text:
(a) For purposes of this chapter:

(1) “California Consumer Privacy Act-excluded covered information” or “CCPA-excluded covered information” means covered information that is not subject to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).

(2) “Covered information” means personally identifiable information or materials, in any media or format that meets any of the following:

(A) Is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes.

(B) Is created or provided by an employee or agent of the school or local educational agency to an operator.

(C) Is gathered by an operator through the operation of a site, service, or application described in paragraph (6) and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information.

(3) “K–12 school purposes” means purposes that customarily take place at the direction of the K–12 school, teacher, or local educational agency or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between pupils, school personnel, or parents, or are for the use and benefit of the school.

(4) “Local educational agency” means a school district, county office of education, charter school, or the state special schools for the blind and the deaf.

(5) “National assessment provider” means a person that develops, sponsors, or administers standardized tests.

(6) “Online service” includes cloud computing services, which must comply with this section if they otherwise meet the definition of an operator.

(7) “Operator” means the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.

(8) “Pupil” means a student enrolled in a K–12 course of instruction.

(9) “Standardized test” means a test administered in California at the expense of the test subject that meets either of the following criteria:

(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.

(B) The test is used for preliminary preparation for a test described in subparagraph (A).

(b) An operator shall not knowingly engage in any of the following activities with respect to their site, service, or application:

(1) (A) Engage in targeted advertising on the operator’s site, service, or application, or (B) target advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator’s site, service, or application described in paragraph (6) of subdivision (a).

(2) Use information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a pupil enrolled in a local educational agency, except in furtherance of K–12 school purposes.

(3) Sell a pupil’s information, including covered information. This prohibition does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, provided that the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired pupil information.

(4) Disclose covered information unless the disclosure is made:

(A) In furtherance of the K–12 purpose of the site, service, or application, provided the recipient of the covered information disclosed pursuant to this subparagraph:

(i) Shall not further disclose the information unless done to allow or improve operability and functionality within that pupil’s classroom or school; and

(ii) Is legally required to comply with subdivision (d);

(B) To ensure legal and regulatory compliance;

(C) To respond to or participate in judicial process;

(D) To protect the safety of users or others or security of the site; or

(E) To a service provider, provided the operator contractually (i) prohibits the service provider from using any covered information for any purpose other than providing the contracted service to, or on behalf of, the operator, (ii) prohibits the service provider from disclosing any covered information provided by the operator with subsequent third parties, and (iii) requires the service provider to implement and maintain reasonable security procedures and practices as provided in subdivision (d).

(c) Subdivision (b) does not prohibit the operator’s use of information for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application.

(d) An operator shall do all of the following:

(1) Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(2) (A) Delete a pupil’s covered information if the school or local educational agency requests deletion of data under the control of the school or local educational agency.

(B) This paragraph does not require the deletion of pupil records held by a national assessment provider and that only include standardized test results.

(3) (A) Delete a pupil’s CCPA-excluded covered information under the operator’s control if a pupil’s parent or guardian or, in the case of a former pupil who is 18 years of age or older, the pupil requests an operator to delete the covered information under the operator’s control if the pupil has been no longer enrolled in the local educational agency for at least 60 days.

(B) Before deleting any information described in subparagraph (A), the operator shall require documentation that the pupil is no longer enrolled in the local educational agency.

(C) This paragraph does not require deletion of mandatory permanent pupil records, described in Section 430 of Title 5 of the California Code of Regulations, or any official records or files directly related to a pupil and maintained by the operator, school, or local educational agency, including, but not limited to, records of achievement and results of evaluative tests or records encompassing all the material kept in the pupil’s cumulative folder that is maintained by the school or local educational agency, including, but not limited to, general identifying data, records of attendance and of academic work completed, health data, disciplinary status, test protocols, individualized education programs, or pupil records held by a national assessment provider and that only include standardized test results.

(e) Notwithstanding paragraph (4) of subdivision (b), an operator may disclose covered information of a pupil, as long as paragraphs (1) to (3), inclusive, of subdivision (b) are not violated, under the following circumstances:

(1) If other provisions of federal or state law require the operator to disclose the information, and the operator complies with the requirements of federal and state law in protecting and disclosing that information.

(2) For legitimate research purposes: (A) as required by state or federal law and subject to the restrictions under applicable state and federal law or (B) as allowed by state or federal law and under the direction of a local educational agency or state department of education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the pupil for purposes other than K–12 school purposes.

(3) To a state or local educational agency, including schools of local educational agencies, for K–12 school purposes, as permitted by state or federal law.

(f) This section does not prohibit an operator from using deidentified pupil covered information as follows:

(1) Within the operator’s site, service, or application or other sites, services, or applications owned by the operator to improve educational products.

(2) To demonstrate the effectiveness of the operator’s products or services, including in their marketing.

(g) This section does not prohibit an operator from sharing aggregated deidentified pupil covered information for the development and improvement of educational sites, services, or applications.

(h) This section does not limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction.

(i) This section does not limit the ability of an operator to use pupil data, including covered information, for adaptive learning or customized pupil learning purposes.

(j) This section does not apply to general audience internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator’s site, service, or application may be used to access those general audience sites, services, or applications.

(k) This section does not limit internet service providers from providing internet connectivity to schools or pupils and their families.

(l) This section does not prohibit an operator of an internet website, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section.

(m) This section does not impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software.

(n) This section does not impose a duty upon a provider of an interactive computer service, as defined in Section 230 of Title 47 of the United States Code, to review or enforce compliance with this section by third-party content providers.

(o) This section does not impede the ability of pupils to download, export, or otherwise save or maintain their own pupil-created data or documents.

(p) This section shall not be interpreted to limit or supersede any rights or requirements under the federal Individuals with Disabilities Education Act (20 U.S.C. Sec. 1400 et seq.), the Rehabilitation Act of 1973 (29 U.S.C. Sec. 701 et seq.), and any rules or regulations promulgated pursuant to those laws.

history: (History: Amended by Stats. 2024, Ch. 935, Sec. 2. (AB 801) Effective January 1, 2025.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2. K–12 Pupil Online Personal Information Protection Act


kind: section

code: BPC

text: This chapter shall become operative on January 1, 2016.

history: (History: Added by Stats. 2014, Ch. 839, Sec. 1. (SB 1177) Effective January 1, 2015. Section operative January 1, 2016, by its own provisions.)

division: 8. SPECIAL BUSINESS REGULATIONS

chapter: 22.2. K–12 Pupil Online Personal Information Protection Act


text:
For purposes of this chapter:

(a) “Covered information” means personal information provided by an individual, or the individual’s parent or legal guardian, to a national assessment provider for the purposes of administering, or publishing or distributing the scores with respect to, a standardized test.

(b) “National assessment provider” means a person that develops, sponsors, or administers standardized tests.

(c) “Personal information” has the same meaning as defined in Section 1798.140 of the Civil Code.

(d) (1) “Standardized test” means a test administered in California at the expense of the test subject that meets either of the following criteria:

(A) The test is used for the purposes of admission to, or class placement in, postsecondary educational institutions or their programs.

(B) The test is used for preliminary preparation for a test described in subparagraph (A).

(2) “Standardized test” does not mean a test administered for K–12 purposes, as defined in Section 22584.

history: (History: Added by Stats. 2024, Ch. 508, Sec. 1. (AB 1971) Effective January 1, 2025.)

chapter: 22.2.3. National Assessment Providers

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2.3. National Assessment Providers


text:
(a) A national assessment provider shall not knowingly do any of the following with respect to its administration of, or publishing or distributing the scores with respect to, a standardized test:

(1) (A) Except as provided in subparagraph (B), sell covered information.

(B) A national assessment provider may sell covered information if either of the following apply:

(i) The sale is incident to the purchase, merger, or other type of acquisition of a national assessment provider by another entity, if that entity complies with this chapter as if it were a national assessment provider.

(ii) (I) The sale is to colleges, universities, financial aid and scholarship agencies, government agencies, and organizations that offer educational, community involvement, extracurricular, and career opportunities products and services solely to provide access to employment, educational scholarships or financial aid, or educational opportunities.

(II) This clause applies only if the individual, or the individual’s parent or legal guardian, identified by the covered information expressly consented to the sale of the covered information.

(2) Disclose covered information to a third party, including, but not limited to, social media providers through cookies, pixels, or similar tracking technologies on the national assessment provider’s internet website.

(3) Disclose covered information unless any of the following is true:

(A) (i) The disclosure is made in furtherance of the purposes of the standardized test, including, but not limited to, disclosure to postsecondary institutions, scholarship providers, or government agencies for the purpose of an individual’s admission, course credit, or placement in an institution or facilitating an individual’s eligibility for recognition, a scholarship, or financial aid.

(ii) This subparagraph applies only if the individual identified by the covered information expressly consented to the disclosure, and the recipient of the covered information agreed not to further disclose the information without the consent of the individual or as required by law.

(B) The disclosure is made to ensure legal and regulatory compliance.

(C) The disclosure is made to respond to, or participate in, judicial process.

(D) The disclosure is made to protect personal safety or the safety of others.

(E) The disclosure is made to a service provider if a national assessment provider contractually does all of the following:

(i) Prohibits the service provider from using any covered information for a purpose other than providing the contracted service to, or on behalf of, the national assessment provider.

(ii) Prohibits the service provider from disclosing any covered information provided by the national assessment provider to other third parties.

(iii) Requires the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(F) The disclosure is made for legitimate research purposes required by state or federal law.

(G) The disclosure is made to a state or local educational agency, including a school or school district.

(H) The disclosure is made to a parent or legal guardian of the individual identified by the covered information if that individual is under the age of 18.

(b) This section does not prohibit a national assessment provider from using covered information for maintaining, developing, supporting, improving, or diagnosing the national assessment provider’s programs and services.

(c) A national assessment provider shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(d) If there is a conflict between any other law, including the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code) and this chapter, the law that affords the greatest protection of the right of privacy shall control.


text:
(a) For purposes of this chapter:

(1) “California Consumer Privacy Act-excluded covered information” or “CCPA-excluded covered information” means covered information that is not subject to the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100) of Part 4 of Division 3 of the Civil Code).

(2) “Covered information” means personally identifiable information or materials, in any media or format that meets any of the following:

(A) Is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for preschool and prekindergarten purposes.

(B) Is created or provided by an employee or agent of the preschool, prekindergarten, school district, local educational agency, or county office of education, to an operator.

(C) Is gathered by an operator through the operation of a site, service, or application described in paragraph (4), and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information.

(3) “Online service” includes cloud computing services, which must comply with this section if they otherwise meet the definition of an operator.

(4) “Operator” means the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes.

(5) “Preschool or prekindergarten purposes” means purposes that customarily take place at the direction of the preschool, prekindergarten, teacher, or school district, or aid in the administration of preschool or prekindergarten activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between pupils, preschool or prekindergarten personnel, or parents, or are for the use and benefit of the preschool or prekindergarten.

(6) “Pupil” means a child enrolled in a preschool or prekindergarten course of instruction.

(b) An operator shall not knowingly engage in any of the following activities with respect to their site, service, or application:

(1) (A) Engage in targeted advertising on the operator’s site, service, or application.

(B) Target advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator’s site, service, or application described in paragraph (4) of subdivision (a).

(2) Use information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a pupil, except in furtherance of preschool or prekindergarten purposes.

(3) Sell a pupil’s information, including covered information. This prohibition does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, provided that the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired pupil information.

(4) Disclose covered information unless the disclosure is made:

(A) In furtherance of the preschool and prekindergarten purposes of the site, service, or application, provided that the recipient of the covered information disclosed pursuant to this subparagraph:

(i) Shall not further disclose the information unless done to allow or improve operability and functionality within that pupil’s preschool or prekindergarten.

(ii) Is legally required to comply with subdivision (d);

(B) To ensure legal and regulatory compliance;

(C) To respond to or participate in a judicial process;

(D) To protect the safety of users or others or security of the site; or

(E) To a service provider, provided the operator contractually (i) prohibits the service provider from using any covered information for any purpose other than providing the contracted service to, or on behalf of, the operator, (ii) prohibits the service provider from disclosing any covered information provided by the operator with subsequent third parties, and (iii) requires the service provider to implement and maintain reasonable security procedures and practices as provided in subdivision (d).

(c) Subdivision (b) does not prohibit the operator’s use of information for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application.

(d) An operator shall do all of the following:

(1) Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

(2) Delete a pupil’s covered information if the preschool, prekindergarten, or district requests deletion of data under the control of the preschool, prekindergarten, or district.

(3) (A) Delete a pupil’s CCPA-excluded covered information under the operator’s control if a pupil’s parent, guardian, or education rights holder or, in the case of a former pupil 18 years of age or older, the pupil requests an operator to delete the covered information under the operator’s control if the pupil has been no longer enrolled in the preschool, prekindergarten, or district for at least 60 days.

(B) Before deleting any information described in subparagraph (A), the operator shall require documentation that the pupil is no longer enrolled in the preschool, prekindergarten, or district.

(e) Notwithstanding paragraph (4) of subdivision (b), an operator may disclose covered information of a pupil, as long as paragraphs (1) to (3), inclusive, of subdivision (b) are not violated, under the following circumstances:

(1) If other provisions of federal or state law require the operator to disclose the information, and the operator complies with the requirements of federal and state law in protecting and disclosing that information.

(2) For legitimate research purposes: (A) as required by state or federal law and subject to the restrictions under applicable state and federal law or (B) as allowed by state or federal law and under the direction of a preschool, prekindergarten, school district, or state department of education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the pupil for purposes other than preschool and prekindergarten purposes.

(3) To a state or local educational agency, including preschools, prekindergartens, and school districts, for preschool and prekindergarten purposes, as permitted by state or federal law.

(f) This section does not prohibit an operator from using deidentified pupil covered information as follows:

(1) Within the operator’s site, service, or application or other sites, services, or applications owned by the operator to improve educational products.

(2) To demonstrate the effectiveness of the operator’s products or services, including in their marketing.

(g) This section does not prohibit an operator from sharing aggregated deidentified pupil covered information for the development and improvement of educational sites, services, or applications.

(h) This section does not limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction.

(i) This section does not limit the ability of an operator to use a pupil’s data, including covered information, for adaptive learning or customized early learning purposes.

(j) This section does not apply to general audience internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator’s site, service, or application may be used to access those general audience sites, services, or applications.

(k) This section does not limit internet service providers from providing internet connectivity to preschools, prekindergartens, or pupils and their families.

(l) This section does not prohibit an operator of an internet website, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section.

(m) This section does not impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software.

(n) This section does not impose a duty upon a provider of an interactive computer service, as defined in Section 230 of Title 47 of the United States Code, to review or enforce compliance with this section by third-party content providers.

(o) This section does not impede the ability of pupils to download, export, or otherwise save or maintain their own personally created data or documents.

(p) This section shall not be interpreted to limit or supersede any rights or requirements under the federal Individuals with Disabilities Education Act (20 U.S.C. Sec. 1400 et seq.), the Rehabilitation Act of 1973 (29 U.S.C. Sec. 701 et seq.), and any rules or regulations promulgated pursuant to those laws.

history: (History: Amended by Stats. 2024, Ch. 935, Sec. 3. (AB 801) Effective January 1, 2025.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2.5. Early Learning Personal Information Protection Act


text: This chapter shall become operative on July 1, 2017.

history: (History: Added by Stats. 2016, Ch. 620, Sec. 1. (AB 2799) Effective January 1, 2017. Note: This section prescribed a delayed operative date for Ch. 22.2.5, commencing with Section 22586.)

chapter: 22.2.5. Early Learning Personal Information Protection Act


text:
(a) Notwithstanding Section 22584 of the Business and Professions Code, a business providing proctoring services in an educational setting shall collect, use, retain, and disclose only the personal information strictly necessary to provide those services.

(b) This section shall not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for any of the following:

(1) To comply with federal, state, or local law.

(2) To comply with a court order or subpoena.

(3) To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.

(A) A law enforcement agency may direct a business, pursuant to a law enforcement agency-approved investigation with an active case number, not to delete a consumer’s personal information, and, upon receipt of that direction, a business shall not delete the personal information for 90 days, in order to allow the law enforcement agency to obtain a court order or subpoena to obtain the consumer’s personal information.

(B) A business that has received direction from a law enforcement agency not to delete a consumer’s personal information that otherwise would not be permissible to retain or disclose pursuant to this section shall not use or disclose the consumer’s personal information for any purpose except in response to a court order or subpoena.

(4) To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.

(5) To cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:

(A) The request is approved by a high-ranking agency officer for emergency access to a consumer’s personal information.

(B) The request is based on the agency’s good faith determination that it has a lawful basis to access the information on a nonemergency basis.

(C) The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.

(6) To exercise or defend a legal claim.

(c) For purposes of this section, “personal information” has the same meaning as in Section 1798.140 of the Civil Code.

(d) For purposes of this section, “proctoring services” includes, but is not limited to, services offered by a business to observe, monitor, or administer an exam.

history: (History: Added by Stats. 2022, Ch. 720, Sec. 1. (SB 1172) Effective January 1, 2023.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2.7. Student Test Taker Privacy Protection Act


text:
For purposes of this chapter:

(a) (1) “Content” means statements or comments made by users and media, including audio, pictures, video, and text, that are created, posted, shared, or otherwise interacted with by users on an internet-based service or application.

(2) “Content” does not include media put on a service or application exclusively for the purpose of cloud storage, transmitting files, or file collaboration.

(b) “Cyberbullying” means any severe or pervasive conduct made by an electronic act or acts, as defined in paragraph (2) of subdivision (r) of Section 48900 of the Education Code and Section 22589, committed by a person directed toward another person that has or can be reasonably predicted to have the effect of one or more of the following:

(1) Placing a reasonable person in fear of bodily harm or harm to that person’s property.

(2) Causing a reasonable person to experience a substantially detrimental effect on the person’s physical or mental health.

(3) Causing a reasonable person to experience substantial interference with the person’s academic performance.

(4) Causing a reasonable person to experience substantial interference with the person’s ability to participate in or benefit from the services, activities, or privileges provided by a school.

(c) (1) “Large social media platform” means a social media platform that meets all of the following criteria:

(A) The social media platform’s terms of service do not prohibit the use of the social media platform by a child.

(B) The social media platform includes features that enable a child to share images, text, or video through the internet with other users of the social media platform whom the child has met, identified, or become aware of solely through the use of the social media platform.

(C) The social media platform has more than 100,000,000 monthly global active users or generates more than one billion dollars ($1,000,000,000) in gross revenue per year, adjusted yearly for inflation.

(2) “Large social media platform” does not include any of the following:

(A) A service that primarily serves to facilitate the sale or provision of professional services or the sale of commercial products.

(B) A service that primarily provides news or information and does not offer the ability for content to be sent by a user directly to a child.

(C) A service that has features that enable a user who communicates directly with a child through a message, including a text, audio, or video message, not otherwise available to other users of the service, to add other users to that message that the child may not have otherwise met, identified, or become aware of solely through the use of the service and does not have any features described in subparagraph (B) of paragraph (1).

(d) “Public or semipublic internet-based service or application” does not include a service or application used to facilitate communication within a business or enterprise among employees or affiliates of the business or enterprise, if access to the service or application is restricted to employees or affiliates of the business or enterprise using the service or application.

(e) “Risk” means a social media-related threat that more likely than not will cause harm to a child.

(f) “Severe risk” means a social media-related threat that more likely than not will cause serious bodily or mental harm to a child.

(g) “Social media platform” has the same meaning as defined in Section 22675.

(h) “Social media-related threat” means content that promotes, incites, facilitates, or perpetrates any of the following:

(1) Suicide.

(2) Disordered eating.

(3) Drug trafficking.

(4) Substance abuse.

(5) Fraud.

(6) Human trafficking punishable pursuant to Section 236.1 of the Penal Code.

(7) Sexual abuse.

(8) Cyberbullying.

(9) Harassment.

(10) Distribution of harmful matter, as defined by Section 313 of the Penal Code.

(i) “Substantively respond” means to inform a person who makes a report pursuant to Section 22588.3 that the content being reported meets either of the following criteria:

(1) The content does not violate the terms of service of the large social media platform.

(2) The content violates the terms and conditions of the large social media platform.

(j) “Terms of service” means a public-facing policy or set of policies adopted by a social media platform that specifies, at least, the user behavior and activities that are permitted on the social media platform and the user behavior and activities that may result in the social media platform taking action against the user or content.

(k) “Verified reporter” means an individual described in, and verified by, the process required by subdivision (b) of Section 22588.3.

history: (History: Added by Stats. 2024, Ch. 832, Sec. 1. (AB 2481) Effective January 1, 2025. Operative January 1, 2026, pursuant to Section 22588.4.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2.8. Youth Social Media Protection Act


text:
(a) A social media platform shall disclose all social media-related threat reporting procedures for verified reporters described in subdivision (b) in the social media platform’s terms of service.

(b) A large social media platform shall create a process to verify both of the following individuals as verified reporters:

(1) A principal, or a position of similar responsibility, of any school lawfully operating any programs from kindergarten and grades 1 to 12, inclusive, in the state.

(2) A mental health professional licensed pursuant to California law who provides mental health services to minors in the state.

(c) In addition to any other reporting mechanism required by state law, a large social media platform shall create a process by which a verified reporter can make a report of a social media-related threat or a violation of the large social media platform’s terms of service that in the verified reporter’s opinion poses a risk or a severe risk to the health and safety of a minor that does all of the following:

(1) Enables, but does not require, an individual to upload a screenshot of the content that contains a social media-related threat or violates the terms of service.

(2) Provides all verified reporters with an electronic point of contact specific to matters involving harms to a minor.

(3) Provides confirmation of the receipt of a submitted report and a means to track that report.

(d) A large social media platform shall do both of the following:

(1) Establish an internal process to receive and substantively respond within 72 hours, or within 24 hours if the report is of a severe risk, to a report by a verified reporter of content the verified reporter deems to be a risk to a minor.

(2) Ensure that a report submitted by a verified reporter and deemed by the verified reporter to be of a severe risk receives a review by a natural person.

(e) A large social media platform that receives a report from a verified reporter shall, on a publicly accessible internet website, report annually on all of the following:

(1) The total number of reports from a verified reporter received for the calendar year.

(2) The percentages of each social media-related threat that formed the basis for the total number of reports from verified reporters for the calendar year.

(3) The percentage of reports from verified reporters for which the large social media platform took further action.

(f) A large social media platform shall not require a verified reporter to reverify the verified reporter’s qualifications pursuant to subdivision (b) more often than once every two years.

chapter: 22.2.8. Youth Social Media Protection Act


text: This chapter shall become operative on January 1, 2026.

history: (History: Added by Stats. 2024, Ch. 832, Sec. 1. (AB 2481) Effective January 1, 2025.)


text:
For purposes of this chapter:

(a) (1) “Content” means statements or comments made by users and media that are created, posted, shared, or otherwise interacted with by users on an internet-based service or application.

(2) “Content” does not include media put on a service or application exclusively for the purpose of cloud storage, transmitting files, or file collaboration.

(b) “Cyberbullying” means any severe or pervasive conduct made by an electronic act, as defined in paragraph (2) of subdivision (r) of Section 48900 of the Education Code, committed by a person or group of people directed toward one or more minors that has, or can be reasonably predicted to have, the effect of any of the following:

(1) Placing a reasonable minor in fear of harm to that minor’s person or property.

(2) Causing a reasonable minor to experience a substantially detrimental effect on the minor’s physical or mental health.

(3) Causing a reasonable minor to experience substantial interference with the minor’s academic performance.

(4) Causing a reasonable minor to experience substantial interference with the minor’s ability to participate in, or benefit from, the services, activities, or privileges provided by a school.

(c) (1) “Severe or pervasive conduct” includes only content that has, or can be reasonably predicted to have, the harmful, detrimental, or substantially interfering effects described in paragraphs (1) to (4), inclusive, of subdivision (b).

(2) “Severe conduct” includes conduct that has, or can be reasonably predicted to have, the harmful, detrimental, or substantially interfering effects described in paragraphs (1) to (4), inclusive, of subdivision (b). Severe conduct may also include content that does any of the following:

(A) Calls for self-injury or suicide of a minor or a specific person or of a group of individuals related to a minor.

(B) Attacks a minor based on the minor’s experience of sexual assault, sexual exploitation, sexual harassment, or domestic abuse.

(C) Includes statements of intent to engage in a sexual activity or advocating to engage in a sexual activity with a minor.

(D) Threatens to release a minor’s telephone number, residential address, images, or email address.

(E) Calls for, or statements of intent to engage in, threats of violence, humiliation, or criminal activity against a minor.

(F) Degrades, or expresses disgust toward, a minor who is depicted in the process of, or right after, menstruating, urinating, vomiting, or defecating.

(G) The identification in this paragraph of particular bases of severe conduct is illustrative rather than restrictive.

(d) “Social media platform” has the same meaning as defined in Section 22675.

(e) “Public or semipublic internet-based service or application” excludes a service or application used to facilitate communication within a business or enterprise among employees or affiliates of the business or enterprise, provided that access to the service or application is restricted to employees or affiliates of the business or enterprise using the service or application.

(f) “Terms of service” means a public-facing policy or set of policies adopted by a social media platform that specifies, at least, the user behavior and activities that are permitted on the social media platform and the user behavior and activities that may result in the social media platform taking action against the user or content.

history: (History: Amended by Stats. 2024, Ch. 900, Sec. 1. (SB 1504) Effective January 1, 2025.)

chapter: 22.2.9. Cyberbullying Protection Act

path: 8. SPECIAL BUSINESS REGULATIONS > 22.2.9. Cyberbullying Protection Act


text:
(a) A social media platform shall disclose all cyberbullying reporting procedures in the social media platform’s terms of service.

(b) (1) A social media platform shall establish a prominent mechanism within its internet-based service that allows any individual, whether or not that individual has a profile on the internet-based service, to report cyberbullying or any content that violates the existing terms of service related to cyberbullying.

(2) The mechanism required by this subdivision shall meet all of the following criteria:

(A) The mechanism shall allow, but not require, an individual to upload a screenshot of the content that contains cyberbullying or violates the terms of service related to cyberbullying and collect basic identifying information, such as an account identifier, sufficient to permit the social media platform to locate the reported material.

(B) The mechanism shall include, but not be limited to, a method of contacting a reporting individual in writing by a method, including a telephone number for purposes of sending text messages, an email address, or other reasonable electronic method of communication.

(C) A social media platform may offer any other reasonable electronic method of communication in addition to those described in subparagraph (B). A social media platform shall inform a reporting individual of all options for a platform to contact the reporting individual in writing regarding their report, including, but not limited to, the methods listed in subparagraph (B). The reporting individual shall choose the method of communication.

(D) The mechanism provides, within 36 hours of receipt of a report, written confirmation to the reporting individual that the social media platform received that individual’s report.

(E) (i) The mechanism provides periodic written updates to the reporting individual as to the status of the social media platform’s handling of the reported material using the reporting individual’s chosen method of communication, pursuant to subparagraph (C).

(ii) The first written update required by clause (i) shall be provided as soon as reasonably feasible but no later than 14 days after the date on which the written confirmation required under subparagraph (D) is provided. Subsequent written updates shall be provided as soon as reasonably feasible but no later than every 14 days thereafter, until the final written determination required by subparagraph (F).

(F) (i) Except as provided in clause (ii), the mechanism issues a final written determination to the reporting user within 30 days of receiving the report stating one of the following:

(I) The reported material has been determined to be cyberbullying that was displayed, stored, or hosted on the social media platform and has been blocked from being viewable on the social media platform because it violates the platform’s existing terms of service related to cyberbullying.

(II) The reported material has been determined to be cyberbullying that was displayed, stored, or hosted on the social media platform and has not been, or will not be, blocked on the social media platform because it does not violate the platform’s existing terms of service related to cyberbullying.

(III) The reported material has not been determined to be cyberbullying or to violate the platform’s existing terms of service related to cyberbullying and the reported material has not been, or will not be, blocked on the social media platform.

(IV) The reported material has not been determined to be cyberbullying or to violate the platform’s existing terms of service related to cyberbullying, but the reported material has been blocked from being viewable on the social media platform for reasons unrelated to the platform’s existing terms of service related to cyberbullying.

(V) The reported material has been determined not to be displayed, stored, or hosted on the social media platform.

(ii) If the social media platform cannot comply with clause (i) within 30 days due to circumstances beyond the reasonable control of the social media platform, the social media platform shall comply with clause (i) no later than 60 days after the date on which the covered material was first reported. If this subparagraph applies, the social media platform shall promptly provide written notice of the delay, no later than 48 hours from the time the social media platform knew the delay was likely to occur, to the reporting individual.

history: (History: Amended by Stats. 2024, Ch. 900, Sec. 2. (SB 1504) Effective January 1, 2025.)


text:
Notwithstanding that any individual may report cyberbullying, or any content that violates a platform’s existing terms of service related to cyberbullying, as described in paragraph (1) of subdivision (b) of Section 22589.1, actions for relief pursuant to this chapter may be brought only in a civil action by any of the following persons:

(a) A parent or legal guardian of a minor, or an administrator in the school that the minor attends, who submits a report of cyberbullying to the social media platform.

(b) A city attorney, a district attorney, or a county counsel.

(c) The Attorney General, in the name of the people of the State of California.

history: (History: Amended by Stats. 2024, Ch. 900, Sec. 3. (SB 1504) Effective January 1, 2025.)


text:
(a) (1) Any social media platform that violates a requirement of this chapter shall be liable for ten thousand dollars ($10,000) for each violation and for compensatory damages, punitive damages, and any civil remedies, penalties, or sanctions for harms caused by the social media platform’s failure to comply with this chapter, which damages shall be adjudicated and awarded apart from any harms attributable to the existence of the reported content alone and which shall be assessed and recovered in a civil action brought by any person set forth in Section 22589.2.

(2) In a successful action brought to enforce this chapter, the court may order injunctive relief to obtain compliance with this chapter and may award reasonable attorney’s fees and costs to the prevailing plaintiff.

(b) For purposes of this section, each day a social media platform is in violation of a requirement of this chapter constitutes a separate violation.

(c) (1) The remedies provided by this section are in addition to any other civil, criminal, and administrative remedies, penalties, or sanctions provided by law and do not supplant, but are cumulative to, other remedies, penalties, or sanctions.

(2) The duties and obligations imposed by this section are cumulative with any other duties or obligations imposed under other law and shall not be construed to relieve any party from any duties or obligations imposed under other law.

(3) This section does not impose liability on a social media platform if such liability is prohibited by Section 230 of Title 47 of the United States Code.

history: (History: Amended by Stats. 2024, Ch. 900, Sec. 4. (SB 1504) Effective January 1, 2025.)


text:
This chapter shall not apply to either of the following:

(a) A social media platform that is controlled by a business entity that generated less than one hundred million dollars ($100,000,000) in gross revenue during the preceding calendar year.

(b) A social media platform whose primary function is to allow users to play video games.

history: (History: Added by Stats. 2022, Ch. 700, Sec. 1. (AB 2879) Effective January 1, 2023.)


text: As used in this chapter, a “hosting platform” means a marketplace that is created for the primary purpose of facilitating the rental of a residential unit offered for occupancy for tourist or transient use for compensation to the offeror of that unit, and the operator of the hosting platform derives revenues, including booking fees or advertising revenues, from providing or maintaining that marketplace. “Facilitating” includes, but is not limited to, the act of allowing the offeror of the residential unit to offer or advertise the residential unit on the Internet Web site provided or maintained by the operator.

history: (History: Added by Stats. 2015, Ch. 239, Sec. 1. (SB 761) Effective January 1, 2016.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.3. Internet Private Residence Rental Listings


text:
A hosting platform shall provide the following notice to an offeror listing a residence for short-term rental on the hosting platform:

(a) If you are a tenant who is listing a room, home, mobilehome, condominium, or apartment, please refer to your rental contract or lease, or contact your landlord, prior to listing the property to determine whether your lease or contract contains restrictions that would limit your ability to list your room, home, mobilehome, condominium, or apartment. Listing your room, home, mobilehome, condominium, or apartment may be a violation of your lease or contract, and could result in legal action against you by your landlord, including possible eviction.

(b) You should review any restrictions on coverage under your homeowners’ or renters’ insurance policy related to short-term rental activities to ensure that there is appropriate insurance coverage in the event that a person sustains an injury or loss for which you are responsible, a person damages or causes loss to your personal or real property, or a claim or lawsuit is made against you or otherwise arises out of activities related to this hosting platform.

history: (History: Amended by Stats. 2016, Ch. 113, Sec. 1. (SB 1092) Effective January 1, 2017.)

chapter: 22.3. Internet Private Residence Rental Listings


text:
(a) The notice required by Section 22592 shall be in a font size that is equal to or greater than 100 percent of the standard font size of the other paragraphs on the hosting platform’s Internet Web site or equal to the default font size on the hosting platform’s Internet Web site.

(b) The notice shall be provided immediately before the offeror lists each real property on the hosting platform’s Internet Web site, and shall require the offeror to interact with the hosting platform’s Internet Web site to affirmatively acknowledge he or she has read the notice. This affirmative acknowledgment may be accomplished by the inclusion of a statement in the notice described in Section 22592 that the offeror acknowledges reading this notice before proceeding to list a real property with the hosting platform’s Internet Web site.

history: (History: Amended by Stats. 2016, Ch. 113, Sec. 2. (SB 1092) Effective January 1, 2017.)


text:
As used in this chapter:

(a) “Clearly and conspicuously” means in a font no smaller than boldface, 14-point type, clearly separate from any other language on the page. For an audio disclosure, “clearly and conspicuously” means in a volume and cadence sufficient to be readily audible and understandable.

(b) “Food delivery platform” means an online business that acts as an intermediary between consumers and multiple food facilities to submit food and beverage orders from a consumer to a participating food facility, and to arrange for, or to complete, the delivery of the order from the food facility to the consumer.

(c) “Food facility” means a food facility, as defined in Section 113789 of the Health and Safety Code.

(d) “Forwarded call” means a communication made by a consumer and intended for a food facility, by telephone call or other means of communication, that has been routed by a food delivery platform, or a routing service under the direction of the food delivery platform, to the intended food facility.

(e) “Listing website” means an internet website or application that lists, or produces through search results, telephone numbers associated with food facilities, and that has 100,000,000 or more unique monthly visitors.

(f) “Online order” means an order for food or beverage placed by a customer through or with the assistance of a food delivery platform, including, but not limited to, a telephone order, for delivery.

(g) (1) “Purchase price” means the price, as listed on the menu, for the items contained in an online order.

(2) “Purchase price” does not include taxes, fees, commissions, or gratuities that may make up the total amount charged to the customer of an online order.

history: (History: Amended by Stats. 2024, Ch. 898, Sec. 1. (SB 1490) Effective January 1, 2025.)

chapter: 22.4. Food Delivery Platforms

path: 8. SPECIAL BUSINESS REGULATIONS > 22.4. Food Delivery Platforms


text:
(a) A food delivery platform shall not arrange for the delivery of an order from a food facility without first obtaining an agreement with the food facility expressly authorizing the food delivery platform to take orders and deliver meals prepared by the food facility.

(b) (1) Subject to paragraph (2), a food delivery platform shall provide to a food facility a mechanism to do both of the following:

(A) Remove the food facility, including its name, address, logo, or menu listing, from the platform within three business days of receiving a request to be removed from the platform.

(B) Direct the food delivery platform to disclose to customers the delivery fee charged to the food facility and each fee, commission, or cost charged to the food facility, as provided in paragraph (2) of subdivision (b) of Section 22599.1.

(2) Nothing in this subdivision shall interfere with preexisting contractual obligations between a food delivery platform and a food facility.

(c) (1) A food delivery platform shall inform a food facility of both of the following prior to signing an agreement:

(A) The fees charged by the food delivery platform for each service plan offered.

(B) The features included in each service plan, as applicable.

(2) A food delivery platform shall also inform a food facility of any change to the agreement referenced in this subdivision that is deemed material and applicable to the food facility.

(d) A food delivery platform shall inform a food facility of all of the following:

(1) How charges for customer order and delivery errors are calculated.

(2) How charges related to errors are allocated between the food delivery platform and the food facility.

(3) The process for food facilities to dispute charges related to errors, including whether disputes may be subject to automatic resolution.

(e) This section shall not require a food delivery platform to reveal information that is confidential, proprietary, or a trade secret.

(f) This section shall not prohibit offering bundled services at a single price.

history: (History: Amended by Stats. 2024, Ch. 898, Sec. 2. (SB 1490) Effective January 1, 2025.)


text:
(a) It is unlawful for a food delivery platform to do any of the following:

(1) Charge a customer any purchase price for food or beverage that is higher than the price posted on the food delivery platform’s internet website by the food facility at the time of the order.

(2) Retain any portion of amounts designated as a tip or gratuity. Any tip or gratuity for a delivery order shall be paid by a food delivery platform, in its entirety, to the person delivering the food or beverage. Any tip or gratuity for a pickup order shall be paid by a food delivery platform, in its entirety, to the food facility.

(3) Maintain a payment model that uses any amount designated as tips or gratuity to offset the base pay to the person delivering the food or beverage.

(b) A food delivery platform shall prominently disclose to the customer and to the food facility an accurate, clearly identified, and itemized cost breakdown of each transaction, including, but not limited to, all of the following information:

(1) The purchase price of the food and beverage.

(2) A notice, if applicable, that the food delivery platform charges a fee, commission, or cost to the food facility, unless the food facility directs that the food delivery platform disclose to customers the delivery fee charged to the food facility and each fee, commission, or cost charged to the food facility.

(3) Each fee, commission, and any other cost charged to the customer by the food delivery platform.

(4) Any tip or gratuity payable to the delivery driver or food facility.

(c) A food delivery platform shall prominently disclose to the person delivering the food or beverage an accurate, clearly identified, and itemized breakdown of the pay received for a delivery, including, but not limited to, the base pay, gratuity or tips, and any promotional bonuses.

(d) (1) A listing website shall not associate a telephone number or other method of direct communication with a food facility on the listing website’s internet website or application if the listing website knows the use of that telephone number or other method of direct communication will result in a forwarded call.

(2) A listing website shall clearly and conspicuously disclose if an order placed through a telephone number or other interface on the listing website’s internet website or application may result in a fee, commission, or cost paid to a party other than the food facility and shall identify that other party.

(e) A food delivery platform shall clearly and regularly disclose to the food facility and the customer the status of the order, including all of the following:

(1) The method of delivery.

(2) The anticipated date and time of the delivery of the order.

(3) Confirmation that the order has been successfully delivered or that the delivery cannot be completed.

(f) A food delivery platform shall include a clear and conspicuous customer service feature that allows a customer to contact a natural person. The food delivery platform may use an automated system to address customer service concerns. However, if the automated system is unable to address the customer’s concerns, the food delivery platform shall ensure that the customer is able to promptly connect with the natural person in order to address the concern.

history: (History: Amended by Stats. 2025, Ch. 341, Sec. 1. (AB 578) Effective January 1, 2026.)


text:
(a) A food delivery platform shall provide a full refund, including all taxes, commissions, fees, and gratuities, to the customer if an order is not delivered or the wrong order is delivered, unless the food delivery platform determines that the customer was responsible for the nondelivery or finds evidence indicating the refund request may be fraudulent.

(b) The food delivery platform shall refund the amount of the original paid gratuity to the customer but shall not take or deduct the original gratuity amount from the delivery driver.

(c) If it is not feasible for the food delivery platform to refund the paid gratuity to the customer in the original method of payment, the food delivery platform shall provide an alternate refund method for the paid gratuity.

(d) In the event that a customer receives an order that is only partially fulfilled, the food delivery platform shall do the following:

(1) Charge the customer only for the portion of the order the customer received. Any taxes, fees, or gratuities directly associated with the undelivered items shall be adjusted to reflect the reduced order.

(2) Provide a mechanism that allows the customer to adjust any gratuity that was included in the order prior to its delivery.

(e) Along with any other refund options, the food delivery platform shall provide a mechanism that allows the customer to request that the amount of the refund be returned to the original method of payment.

(f) This section does not prohibit a food delivery platform from removing a customer from the platform if the platform has a reasonable suspicion that the customer has committed or is committing fraud.

history: (History: Added by Stats. 2025, Ch. 341, Sec. 2. (AB 578) Effective January 1, 2026.)


text:
(a) Unless exempt pursuant to subdivision (b), a food delivery platform shall provide all of the following information to a customer on its online-enabled application or platform at the time the customer is notified their purchase is out for delivery:

(1) The driver’s first name.

(2) A picture of the driver.

(b) This section shall not apply to an order if either of the following apply:

(1) The food facility uses its own delivery driver for delivery of the order.

(2) The food facility receives the order through the food facility’s internet website or a third party that is not the food delivery platform.

(c) This section shall take effect on March 1, 2025.

history: (History: Added by Stats. 2024, Ch. 84, Sec. 1. (AB 375) Effective January 1, 2025. Operative March 1, 2025, by its own provisions.)


text: The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.

history: (History: Added by Stats. 2021, Ch. 513, Sec. 3. (AB 286) Effective January 1, 2022.)


text:
(a) Every publisher shall, prior to including a telephone number for a facsimile machine in any commercial directory of telephone numbers, obtain the written consent of the subscriber who has been assigned the number unless the telephone number for the facsimile machine is obtained from a telephone corporation’s alphabetical or classified directory of telephone numbers.

(b) As used in this section:

(1) “Commercial directory” does not include an alphabetical directory of telephone numbers or a classified directory published by a telephone corporation.

(2) “Telephone number for a facsimile machine” means any number designated in a directory as being for a facsimile machine or any number included in a directory represented to be a directory of telephone numbers for facsimile machines.

(c) Every publisher shall notify, in writing, all of the subscribers of the facsimile telephone numbers printed in the publisher’s directory of the requirements of this chapter on or before April 1, 1991. Unless the subscriber thereafter notifies the publisher otherwise, telephone numbers for facsimile machines published prior to July 1, 1991, without the written consent of the subscriber, may continue to be published by that publisher. Upon notification by the subscriber that he or she desires to be excluded from the directory, all subsequent volumes of the directory shall exclude the subscriber’s facsimile telephone number.

(d) Every violation of subdivision (a) is an infraction punishable by a fine of five hundred dollars ($500).

history: (History: Added by Stats. 1990, Ch. 973, Sec. 1.)

chapter: 22.5. Commercial Directories

path: 8. SPECIAL BUSINESS REGULATIONS > 22.5. Commercial Directories


text:
As used in this chapter:

(a) “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

(b) (1) “Companion chatbot” means an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user’s social needs, including by exhibiting anthropomorphic features and being able to sustain a relationship across multiple interactions.

(2) “Companion chatbot” does not include any of the following:

(A) A bot that is used only for customer service, a business’ operational purposes, productivity and analysis related to source information, internal research, or technical assistance.

(B) A bot that is a feature of a video game and is limited to replies related to the video game that cannot discuss topics related to mental health, self-harm, sexually explicit conduct, or maintain a dialogue on other topics unrelated to the video game.

(C) A stand-alone consumer electronic device that functions as a speaker and voice command interface, acts as a voice-activated virtual assistant, and does not sustain a relationship across multiple interactions or generate outputs that are likely to elicit emotional responses in the user.

(c) “Companion chatbot platform” means a platform that allows a user to engage with companion chatbots.

(d) “Office” means the Office of Suicide Prevention established pursuant to Section 131300 of the Health and Safety Code.

(e) “Operator” means a person who makes a companion chatbot platform available to a user in the state.

(f) “Sexually explicit conduct” has the meaning defined in Section 2256 of Title 18 of the United States Code.

(g) “Video game” means a game played on an electronic amusement device that utilizes a computer, microprocessor, or similar electronic circuitry and its own monitor, or is designed to be used with a television set or a computer monitor, that interacts with the user of the device.

history: (History: Added by Stats. 2025, Ch. 677, Sec. 1. (SB 243) Effective January 1, 2026.)

chapter: 22.6. Companion Chatbots

path: 8. SPECIAL BUSINESS REGULATIONS > 22.6. Companion Chatbots


text:
(a) If a reasonable person interacting with a companion chatbot would be misled to believe that the person is interacting with a human, an operator shall issue a clear and conspicuous notification indicating that the companion chatbot is artificially generated and not human.

(b) (1) An operator shall prevent a companion chatbot on its companion chatbot platform from engaging with users unless the operator maintains a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user, including, but not limited to, by providing a notification to the user that refers the user to crisis service providers, including a suicide hotline or crisis text line, if the user expresses suicidal ideation, suicide, or self-harm.

(2) The operator shall publish details on the protocol required by this subdivision on the operator’s internet website.

(c) An operator shall, for a user that the operator knows is a minor, do all of the following:

(1) Disclose to the user that the user is interacting with artificial intelligence.

(2) Provide by default a clear and conspicuous notification to the user at least every three hours for continuing companion chatbot interactions that reminds the user to take a break and that the companion chatbot is artificially generated and not human.

(3) Institute reasonable measures to prevent its companion chatbot from producing visual material of sexually explicit conduct or directly stating that the minor should engage in sexually explicit conduct.


text:
(a) Beginning July 1, 2027, an operator shall annually report to the office all of the following:

(1) The number of times the operator has issued a crisis service provider referral notification pursuant to Section 22602 in the preceding calendar year.

(2) Protocols put in place to detect, remove, and respond to instances of suicidal ideation by users.

(3) Protocols put in place to prohibit a companion chatbot response about suicidal ideation or actions with the user.

(b) The report required by this section shall include only the information listed in subdivision (a) and shall not include any identifiers or personal information about users.

(c) The office shall post data from a report required by this section on its internet website.

(d) An operator shall use evidence-based methods for measuring suicidal ideation.


text: An operator shall disclose to a user of its companion chatbot platform, on the application, the browser, or any other format that a user can use to access the companion chatbot platform, that companion chatbots may not be suitable for some minors.


text:
A person who suffers injury in fact as a result of a violation of this chapter may bring a civil action to recover all of the following relief:

(a) Injunctive relief.

(b) Damages in an amount equal to the greater of actual damages or one thousand dollars ($1,000) per violation.

(c) Reasonable attorney’s fees and costs.


text: The duties, remedies, and obligations imposed by this chapter are cumulative to the duties, remedies, or obligations imposed under other law and shall not be construed to relieve an operator from any duties, remedies, or obligations imposed under any other law.


text:
(a) (1) “Covered material” means material that meets all of the following criteria:

(A) The material is an image or video created or altered through digitization that would appear to a reasonable person to be an image or video of any of the following:

(i) An intimate body part of an identifiable person.

(ii) An identifiable person engaged in an act of sexual intercourse, sodomy, oral copulation, or sexual penetration.

(iii) An identifiable person engaged in masturbation.

(B) The reporting person is the person depicted in the material, and the reporting person did not consent to the use of the reporting person’s likeness in the material.

(C) The material is displayed, stored, or hosted on the social media platform.

(2) “Covered material” does not include an image or video that contains only minor alterations that do not lead to significant changes to the perceived content or meaning of the content, including changes to brightness or contrast of images and other minor changes that do not impact the content of the image or video.

(b) “Reporting user” means a natural person who reports material to a social media platform using the mechanism provided by the social media platform pursuant to Section 22671.

(c) “Sexually explicit digital identity theft” means the posting of covered material on a social media platform.

(d) (1) “Social media platform” has, except as provided in paragraph (2), the same meaning as defined in Section 22675.

(2) “Social media platform” does not include either of the following:

(A) A stand-alone direct messaging service that provides end-to-end encrypted communication or the portion of a multiservice platform that uses end-to-end encrypted communication.

(B) An internet-based service or application owned or operated by a nonprofit organization exempt from federal income tax pursuant to Section 501(c)(3) of the Internal Revenue Code.

history: (History: Added by Stats. 2024, Ch. 292, Sec. 1. (SB 981) Effective January 1, 2025.)

chapter: 22.7. Digital Identity Theft

path: 8. SPECIAL BUSINESS REGULATIONS > 22.7. Digital Identity Theft


text:
A social media platform shall do all of the following:

(a) Provide a mechanism that is reasonably accessible to a reporting user who is a California resident who has an account with the social media platform to report sexually explicit digital identity theft to the social media platform.

(b) Collect information reasonably sufficient to enable the social media platform to locate the instance of sexually explicit digital identity theft and to contact a reporting user with both of the following:

(1) Confirmation that the social media platform received the reporting user’s report within 48 hours of receipt of the report.

(2) Within seven days of the date on which the confirmation required by paragraph (1) is issued, a written update to the reporting user as to the status of the social media platform’s handling of the reported sexually explicit digital identity theft.

(c) (1) Except as provided in paragraph (2), determine within 30 days of the date on which the confirmation required by paragraph (1) of subdivision (b) is issued whether there is a reasonable basis to believe that the reported sexually explicit digital identity theft is sexually explicit digital identity theft.

(2) (A) If the social media platform cannot comply with paragraph (1) within 30 days due to circumstances beyond the reasonable control of the social media platform, the social media platform shall comply with paragraph (1) no later than 60 days after the date on which the covered material was first reported.

(B) If subparagraph (A) applies, the social media platform shall promptly provide written notice of the delay, no later than 48 hours from the time the social media platform knew the delay was likely to occur, to the reporting user using the information collected from the reporting user under subdivision (b).

(d) (1) Temporarily block a reported instance of sexually explicit digital identity theft from being publicly viewable on the social media platform pending a determination pursuant to subdivision (c).

(2) Immediately remove a reported instance of sexually explicit digital identity theft from being publicly viewable on the social media platform if the social media platform determines there is a reasonable basis to believe the reported sexually explicit digital identity theft is sexually explicit digital identity theft.


text:
For purposes of this chapter, the following definitions apply:

(a) “Actioned” means a social media company, due to a suspected or confirmed violation of the terms of service, has taken some form of action, including, but not limited to, removal, demonetization, deprioritization, or banning, against the relevant user or relevant item of content.

(b) “Artificial intelligence” has the same definition as in Section 11546.45.5 of the Government Code.

(c) (1) “Content” means statements or comments made by users and media that are created, posted, shared, or otherwise interacted with by users on an internet-based service or application.

(2) “Content” does not include media put on a service or application exclusively for the purpose of cloud storage, transmitting files, or file collaboration.

(d) “Public or semipublic internet-based service or application” excludes a service or application used to facilitate communication within a business or enterprise among employees or affiliates of the business or enterprise, provided that access to the service or application is restricted to employees or affiliates of the business or enterprise using the service or application.

(e) “Social media company” means a person or entity that owns or operates one or more social media platforms.

(f) “Social media platform” means a public or semipublic internet-based service or application that has users in California and that meets both of the following criteria:

(1) (A) A substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application.

(B) A service or application that provides email or direct messaging services shall not be considered to meet this criterion on the basis of that function alone.

(2) The service or application allows users to do all of the following:

(A) Construct a public or semipublic profile for purposes of signing into and using the service or application.

(B) Populate a list of other users with whom an individual shares a social connection within the system.

(C) Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.

(g) “Terms of service” means a policy or set of policies adopted by a social media company that specifies, at least, the user behavior and activities that are permitted on the internet-based service owned or operated by the social media company, and the user behavior and activities that may subject the user or an item of content to being actioned.

history: (History: Amended by Stats. 2024, Ch. 843, Sec. 1. (AB 2885) Effective January 1, 2025.)

path: 8. SPECIAL BUSINESS REGULATIONS > 22.8. Content Moderation Requirements for Internet Terms of Service


text:
(a) A social media company shall post terms of service for each social media platform owned or operated by the company in a manner reasonably designed to inform all users of the social media platform of the existence and contents of the terms of service.

(b) The terms of service posted pursuant to subdivision (a) shall include all of the following:

(1) Contact information for the purpose of allowing users to ask the social media company questions about the terms of service.

(2) A description of the process that users must follow to flag content, groups, or other users that they believe violate the terms of service, and the social media company’s commitments on response and resolution time.

(3) A list of potential actions the social media company may take against an item of content or a user, including, but not limited to, removal, demonetization, deprioritization, or banning.

(c) The terms of service posted pursuant to subdivision (a) shall be available in all Medi-Cal threshold languages, as defined in subdivision (c) of Section 128552 of the Health and Safety Code, in which the social media platform offers product features, including, but not limited to, menus and prompts.

history: (History: Added by Stats. 2022, Ch. 269, Sec. 2. (AB 587) Effective January 1, 2023.)

chapter: 22.8. Content Moderation Requirements for Internet Terms of Service


text:
(a) On a semiannual basis in accordance with subdivision (b), a social media company shall submit to the Attorney General a terms of service report. The terms of service report shall include, for each social media platform owned or operated by the company, all of the following:

(1) The current version of the terms of service of the social media platform.

(2) If a social media company has filed its first report, a complete and detailed description of any changes to the terms of service since the previous report.

(3) A statement of whether the current version of the terms of service defines each of the following categories of content, and, if so, the definitions of those categories, including any subcategories:

(A) Hate speech or racism.

(B) Extremism or radicalization.

(C) Disinformation or misinformation.

(D) Harassment.

(E) Foreign political interference.

(F) Controlled substance distribution.

(4) A detailed description of content moderation practices used by the social media company for that platform, including, but not limited to, all of the following:

(A) Any existing policies intended to address the categories of content described in paragraph (3).

(B) How automated content moderation systems enforce terms of service of the social media platform and when these systems involve human review.

(C) How the social media company responds to user reports of violations of the terms of service.

(D) How the social media company would remove individual pieces of content, users, or groups that violate the terms of service, or take broader action against individual users or against groups of users that violate the terms of service.

(E) The languages in which the social media platform does not make terms of service available, but does offer product features, including, but not limited to, menus and prompts.

(5) (A) Information on content that was flagged by the social media company as content belonging to any of the categories described in paragraph (3), including all of the following:

(i) The total number of flagged items of content.

(ii) The total number of actioned items of content.

(iii) The total number of actioned items of content that resulted in action taken by the social media company against the user or group of users responsible for the content.

(iv) The total number of actioned items of content that were removed, demonetized, or deprioritized by the social media company.

(v) The number of times actioned items of content were viewed by users.

(vi) The number of times actioned items of content were shared, and the number of users that viewed the content before it was actioned.

(vii) The number of times users appealed social media company actions taken on that platform and the number of reversals of social media company actions on appeal disaggregated by each type of action.

(B) All information required by subparagraph (A) shall be disaggregated into the following categories:

(i) The category of content, including any relevant categories described in paragraph (3).

(ii) The type of content, including, but not limited to, posts, comments, messages, profiles of users, or groups of users.

(iii) The type of media of the content, including, but not limited to, text, images, and videos.

(iv) How the content was flagged, including, but not limited to, flagged by company employees or contractors, flagged by artificial intelligence software, flagged by community moderators, flagged by civil society partners, and flagged by users.

(v) How the content was actioned, including, but not limited to, actioned by company employees or contractors, actioned by artificial intelligence software, actioned by community moderators, actioned by civil society partners, and actioned by users.

(b) (1) A social media company shall electronically submit a semiannual terms of service report pursuant to subdivision (a), covering activity within the third and fourth quarters of the preceding calendar year, to the Attorney General no later than April 1 of each year, and shall electronically submit a semiannual terms of service report pursuant to subdivision (a), covering activity within the first and second quarters of the current calendar year, to the Attorney General no later than October 1 of each year.

(2) Notwithstanding paragraph (1), a social media company shall electronically submit its first terms of service report pursuant to subdivision (a), covering activity within the third quarter of 2023, to the Attorney General no later than January 1, 2024, and shall electronically submit its second terms of service report pursuant to subdivision (a), covering activity within the fourth quarter of 2023, to the Attorney General no later than April 1, 2024. A social media platform shall submit its third report no later than October 1, 2024, in accordance with paragraph (1).

(c) The Attorney General shall make all terms of service reports submitted pursuant to this section available to the public in a searchable repository on its official internet website.

history: (History: Amended by Stats. 2023, Ch. 824, Sec. 2. (AB 1027) Effective January 1, 2024.)


text:
(a) (1) A social media company that violates the provisions of this chapter shall be liable for a civil penalty not to exceed fifteen thousand dollars ($15,000) per violation per day, and may be enjoined in any court of competent jurisdiction.

(2) A social media company shall be considered in violation of the provisions of this chapter for each day the social media company does any of the following:

(A) Fails to post terms of service in accordance with Section 22676.

(B) Fails to timely submit to the Attorney General a report required pursuant to Section 22677.

(C) Materially omits or misrepresents required information in a report submitted pursuant to Section 22677.

(3) In assessing the amount of a civil penalty pursuant to paragraph (1), the court shall consider whether the social media company has made a reasonable, good faith attempt to comply with the provisions of this chapter.

(b) Actions for relief pursuant to this chapter shall be prosecuted exclusively in a court of competent jurisdiction by the Attorney General or by a city attorney of a city having a population in excess of 750,000, or by a city attorney in a city and county in the name of the people of the State of California upon their own complaint or upon the complaint of a board, officer, person, corporation, or association.

(c) If an action pursuant to this section is brought by the Attorney General, one-half of the penalty collected shall be paid to the treasurer of the county in which the judgment was entered, and one-half to the General Fund. If the action is brought by a city attorney, one-half of the penalty collected shall be paid to the treasurer of the city in which the judgment was entered, and one-half to the treasurer of the county in which the judgment was entered.


text:
(a) The duties and obligations imposed by this chapter are cumulative to any other duties or obligations imposed under local, state, or federal law and shall not be construed to relieve any party from any duties or obligations imposed under law.

(b) The remedies or penalties provided by this chapter are cumulative to each other and to any other remedies or penalties available under local, state, or federal law.


text: This chapter shall not apply to a social media company that generated less than one hundred million dollars ($100,000,000) in gross revenue during the preceding calendar year.


text: This chapter shall not be construed to apply to an internet-based service or application for which interactions between users are limited to direct messages, commercial transactions, consumer reviews of products, sellers, services, events, or places, or any combination thereof.


text: This chapter shall be known and may be cited as the Filante Tanning Facility Act of 1988.

history: (History: Added by Stats. 1988, Ch. 808, Sec. 1.)

chapter: 23. Tanning Facilities

path: 8. SPECIAL BUSINESS REGULATIONS > 23. Tanning Facilities


text:
The Legislature finds and declares:

(a) Many physicians and scientists now warn that the risks associated with suntanning are greater when tanning with artificial ultraviolet light.

(b) These risks include, but are not limited to, sunburn, premature aging, skin cancer, retinal damage, formation of cataracts, suppression of the immune system, and damage to the vascular system.

(c) Certain medications, cosmetics, and foods are “photosensitizing,” which means that in some people they react unfavorably with ultraviolet light to produce skin rashes or burns.

(d) Sunlamps and other artificial sources of ultraviolet light are known to intensify these effects.

(e) The creation of state law to protect and promote the public health, safety, and welfare is needed concerning tanning with artificial ultraviolet light.

history: (History: Amended by Stats. 2006, Ch. 538, Sec. 31. Effective January 1, 2007.)


text:
As used in this chapter:

(a) “Tanning facility” means any location, place, area, structure, or business that provides persons access to any tanning device.

(b) “Department” means the Department of Consumer Affairs.

(c) “Phototherapy device” means equipment that emits ultraviolet radiation used by a health care professional in the treatment of disease.

(d) “Tanning device” means an ultraviolet tanning device and any accompanying equipment, including, but not limited to, protective eyewear, timers, and handrails.

(e) “Ultraviolet tanning device” means equipment that emits electromagnetic radiation with wavelengths in the air between 200 and 400 nanometers used for tanning of the skin, including, but not limited to, a sunlamp, tanning booth, or tanning bed.

history: (History: Amended by Stats. 2007, Ch. 590, Sec. 1. Effective January 1, 2008.)


text: This chapter does not apply to a phototherapy device used by or under the direct supervision of a licensed physician who is trained in the use of phototherapy devices.


text: Any tanning device used by a tanning facility shall comply with all applicable federal laws and regulations.


text:
(a) A tanning facility shall give each customer, prior to the customer’s use of an ultraviolet tanning device, a written statement warning that:

(1) Not wearing the eye protection provided to the customer by the tanning center may cause damage to the eyes.

(2) Overexposure causes burns.

(3) Repeated exposure may cause premature aging of the skin and skin cancer.

(4) Abnormal skin sensitivity or burning may be caused by certain:

(A) Foods.

(B) Cosmetics.

(C) Medications, including, but not limited to, the following:

(i) Tranquilizers.

(ii) Diuretics.

(iii) Antibiotics.

(iv) High blood pressure medicines.

(v) Birth control pills.

(5) Any person taking a prescription or over-the-counter drug should consult a physician before using an ultraviolet tanning device.

(6) Any person with skin that burns easily should avoid an ultraviolet tanning device.

(7) Any person with a family history or past medical history of skin cancer should avoid an ultraviolet tanning device.

(b) A tanning facility shall conspicuously post a warning sign in any area where an ultraviolet tanning device is used that is readily visible to a person using an ultraviolet tanning device. The sign shall read as follows:

DANGER: ULTRAVIOLET RADIATION

1. Follow instructions.

2. Avoid too frequent or too lengthy exposure. As with natural sunlight, exposure can cause eye and skin injury and allergic reactions. Repeated exposure may cause chronic sun damage characterized by wrinkling, dryness, fragility and bruising of the skin, and skin cancer.

3. Wear protective eyewear.

FAILURE TO USE PROTECTIVE EYEWEAR

MAY RESULT IN SEVERE BURNS OR

LONG-TERM INJURY TO THE EYES.

4. Ultraviolet radiation from sunlamps will aggravate the effects of the sun. Therefore, do not sunbathe before or after exposure to ultraviolet radiation.

5. Medications or cosmetics may increase your sensitivity to ultraviolet radiation. Consult a physician before using a sunlamp if you are using medications, have a history of skin problems, or believe you are especially sensitive to sunlight. Pregnant women or women on birth control pills who use this product may develop discolored skin.

IF YOU DO NOT TAN IN THE SUN YOU WILL

NOT TAN FROM USE OF THIS DEVICE.

(c) A tanning facility may include in the warning sign described in subdivision (b) the following statement: “Spray on tans and other sunless tanning products are not subject to the same effects as ultraviolet tanning devices.”

(d) A tanning facility shall not claim, or distribute promotional materials that claim, that using an ultraviolet tanning device is safe or free from risk or that indoor tanning has any known health benefits.

(e) The liability of a tanning facility operator or a manufacturer of an ultraviolet tanning device is not changed by giving the warning under this section.

history: (History: Amended by Stats. 2007, Ch. 590, Sec. 2. Effective January 1, 2008.)


text:
(a) A tanning facility shall:

(1) Have an operator present during operating hours who is sufficiently knowledgeable in the correct operation of the tanning devices used at the facility so that he or she is able to inform and assist each customer in the proper use of the tanning devices.

(2) Before each use of an ultraviolet tanning device, provide each customer with properly sanitized protective eyewear that protects the eye from ultraviolet radiation and allows adequate vision to maintain balance; and not allow a person to use an ultraviolet tanning device if that person does not use the protective eyewear.

(3) Show each customer how to use suitable physical aids, such as handrails and markings on the floor, to maintain proper exposure distance as recommended by the manufacturer.

(4) Use a timer on an ultraviolet tanning device that has an accuracy of plus or minus 10 percent of any selected timer interval. The timer shall also be remotely located so that customers cannot set their own exposure time.

(5) Limit each customer using an ultraviolet tanning device to the maximum exposure time as recommended by the manufacturer.

(6) Control the interior temperature of a tanning facility so that it does not exceed 100 degrees Fahrenheit.

(b) (1) Every person who uses a tanning facility shall sign a written statement acknowledging that he or she has read and understood the warnings before using the device; and agrees to use the protective eyewear that the tanning facility provides. The statement of acknowledgment shall be retained by the tanning facility until the end of the calendar year at which time each person who is a current customer of the facility shall be required to renew that acknowledgment.

(2) Whenever using a tanning device a person shall use the protective eyewear that the tanning facility provides.

(3) Persons under 18 years of age are prohibited from using an ultraviolet tanning device.

(4) Proof of age shall be satisfied with a driver’s license or other government issued identification containing the date of birth and a photograph of the individual.

history: (History: Amended by Stats. 2011, Ch. 664, Sec. 2. (SB 746) Effective January 1, 2012.)


text:
If a patron is injured whereupon he or she must seek medical attention, a tanning facility shall do the following:

(a) Report any injury to the department.

(b) Send a copy of the injury report to the person who is injured.

(c) Send a copy of the injury report to the Federal Food and Drug Administration.


text:
(a) A first violation of this chapter is an infraction. Each day a first violation continues constitutes a separate infraction.

(b) Any violation of this chapter subsequent to a first violation is a misdemeanor. Each day a subsequent violation continues constitutes a separate misdemeanor.

(c) A tanning facility that has violated this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) per day in addition to any other penalty established by law.

history: (History: Amended by Stats. 2004, Ch. 758, Sec. 3. Effective January 1, 2005.)


text:
For purposes of this chapter:

(a) “Bakery tray” or “bakery basket” is a plastic or metal container that holds bread or other baked goods and is used by a distributor, retailer, or an agent of the distributor or retailer as a means to transport, store, or carry those products, which has a notice permanently affixed to it that does all of the following: (1) identifies the company name of the owner of the item; (2) notifies the public that the unauthorized possession of the item is a violation of state law; and (3) lists an address or telephone number for returning the item to the owner.

(b) “Merchandise pallet” is a wooden or plastic carrier or container, used by a manufacturer or distributor for bulk transport of merchandise to wholesale or retail outlets marked with an indicia of ownership. For purposes of this chapter, “indicia of ownership” means words, symbols, or registered trademarks printed, stamped, etched, attached, or otherwise displayed on the exterior surface of the merchandise pallet that reasonably identify the owner.

history: (History: Amended by Stats. 2012, Ch. 300, Sec. 4. (AB 1583) Effective January 1, 2013.)

path: 8. SPECIAL BUSINESS REGULATIONS > 24. Bakery Trays, Bakery Baskets, and Merchandise Pallets


text: Any person who purchases or leases a bakery tray, bakery basket, or merchandise pallet shall retain a copy of the bill of sale or other evidence that supports the purchase.

history: (History: Amended by Stats. 1995, Ch. 456, Sec. 4. Effective January 1, 1996.)

chapter: 24. Bakery Trays, Bakery Baskets, and Merchandise Pallets


text:
As used in this chapter, an “unauthorized person” with respect to possession of a bakery tray, bakery basket, or merchandise pallet includes anyone in possession of one or more of these items, except the following:

(a) The company owner.

(b) A person in lawful possession of the item.

(c) A person who, with the consent of the company owner or the company’s agent, has temporary possession of the item as a result of the purchase of the products or merchandise transported using the item.

history: (History: Amended by Stats. 1995, Ch. 456, Sec. 5. Effective January 1, 1996.)


text:
The following acts are punishable as provided in subdivision (b) of Section 489 or in Section 490 of the Penal Code as to any bakery tray, bakery basket, or merchandise pallet described in Section 22750:

(a) Possession of a bakery tray, bakery basket, or merchandise pallet by an unauthorized person.

(b) Obliteration of the company owner’s name on the bakery tray or bakery basket, or obliteration of the indicia of ownership on a merchandise pallet, except by the owner.

history: (History: Amended by Stats. 2012, Ch. 300, Sec. 5. (AB 1583) Effective January 1, 2013.)


text: An unauthorized person who possesses a bakery tray, bakery basket, or merchandise pallet is subject to civil action. Punitive damages under Section 3294 of the Civil Code and costs shall be awarded to a person who is awarded actual damages arising from a violation of this chapter.

history: (History: Added by Stats. 1995, Ch. 456, Sec. 7. Effective January 1, 1996.)