data Exchange Framework. The bill would require the department, no later than July 1, 2026, to establish a process to designate qualified health information organizations as data sharing intermediaries that have demonstrated their ability to meet requirements of the California Health and Human Services Data Exchange Framework. The bill would require the department, by July 1, 2027, and in collaboration with the stakeholder advisory group, to develop and submit a report to the Legislature on the California Health and Human Services Data Exchange Framework, including compliance with data sharing agreements. The bill would expand the membership of the stakeholder advisory group, as specified.
Under existing law, the residence address, telephone number, and email address of a registered voter is confidential, except that under certain circumstances a county elections official must provide that information to any candidate for federal, state, or local office, to any committee for or against any initiative or referendum measure, and to any person for election, scholarly, journalistic, political, or governmental purposes. This bill would exempt the residence address, telephone number, and email address of a federal, state, or local elected official or candidate from that disclosure requirement, except that the information may be disclosed for journalistic or governmental purposes under specified conditions. The bill would require the Secretary of State to provide each county elections official with a list identifying each federal and state elected official or candidate residing in the county, require the county elections official to add each local elected official or candidate to that list, and require the county elections official to make the elected official or candidate's information confidential within 5 business days. The bill would require the county elections official to exclude the elected official or candidate's confidential information when producing any list, roster, or index. The bill would require an elected official or candidate to contact their county elections official to ensure their voter registration record has been made confidential. The bill would authorize an elected official or candidate to opt out of making their residence address, telephone number, and email address confidential. By adding new duties for county elections officials, this bill would create a state-mandated local program. This bill would incorporate additional changes to Section 2194 of the Elections Code proposed by AB 827 to be operative only if this bill and AB 827 are enacted and this bill is enacted last. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.
Existing law requires the Office of Emergency Services to establish and lead the California Cybersecurity Integration Center. Existing law states that the center's mission is to reduce the likelihood and severity of cyber incidents that could damage California's economy, its critical infrastructure, or public and private sector computer networks in the state. Existing law requires the center to serve as the central organizing hub of state government's cybersecurity activities and coordinate information sharing with specified entities, including local, state, and federal agencies. This bill would require the California Cybersecurity Integration Center to develop, on or before January 1, 2027, in consultation with the Office of Information Security and the Government Operations Agency, a California AI Cybersecurity Collaboration Playbook, as specified, to facilitate information sharing across the cyber and artificial intelligence communities and to strengthen collective cyber defenses against emerging threats. The bill would require the center to review federal requirements, standards, and industry best practices, as specified, and to use those resources to inform the development of the California AI Cybersecurity Collaboration Playbook. Except as specified, the bill would provide that any information related to cyber threat indicators or defensive measures for a cybersecurity purpose shared in accordance with the California AI Cybersecurity Collaboration Playbook is confidential and would prohibit that information from being disclosed, except as specified. The bill would also make findings and declarations related to its provisions. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.
The California Consumer Financial Protection Law requires the Commissioner of Financial Protection and Innovation to prepare and publish on the Department of Financial Protection and Innovation's internet website an annual report detailing actions taken during the prior year under the law and requires the report to include information on actions taken with respect to, among other things, the activities of the Financial Technology Innovation Office. This bill would additionally require the report to include information on actions taken with respect to the Office of the Ombuds.
