reglab/statecodes huggingface dataset:
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.26 - Security of Connected Devices › Section 1798.91.05.

1798.91.05. For the purposes of this title, the following terms have the following meanings:
(a) “Authentication” means a method of verifying the authority of a user, process, or device to access resources in an information system.
(b) “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address.
(c) “Manufacturer” means the person who manufactures, or contracts with another person to manufacture on the person’s behalf, connected devices that are sold or offered for sale in California. For the purposes of this subdivision, a contract with another person to manufacture on the person’s behalf does not include a contract only to purchase a connected device, or only to purchase and brand a connected device.
(d) “NIST conforming labeling scheme” means a labeling scheme conforming to the Cybersecurity White Paper titled “Recommended Criteria for Cybersecurity Labeling for Consumer Internet of Things (IoT) Products” published by the National Institute of Standards and Technology (NIST) on February 4, 2022, including any revisions or successor publications.
(e) “Security feature” means a feature of a device designed to provide security for that device.
(f) “Unauthorized access, destruction, use, modification, or disclosure” means access, destruction, use, modification, or disclosure that is not authorized by the consumer.
(Amended (as added by Stats. 2018, Ch. 860, Sec. 1) by Stats. 2022, Ch. 785, Sec. 3. (AB 2392) Effective January 1, 2023. See similar section in the Title 1.81.26 added by Stats. 2018, Ch. 886.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.26 - Security of Connected Devices › Section 1798.91.06.

1798.91.06. (a) This title shall not be construed to impose any duty upon the manufacturer of a connected device related to unaffiliated third-party software or applications that a user chooses to add to a connected device.
(b) This title shall not be construed to impose any duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications, to review or enforce compliance with this title.
(c) This title shall not be construed to impose any duty upon the manufacturer of a connected device to prevent a user from having full control over a connected device, including the ability to modify the software or firmware running on the device at the user’s discretion.
(d) This title shall not apply to any connected device the functionality of which is subject to security requirements under federal law, regulations, or guidance promulgated by a federal agency pursuant to its regulatory enforcement authority.
(e) This title shall not be construed to provide a basis for a private right of action. The Attorney General, a city attorney, a county counsel, or a district attorney shall have the exclusive authority to enforce this title.
(f) The duties and obligations imposed by this title are cumulative with any other duties or obligations imposed under other law, and shall not be construed to relieve any party from any duties or obligations imposed under other law.
(g) This title shall not be construed to limit the authority of a law enforcement agency to obtain connected device information from a manufacturer as authorized by law or pursuant to an order of a court of competent jurisdiction.
(h) A covered entity, provider of health care, business associate, health care service plan, contractor, employer, or any other person subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Public Law 104-191) or the Confidentiality of Medical Information Act (Part 2.6 (commencing with Section 56) of Division 1) shall not be subject to this title with respect to any activity regulated by those acts.
(i) This title shall become operative on January 1, 2020.
(Added by Stats. 2018, Ch. 860, Sec. 1. (AB 1906) Effective January 1, 2019. Operative January 1, 2020, by its own provisions. See similar section in the Title 1.81.26 added by Stats. 2018, Ch. 886.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.27 - Commercial Use of Booking Photographs › Section 1798.91.1.

1798.91.1. (a) For the purposes of this section, the following definitions shall apply:
(1) “Booking photograph” means a photograph of a subject individual taken pursuant to an arrest or other involvement in the criminal justice system.
(2) “Subject individual” means an individual who was arrested.
(3) “Person” means a natural person, partnership, joint venture, corporation, limited liability company, or other entity.
(4) “Public entity” means the state, county, city, special district, or other political subdivision therein.
(b) It shall be unlawful practice for any person engaged in publishing or otherwise disseminating a booking photograph through a print or electronic medium to solicit, require, or accept the payment of a fee or other consideration from a subject individual to remove, correct, modify, or to refrain from publishing or otherwise disseminating that booking photograph.
(c) Notwithstanding subdivision (b), a public entity may require and accept a reasonable administrative fee to correct a booking photograph.
(d) Each payment solicited or accepted in violation of these provisions constitutes a separate violation.
(e) In addition to any other sanctions, penalties, or remedies provided by law, a subject individual may bring a civil action in any court of competent jurisdiction against any person in violation of this section for damages in an amount equal to the greater of one thousand dollars ($1,000) per violation or the actual damages suffered by him or her as a result, along with costs, reasonable attorney’s fees, and any other legal or equitable relief.
(f) The jurisdiction of a civil action brought pursuant to subdivision (e) shall also include the county in which the subject individual resides at the time of the violation of this section.
(Added by Stats. 2014, Ch. 194, Sec. 1. (SB 1027) Effective January 1, 2015.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.3 - IDENTITY THEFT › Section 1798.92.

1798.92. For the purposes of this title:
(a) “Claimant” means a person who has or purports to have a claim for money or an interest in property in connection with a transaction procured through identity theft.
(b) “Identity theft” means the unauthorized use of another person’s personal identifying information to obtain credit, goods, services, money, or property.
(c) “Personal identifying information” means a person’s name, address, telephone number, driver’s license number, social security number, place of employment, employee identification number, mother’s maiden name, demand deposit account number, savings account number, or credit card number.
(d) “Victim of identity theft” means a person who had their personal identifying information used without authorization by another to obtain credit, goods, services, money, or property, and did not use or possess the credit, goods, services, money, or property obtained by the identity theft, and has submitted a Federal Trade Commission identity theft report. In the alternative, the person may have filed a police report in this regard pursuant to Section 530.5 of the Penal Code.
(Amended by Stats. 2021, Ch. 265, Sec. 3. (AB 430) Effective January 1, 2022.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.3 - IDENTITY THEFT › Section 1798.94.

1798.94. An action or cross-complaint brought under this title that joins other claimants as defendants in the same action or cross-complaint shall be deemed to comply with Section 379 of the Code of Civil Procedure.
(Added by Stats. 2001, Ch. 354, Sec. 21. Effective January 1, 2002.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.3 - IDENTITY THEFT › Section 1798.95.

1798.95. A court shall have continuing jurisdiction over an action or cross-complaint filed pursuant to this title in order to provide for the joinder of related causes of action based on the theft of the same person’s identity and the joinder of further defendants based upon the theft of the same person’s identity, regardless of whether a final judgment has been entered as to any defendant. The court’s continuing jurisdiction shall terminate 10 years after filing of the original action unless the court, prior to that date, finds good cause to extend jurisdiction over the matter.
(Added by Stats. 2001, Ch. 354, Sec. 21. Effective January 1, 2002.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.3 - IDENTITY THEFT › Section 1798.96.

1798.96. Any action brought pursuant to this title or any joinder of a defendant pursuant to Section 1798.82 may be brought within four years of the date the person who alleges that he or she is a victim of identity theft knew or, in the exercise of reasonable diligence, should have known of the existence of facts which would give rise to the bringing of the action or joinder of the defendant.
(Added by Stats. 2001, Ch. 354, Sec. 21. Effective January 1, 2002.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.3 - IDENTITY THEFT › Section 1798.97.

1798.97. (a) This title does not apply to a transaction subject to Section 1747.10.
(b) Nothing is this title shall be construed to affect a claimant’s rights and remedies against a person who perpetrates identity theft or against any person who used or possessed the credit, goods, services, or property obtained by identity theft.
(c) This title is cumulative to the rights and remedies provided under other laws.
(Added by Stats. 2001, Ch. 354, Sec. 21. Effective January 1, 2002.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.35 - Coerced Debt › Section 1798.97.4.

1798.97.4. (a) This title does not apply to secured debts.
(b) This title does not require a court to order a claimant to refund any moneys already paid on a debt that is determined to be coerced.
(c) This title does not diminish the rights of a claimant to recover payment for a coerced debt from the person or persons who coerced a debtor into incurring that debt.
(d) This title does not reduce or eliminate any other rights or defenses available to a debtor or claimant pursuant to any other law.
(Added by Stats. 2022, Ch. 989, Sec. 2. (SB 975) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.35 - Coerced Debt › Section 1798.97.5.

1798.97.5. (a) Except as set forth in subdivision (b), this title applies only to debts incurred on or after July 1, 2023.
(b) Notwithstanding subdivision (a), a debtor may file a cross-complaint described by paragraph (2) of subdivision (a) of Section 1798.97.3 in an action filed by a claimant to collect a debt incurred prior to July 1, 2023, in which case, this title applies to that action, unless a final judgment has been entered in that action.
(Added by Stats. 2022, Ch. 989, Sec. 2. (SB 975) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.35 - Coerced Debt › Section 1798.97.6.

1798.97.6. If any provision of this title or the application thereof to any person or circumstances is held invalid, such invalidity shall not affect other provisions or applications of this title that can be given effect without the invalid provision or application, and to this end the provisions of this title are severable.
(Added by Stats. 2022, Ch. 989, Sec. 2. (SB 975) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.4 - PRIVACY OF CUSTOMER ELECTRICAL OR NATURAL GAS USAGE DATA › Section 1798.99.

1798.99. (a) A customer harmed by the release or unauthorized use of his or her customer data, in violation of Section 1798.98, may bring a civil action to recover actual damages in an amount not to exceed five hundred dollars ($500) for each willful violation.
(b) The rights, remedies, and penalties established by this title are in addition to the rights, remedies, or penalties established under any other law.
(c) Nothing in this title shall abrogate any authority of the Attorney General to enforce existing law.
(Added by Stats. 2013, Ch. 597, Sec. 1. (AB 1274) Effective January 1, 2014.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.46 - Online Violence Prevention Act › Section 1798.99.20.

1798.99.20. For purposes of this section:
(a) (1) “Content” means statements or comments made by users and media that are created, posted, shared, or otherwise interacted with by users on an internet-based service or application.
(2) “Content” does not include media put on a service or application exclusively for the purpose of cloud storage, transmitting files, or file collaboration.
(b) “Social media platform” means a public or semipublic internet-based service or application that has users in California and that meets both of the following criteria:
(1) (A) A substantial function of the service or application is to connect users in order to allow users to interact socially with each other within the service or application.
(B) A service or application that provides email or direct messaging services shall not be considered to meet this criterion on the basis of that function alone.
(2) The service or application allows users to do all of the following:
(A) Construct a public or semipublic profile for purposes of signing into and using the service or application.
(B) Populate a list of other users with whom an individual shares a social connection within the system.
(C) Create or post content viewable by other users, including, but not limited to, on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.
(c) “Public or semipublic internet-based service or application” does not include a service or application used to facilitate communication with a business or enterprise among employees or affiliates of the business or enterprise, provided that access to the service or application is restricted to employees or affiliates of the business or enterprise using the service or application.
(d) “User” means a person with an account on a social media platform.
(e) “Violent post” means content on a social media platform that contains a true threat against a specific person that is not protected by the First Amendment to the United States Constitution.
(Added by Stats. 2022, Ch. 881, Sec. 1. (SB 1056) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.46 - Online Violence Prevention Act › Section 1798.99.21.

1798.99.21. (a) A social media platform shall clearly and conspicuously state whether it has a mechanism for reporting violent posts that is available to users and nonusers of the platform.
(b) If the social media platform has a reporting mechanism, the statement required by this subdivision shall include a link to the reporting mechanism.
(Added by Stats. 2022, Ch. 881, Sec. 1. (SB 1056) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.46 - Online Violence Prevention Act › Section 1798.99.22.

1798.99.22. (a) (1) (A) A person who is the target of a violent post, or reasonably believes the person is the target of a violent post, may seek an order requiring the social media platform to remove the violent post and any related violent post the court determines shall be removed in the interests of justice.
(B) (i) A person may bring an action pursuant to this paragraph before 48 hours have passed since providing notice to a social media platform pursuant to paragraph (2), but the court shall not rule on the request for an order until 48 hours have passed from the provision of notice.
(ii) The court may dismiss an action described by clause (i) if the social media platform deletes the post before 48 hours have passed from the provision of notice.
(C) Except as provided in subparagraph (D), a person may bring an action pursuant to this paragraph at any time, and the court may rule on the request at any time, if the social media platform does not have a reporting mechanism described in Section 1798.99.21.
(D) A person shall not bring an action pursuant to this paragraph, nor shall a court issue an order requiring a social medial platform to remove a violent post or any related violent post, based upon content containing a true threat against a specific person if the date and time when the true threat that was threatened to occur has passed.
(2) If the social media platform has a reporting mechanism described in Section 1798.99.21, a person shall not bring an action pursuant to paragraph (1) until the person has notified the social media platform of the violent post and requested that it be removed through the reporting mechanism.
(b) (1) A court shall award court costs and reasonable attorney’s fees to a prevailing plaintiff in an action brought pursuant to this section.
(2) Reasonable attorney’s fees may be awarded to a prevailing defendant upon a finding by the court that the plaintiff’s prosecution of the action was not in good faith.
(Added by Stats. 2022, Ch. 881, Sec. 1. (SB 1056) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.46 - Online Violence Prevention Act › Section 1798.99.23.

1798.99.23. This title does not apply to a social media platform with fewer than 1,000,000 discrete monthly users.
(Added by Stats. 2022, Ch. 881, Sec. 1. (SB 1056) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.28.

1798.99.28. This title shall be known, and may be cited, as the California Age-Appropriate Design Code Act.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.29.

1798.99.29. The Legislature declares that children should be afforded protections not only by online products and services specifically directed at them but by all online products and services they are likely to access and makes the following findings:
(a) Businesses that develop and provide online services, products, or features that children are likely to access should consider the best interests of children when designing, developing, and providing that online service, product, or feature.
(b) If a conflict arises between commercial interests and the best interests of children, companies should prioritize the privacy, safety, and well-being of children over commercial interests.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.30.

1798.99.30. (a) For purposes of this title, the definitions in Section 1798.140 shall apply unless otherwise specified in this title.
(b) For the purposes of this title:
(1) “Child” or “children,” unless otherwise specified, means a consumer or consumers who are under 18 years of age.
(2) “Data Protection Impact Assessment” means a systematic survey to assess and mitigate risks that arise from the data management practices of the business to children who are reasonably likely to access the online service, product, or feature at issue that arises from the provision of that online service, product, or feature.
(3) “Default” means a preselected option adopted by the business for the online service, product, or feature.
(4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
(A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.
(5) “Online service, product, or feature” does not mean any of the following:
(A) A broadband internet access service, as defined in Section 3100.
(B) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(C) The delivery or use of a physical product.
(6) “Profiling” means any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.33.

1798.99.33. (a) A business shall complete a Data Protection Impact Assessment on or before July 1, 2024, for any online service, product, or feature likely to be accessed by children offered to the public before July 1, 2024.
(b) This section does not apply to an online service, product, or feature that is not offered to the public on or after July 1, 2024.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.35.

1798.99.35. (a) Any business that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.
(b) Any penalties, fees, and expenses recovered in an action brought under this title shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the Attorney General in connection with this title.
(c) (1) If a business is in substantial compliance with the requirements of paragraphs (1) through (4), inclusive, of subdivision (a) of Section 1798.99.31, the Attorney General shall provide written notice to the business, before initiating an action under this title, identifying the specific provisions of this title that the Attorney General alleges have been or are being violated.
(2) If, within 90 days of the notice required by this subdivision, the business cures any noticed violation and provides the Attorney General a written statement that the alleged violations have been cured, and sufficient measures have been taken to prevent future violations, the business shall not be liable for a civil penalty for any violation cured pursuant to this subdivision.
(d) Nothing in this title shall be interpreted to serve as the basis for a private right of action under this title or any other law.
(e) The Attorney General may solicit broad public participation and adopt regulations to clarify the requirements of this title.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.47 - The California Age-Appropriate Design Code Act › Section 1798.99.40.

1798.99.40. This title does not apply to the information or entities described in subdivision (c) of Section 1798.145.
(Added by Stats. 2022, Ch. 320, Sec. 2. (AB 2273) Effective January 1, 2023.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.80.

1798.99.80. For purposes of this title:
(a) The definitions in Section 1798.140 shall apply unless otherwise specified in this title.
(b) “Authorized agent” has the same meaning as used in Chapter 1 (commencing with Section 7000) of Division 6 of Title 11 of the California Code of Regulations.
(c) “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. “Data broker” does not include any of the following:
(1) An entity to the extent that it is covered by the federal Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.).
(2) An entity to the extent that it is covered by the Gramm-Leach-Bliley Act (Public Law 106-102) and implementing regulations.
(3) An entity to the extent that it is covered by the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).
(4) An entity, or a business associate of a covered entity, to the extent their processing of personal information is exempt under Section 1798.146. For purposes of this paragraph, “business associate” and “covered entity” have the same meanings as defined in Section 1798.146.
(Amended by Stats. 2023, Ch. 709, Sec. 1. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.81.

1798.99.81. A fund to be known as the “Data Brokers’ Registry Fund” is hereby created within the State Treasury. The fund shall be administered by the California Privacy Protection Agency. All moneys collected or received by the California Privacy Protection Agency and the Department of Justice under this title shall be deposited into the Data Brokers’ Registry Fund, to be available for expenditure by the California Privacy Protection Agency, upon appropriation by the Legislature, to offset all of the following costs:
(a) The reasonable costs of establishing and maintaining the informational internet website described in Section 1798.99.84.
(b) The costs incurred by the state courts and the California Privacy Protection Agency in connection with enforcing this title, as specified in Section 1798.99.82.
(c) The reasonable costs of establishing, maintaining, and providing access to the accessible deletion mechanism described in Section 1798.99.86.
(Amended by Stats. 2023, Ch. 709, Sec. 2. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.84.

1798.99.84. The California Privacy Protection Agency shall create a page on its internet website where the registration information provided by data brokers described in paragraph (2) of subdivision (b) of Section 1798.99.82 and the accessible deletion mechanism described in Section 1798.99.86 shall be accessible to the public.
(Amended by Stats. 2023, Ch. 709, Sec. 4. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.85.

1798.99.85. (a) On or before July 1 following each calendar year in which a business meets the definition of a data broker as provided in this title, the business shall do all of the following:
(1) Compile the number of requests pursuant to subdivision (c) of Section 1798.99.86 and Sections 1798.105, 1798.110, 1798.115, 1798.120, and 1798.121 that the data broker received, complied with in whole or in part, and denied during the previous calendar year.
(2) Compile the median and the mean number of days within which the data broker substantively responded to requests pursuant to subdivision (c) of Section 1798.99.86 and Sections 1798.105, 1798.110, 1798.115, 1798.120, and 1798.121 that the data broker received during the previous calendar year.
(3) Disclose the metrics compiled pursuant to paragraphs (1) and (2) within the data broker’s privacy policy posted on their internet website and accessible from a link included in the data broker’s privacy policy.
(b) In its disclosure pursuant to paragraph (3) of subdivision (a) regarding requests made pursuant to subdivision (c) of Section 1798.99.86, a data broker shall disclose the number of requests that the data broker denied in whole or in part because of any of the following:
(1) The request was not verifiable.
(2) The request was not made by a consumer.
(3) The request called for information exempt from deletion.
(4) The request was denied on other grounds.
(c) In its disclosure pursuant to paragraph (3) of subdivision (a), a data broker shall, for each provision of Section 1798.145 or 1798.146 under which deletion was not required, specify the number of requests in which deletion was not required in whole, or in part, under that provision.
(Added by Stats. 2023, Ch. 709, Sec. 5. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.87.

1798.99.87. (a) Except as provided in subdivision (b), the California Privacy Protection Agency may adopt regulations pursuant to the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code) to implement and administer this title.
(b) Notwithstanding subdivision (a), any regulation adopted by the California Privacy Protection Agency to establish fees authorized by this title shall be exempt from the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1 of Division 3 of Title 2 of the Government Code).
(Added by Stats. 2023, Ch. 709, Sec. 7. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.88.

1798.99.88. Nothing in this title shall be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018 (Title 1.81.5 (commencing with Section 1798.100)).
(Added by Stats. 2019, Ch. 753, Sec. 2. (AB 1202) Effective January 1, 2020.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.48 - Data Broker Registration › Section 1798.99.89.

1798.99.89. No administrative action brought pursuant to this title alleging a violation of any of the provisions of this title shall be commenced more than five years after the date on which the violation occurred.
(Added by Stats. 2023, Ch. 709, Sec. 8. (SB 362) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.49 - Family Planning Center Location Data › Section 1798.99.90.

1798.99.90. (a) A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except as specified in subdivision (c).
(b) For purposes of this section, the following definitions apply:
(1) “Business” means the same as defined in subdivision (c) of Section 1798.140.
(2) “Collect” means the same as defined in subdivision (f) of Section 1798.140.
(3) “Family planning center” means a business categorized as a family planning center by the North American Industry Classification System adopted by the United States Census Bureau, including, but not limited to, a clinic or center that provides reproductive health care services as defined in Section 1798.300 of the Civil Code.
(4) “Personal information” has the same definition as that term is defined in subdivision (v) of Section 1798.140, except as applied to all persons and not limited to consumers and households, as those terms are defined in subdivisions (i) and (q), respectively, of that section.
(5) “Precise geolocation” means a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet as derived from a device that is used or intended to be used to locate a person.
(6) “Sell” means the same as defined in subdivision (ad) of Section 1798.140.
(7) “Share” means the same as defined in subdivision (ah) of Section 1798.140.
(c) A person or business shall not collect, use, disclose, or retain the personal information of a person who is physically located at, or within a precise geolocation of, a family planning center, except only as necessary to perform the services or provide the goods requested by the person. A person or business shall not sell or share this personal information.
(d) (1) An aggrieved person or entity, including a family planning center, may institute and prosecute a civil action against any person or business who violates this section for injunctive and monetary relief and attorney’s fees within three years of discovery of the violation.
(2) If the court finds for the petitioner in an action authorized by paragraph (1), recovery shall be in the amount of three times the amount of actual damages and any other expenses, costs, or reasonable attorney’s fees incurred in connection with the litigation.
(e) This section does not apply to a provider of health care, a health care service plan, or contractor, as those terms are defined in Section 56.05.
(Added by Stats. 2023, Ch. 260, Sec. 5. (SB 345) Effective January 1, 2024.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.5 - California Consumer Privacy Act of 2018 › Section 1798.106.

1798.106. Consumers’ Right to Correct Inaccurate Personal Information
(a) A consumer shall have the right to request a business that maintains inaccurate personal information about the consumer to correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.
(b) A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s right to request correction of inaccurate personal information.
(c) A business that receives a verifiable consumer request to correct inaccurate personal information shall use commercially reasonable efforts to correct the inaccurate personal information as directed by the consumer, pursuant to Section 1798.130 and regulations adopted pursuant to paragraph (8) of subdivision (a) of Section 1798.185.
(Added November 3, 2020, by initiative Proposition 24, Sec. 6. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.5 - California Consumer Privacy Act of 2018 › Section 1798.110.

1798.110. Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information
(a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
(1) The categories of personal information it has collected about that consumer.
(2) The categories of sources from which the personal information is collected.
(3) The business or commercial purpose for collecting, selling, or sharing personal information.
(4) The categories of third parties to whom the business discloses personal information.
(5) The specific pieces of personal information it has collected about that consumer.
(b) A business that collects personal information about a consumer shall disclose to the consumer, pursuant to subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer, provided that a business shall be deemed to be in compliance with paragraphs (1) to (4), inclusive, of subdivision (a) to the extent that the categories of information and the business or commercial purpose for collecting, selling, or sharing personal information it would be required to disclose to the consumer pursuant to paragraphs (1) to (4), inclusive, of subdivision (a) is the same as the information it has disclosed pursuant to paragraphs (1) to (4), inclusive, of subdivision (c).
(c) A business that collects personal information about consumers shall disclose, pursuant to subparagraph (B) of paragraph (5) of subdivision (a) of Section 1798.130:
(1) The categories of personal information it has collected about consumers.
(2) The categories of sources from which the personal information is collected.
(3) The business or commercial purpose for collecting, selling, or sharing personal information.
(4) The categories of third parties to whom the business discloses personal information.
(5) That a consumer has the right to request the specific pieces of personal information the business has collected about that consumer.
(Amended November 3, 2020, by initiative Proposition 24, Sec. 7. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.5 - California Consumer Privacy Act of 2018 › Section 1798.115.

1798.115. Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom
(a) A consumer shall have the right to request that a business that sells or shares the consumer’s personal information, or that discloses it for a business purpose, disclose to that consumer:
(1) The categories of personal information that the business collected about the consumer.
(2) The categories of personal information that the business sold or shared about the consumer and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared.
(3) The categories of personal information that the business disclosed about the consumer for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
(b) A business that sells or shares personal information about a consumer, or that discloses a consumer’s personal information for a business purpose, shall disclose, pursuant to paragraph (4) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) to the consumer upon receipt of a verifiable consumer request from the consumer.
(c) A business that sells or shares consumers’ personal information, or that discloses consumers’ personal information for a business purpose, shall disclose, pursuant to subparagraph (C) of paragraph (5) of subdivision (a) of Section 1798.130:
(1) The category or categories of consumers’ personal information it has sold or shared, or if the business has not sold or shared consumers’ personal information, it shall disclose that fact.
(2) The category or categories of consumers’ personal information it has disclosed for a business purpose, or if the business has not disclosed consumers’ personal information for a business purpose, it shall disclose that fact.
(d) A third party shall not sell or share personal information about a consumer that has been sold to, or shared with, the third party by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt-out pursuant to Section 1798.120.
(Amended November 3, 2020, by initiative Proposition 24, Sec. 8. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.5 - California Consumer Privacy Act of 2018 › Section 1798.120.

1798.120. Consumers’ Right to Opt Out of Sale or Sharing of Personal Information
(a) A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. This right may be referred to as the right to opt-out of sale or sharing.
(b) A business that sells consumers’ personal information to, or shares it with, third parties shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be sold or shared and that consumers have the “right to opt-out” of the sale or sharing of their personal information.
(c) Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.
(d) A business that has received direction from a consumer not to sell or share the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell or share the minor consumer’s personal information, shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from selling or sharing the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer’s personal information.
(Amended November 3, 2020, by initiative Proposition 24, Sec. 9. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)
2023 California Code › Civil Code - CIV › DIVISION 3 - OBLIGATIONS › PART 4 - OBLIGATIONS ARISING FROM PARTICULAR TRANSACTIONS › TITLE 1.81.5 - California Consumer Privacy Act of 2018 › Section 1798.121.

1798.121. Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information
(a) A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services set forth in paragraphs (2), (4), (5), and (8) of subdivision (e) of Section 1798.140, and as authorized by regulations adopted pursuant to subparagraph (C) of paragraph (19) of subdivision (a) of Section 1798.185. A business that uses or discloses a consumer’s sensitive personal information for purposes other than those specified in this subdivision shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135, that this information may be used, or disclosed to a service provider or contractor, for additional, specified purposes and that consumers have the right to limit the use or disclosure of their sensitive personal information.
(b) A business that has received direction from a consumer not to use or disclose the consumer’s sensitive personal information, except as authorized by subdivision (a), shall be prohibited, pursuant to paragraph (4) of subdivision (c) of Section 1798.135, from using or disclosing the consumer’s sensitive personal information for any other purpose after its receipt of the consumer’s direction unless the consumer subsequently provides consent for the use or disclosure of the consumer’s sensitive personal information for additional purposes.
(c) A service provider or contractor that assists a business in performing the purposes authorized by subdivision (a) may not use the sensitive personal information after it has received instructions from the business and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose. A service provider or contractor is only required to limit its use of sensitive personal information received pursuant to a written contract with the business in response to instructions from the business and only with respect to its relationship with that business.
(d) Sensitive personal information that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to this section, as further defined in regulations adopted pursuant to subparagraph (C) of paragraph (19) of subdivision (a) of Section 1798.185, and shall be treated as personal information for purposes of all other sections of this act, including Section 1798.100.
(Added November 3, 2020, by initiative Proposition 24, Sec. 10. Effective December 16, 2020. Operative January 1, 2023, pursuant to Sec. 31 of Proposition 24.)