Chapter 22.7Digital Identity Theft

Section § 22670

Explanation

This law defines "covered material" as images or videos that look like they show someone's intimate parts or sexual activities without their consent and are posted on social media. If someone reports this kind of content, they are called a "reporting user." If this material is posted without consent, it’s considered "sexually explicit digital identity theft." However, the term "social media platform" doesn't include direct messaging services with encrypted communication or services run by nonprofit organizations.

(a)Copy CA Business and Professions Code § 22670(a)
(1)Copy CA Business and Professions Code § 22670(a)(1) “Covered material” means material that meets all of the following criteria:
(A)CA Business and Professions Code § 22670(a)(1)(A) The material is an image or video created or altered through digitization that would appear to a reasonable person to be an image or video of any of the following:
(i)CA Business and Professions Code § 22670(a)(1)(A)(i) An intimate body part of an identifiable person.
(ii)CA Business and Professions Code § 22670(a)(1)(A)(ii) An identifiable person engaged in an act of sexual intercourse, sodomy, oral copulation, or sexual penetration.
(iii)CA Business and Professions Code § 22670(a)(1)(A)(iii) An identifiable person engaged in masturbation.
(B)CA Business and Professions Code § 22670(a)(1)(B) The reporting person is the person depicted in the material, and the reporting person did not consent to the use of the reporting person’s likeness in the material.
(C)CA Business and Professions Code § 22670(a)(1)(C) The material is displayed, stored, or hosted on the social media platform.
(2)CA Business and Professions Code § 22670(a)(2) “Covered material” does not include an image or video that contains only minor alterations that do not lead to significant changes to the perceived content or meaning of the content, including changes to brightness or contrast of images and other minor changes that do not impact the content of the image or video.
(b)CA Business and Professions Code § 22670(b) “Reporting user” means a natural person who reports material to a social media platform using the mechanism provided by the social media platform pursuant to Section 22671.
(c)CA Business and Professions Code § 22670(c) “Sexually explicit digital identity theft” means the posting of covered material on a social media platform.
(d)Copy CA Business and Professions Code § 22670(d)
(1)Copy CA Business and Professions Code § 22670(d)(1) “Social media platform” has, except as provided in paragraph (2), the same meaning as defined in Section 22675.
(2)CA Business and Professions Code § 22670(d)(2) “Social media platform” does not include either of the following:
(A)CA Business and Professions Code § 22670(d)(2)(A) A stand-alone direct messaging service that provides end-to-end encrypted communication or the portion of a multiservice platform that uses end-to-end encrypted communication.
(B)CA Business and Professions Code § 22670(d)(2)(B) An internet-based service or application owned or operated by a nonprofit organization exempt from federal income tax pursuant to Section 501(c)(3) of the Internal Revenue Code.
digitized images consent intimate images sexual activities social media platforms reporting user sexual identity theft image creation video alteration encryption nonprofit services Section 501(c)(3) reasonable person standard minor alterations hosted material
(Added by Stats. 2024, Ch. 292, Sec. 1. (SB 981) Effective January 1, 2025.)

Section § 22671

Explanation

This law requires social media platforms to help California residents report cases of sexually explicit digital identity theft. Platforms must have a user-friendly way for people to file these reports. They need to confirm receiving a report within 48 hours and update the user about the report's status within a week. Platforms then have 30 days to decide if it's a case of identity theft but may extend to 60 days due to uncontrollable circumstances while informing the user of delays. During this process, platforms must block access to the suspected content and remove it if they confirm it's indeed theft.

A social media platform shall do all of the following:
(a)CA Business and Professions Code § 22671(a) Provide a mechanism that is reasonably accessible to a reporting user who is a California resident who has an account with the social media platform to report sexually explicit digital identity theft to the social media platform.
(b)CA Business and Professions Code § 22671(b) Collect information reasonably sufficient to enable the social media platform to locate the instance of sexually explicit digital identity theft and to contact a reporting user with both of the following:
(1)CA Business and Professions Code § 22671(b)(1) Confirmation that the social media platform received the reporting user’s report within 48 hours of receipt of the report.
(2)CA Business and Professions Code § 22671(b)(2) Within seven days of the date on which the confirmation required by paragraph (1) is issued, a written update to the reporting user as to the status of the social media platform’s handling of the reported sexually explicit digital identity theft.
(c)Copy CA Business and Professions Code § 22671(c)
(1)Copy CA Business and Professions Code § 22671(c)(1) Except as provided in paragraph (2), determine within 30 days of the date on which the confirmation required by paragraph (1) of subdivision (b) is issued whether there is a reasonable basis to believe that the reported sexually explicit digital identity theft is sexually explicit digital identity theft.
(2)Copy CA Business and Professions Code § 22671(c)(2)
(A)Copy CA Business and Professions Code § 22671(c)(2)(A) If the social media platform cannot comply with paragraph (1) within 30 days due to circumstances beyond the reasonable control of the social media platform, the social media platform shall comply with paragraph (1) no later than 60 days after the date on which the covered material was first reported.
(B)CA Business and Professions Code § 22671(c)(2)(A)(B) If subparagraph (A) applies, the social media platform shall promptly provide written notice of the delay, no later than 48 hours from the time the social media platform knew the delay was likely to occur, to the reporting user using the information collected from the reporting user under subdivision (b).
(d)Copy CA Business and Professions Code § 22671(d)
(1)Copy CA Business and Professions Code § 22671(d)(1) Temporarily block a reported instance of sexually explicit digital identity theft from being publicly viewable on the social media platform pending a determination pursuant to subdivision (c).
(2)CA Business and Professions Code § 22671(d)(2) Immediately remove a reported instance of sexually explicit digital identity theft from being publicly viewable on the social media platform if the social media platform determines there is a reasonable basis to believe the reported sexually explicit digital identity theft is sexually explicit digital identity theft.
social media platform reporting mechanism sexually explicit digital identity theft California resident user confirmation status update 30-day determination 60-day extension written notice temporarily block content remove content publicly viewable reporting user
(Added by Stats. 2024, Ch. 292, Sec. 1. (SB 981) Effective January 1, 2025.)