Technology (Privacy)

Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. Existing law, beginning January 1, 2027, prohibits a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. This bill would prohibit an operating system or an application from undoing a user's affirmative configuration of a user's privacy setting without the user's consent, except as specified. The bill would define "privacy setting" to mean any user-configurable option within an application's privacy, or similarly labeled, menu that governs the application's collection, use, sharing, disclosure, retention, or processing of the user's personal information.

Existing law authorizes designated health care services providers, employees, volunteers, and patients, and individuals who face threats of violence or violence or harassment from the public because of their affiliation with a designated health care services facility, to complete an application to be approved by the Secretary of State for the purposes of enabling state and local agencies to respond to requests for public records without disclosing a program participant's residence address contained in any public record and otherwise provide for confidentiality of identity for that person, subject to specified conditions. Existing law defines "designated health care services" to mean gender-affirming health care services or reproductive health care services. Under existing law, any person who makes a false statement in an application is guilty of a misdemeanor. Existing law prohibits a person, business, or association from knowingly publicly posting or publicly displaying, disclosing, or distributing on internet websites or on social media, the personal information or image of any designated health care services patient, provider, or assistant, or other individuals residing at the same home address, with the intent to incite a third person to cause imminent great bodily harm to the person identified in the posting or display, or to a coresident of that person, as specified, or to threaten the person identified in the posting or display, or a coresident of that person, as specified. Existing law additionally prohibits a person, business, or association from soliciting, selling, or trading on the internet or social media the personal information or image of a designated health care services patient, provider, or assistant with the intent described above. Existing law establishes a cause of action for injunctive or declarative relief for a violation of these prohibitions. Existing law prohibits a person from posting on the internet or social media, with the intent that another person imminently use that information to commit a crime involving violence or a threat of violence against a designated health care services patient, provider, or assistant, or other individuals residing at the same home address, the personal information or image of a reproductive health care services patient, provider, or assistant, or other individuals residing at the same home address. This bill would, commencing October 1, 2027, similarly establish an address confidentiality program for a designated immigration support services provider, employee, or volunteer, as defined, who faces threats of violence or harassment from the public because of their affiliation with a designated immigration support services facility. This bill would additionally prohibit a person, business, or association from soliciting, selling, or trading on the internet the personal information or image of a designated immigration support services provider, employee, or volunteer with the intent described above. The bill would also, among other things, prohibit a person from posting on the internet the personal information or image of a designated immigration support services provider, employee, or volunteer, or other individuals residing at the same home address, with the specific intent that another person imminently use that information to commit a crime involving violence or a threat of violence that is likely to occur against such an individual. The bill would define various terms for these purposes. By imposing new duties on local agencies and creating new crimes, this bill would create a state-mandated local program. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that with regard to certain mandates no reimbursement is required by this act for a specified reason. With regard to any other mandates, this bill would provide that, if the Commission on State Mandates determines that the bill contains costs so mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above.

Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information, as specified. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce those provisions. Existing law requires a retail grocery store or grocery department within a general retail merchandise store that uses a point-of-sale system to have a clearly readable price indicated on 85% of the total number of packaged consumer commodities offered for sale, subject to specified exemptions. This bill would, subject to certain exceptions, prohibit a retailer from engaging in surveillance pricing. The bill would define "surveillance pricing" to mean offering or setting a customized price for a good for a specific consumer or group of consumers, based, in whole or in part, on personally identifiable information, as specified, and determined in whole or in part through the use of any technology, software, program, machine-based system, or computational process that uses statistical modeling, data analytics, artificial intelligence, or other data processing techniques. The bill would also define "surveillance pricing" to mean random variations in prices to different consumers using a website, mobile application, or comparable online technology. The bill would provide that its provisions do not limit or impair any consumer right or remedy available under any other state or federal law. The bill would declare that any waiver of these provisions is against public policy and is void and unenforceable. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.