This law explains what businesses in California need to do when they collect personal information from consumers. They must tell consumers what information they are collecting, why they are collecting it, and how long they plan to keep it. If they collect sensitive info, like social security numbers, they must provide similar details. Businesses must also enter into agreements with any third parties they share data with, making sure those parties follow the same privacy rules. Plus, businesses need to have good security practices to protect this information. The law does not require businesses to give away any trade secrets.

This law gives people the right to ask companies to delete their personal information that the companies have collected. Companies must let people know they have this right and are required to delete the information once requested, and also get rid of it from the records of other parties they've shared it with. However, there are exceptions where the company doesn't have to delete the information, like completing a transaction, ensuring security, or complying with other laws. Businesses can keep a record of deletion requests to ensure they follow the rules. Service providers or contractors must also cooperate in deleting information.

This law gives consumers the right to ask businesses to correct any inaccurate personal information they have about them. Businesses must inform consumers about this right and, when requested, make reasonable efforts to fix any incorrect data as per given guidelines.

This law says that if a business collects your personal information, you have the right to know certain details about that. You're entitled to request that the business tells you what types of personal information they have, where they got it from, why they're collecting or sharing it, and with whom they share it. You can also ask for copies of the specific personal information they have about you. Businesses must provide this information once you make a verifiable request. Essentially, you have the right to be informed about how your personal data is being handled.

This California law gives you the right to request information from businesses about how they handle your personal information. You can ask which types of personal data they collect about you, whom they've sold or shared it with, and who they disclosed it to for business purposes. Businesses must provide this information if you make a verifiable request. Additionally, third parties can't sell or share your information without giving you notice and the option to say no.

California law gives consumers the right to tell a business not to sell or share their personal information with other companies. This is called the right to opt out. Businesses must notify consumers if they share or sell personal information and inform them of their opt-out rights. If a consumer is under 16, businesses can't sell or share their personal information unless there's specific permission from the consumer or their guardian. If directed not to share information, businesses must comply unless the consumer later consents. If a company knows or ignores the fact that a consumer is underage, it must follow these rules strictly.

This law gives consumers the right to limit how businesses use and share their sensitive personal information. If a consumer tells a business to restrict this use, the business must comply unless certain conditions are met, or the consumer consents later. Businesses must inform consumers when their sensitive data is used for other purposes and must respect their privacy decisions. Service providers working with these businesses also have to follow these rules and can only use the information for agreed purposes. If data isn’t used to guess personal traits, it isn’t covered by these rules but by broader privacy laws.

This law ensures that businesses cannot treat consumers unfairly if they decide to use their privacy rights, like opting out of selling their personal data. Companies can't deny services, charge different prices, or provide different quality products purely because a customer exercised these rights. However, businesses can offer different prices or services if they're tied to the value the consumer's data provides to the company. Moreover, businesses can have loyalty programs or financial incentives linked to personal data, but they must inform consumers about these and gain their consent first. These programs must not be unfair or manipulative, and consumers can withdraw their consent anytime.

This law requires businesses to provide easy ways for consumers to request information about their personal data, make corrections, or ask for data deletion. Businesses must offer at least two methods for these requests, including a toll-free number; if they are online-only, an email is sufficient. Once a request is verified, businesses have 45 days to fulfill it, which can be extended once by another 45 days if necessary. The businesses must provide information for free and in an accessible format, covering data from the past 12 months, or longer if required. They should also disclose data categories, sources, and sharing details in their privacy policies, updating that at least annually. Finally, staff handling these requests must be well-informed about consumer rights, and the personal data used for request verification must not be used for other purposes.

Businesses that sell or share consumer data must offer easy ways for consumers to stop this. They need to have clear links on their websites like 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information’ to help consumers opt out. Companies can also choose to use a single link to manage both choices. If a company adds fees for opting out, they must clearly explain any financial benefits to consumers. Companies must respect signals from consumers indicating their preference to opt out and ensure staff are knowledgeable about these rights. For businesses, handling of consumer opt-outs must be compliant and transparent, including for consumers under 16. Furthermore, they can’t use or sell this information for at least a year without the consumer's consent again. If a business redirects requests or shares information with others, those parties can only use the data for the specific service they provide. Fallacies or limitations in contracts about these rights are null.

This law section explains various terms related to consumer privacy rights and data protection within California. 'Advertising and marketing' involves communications made to encourage purchases. 'Aggregate consumer information' refers to data about groups, not individuals. 'Biometric information' includes characteristics like fingerprints used for identification. 'Business' is defined as profit-oriented entities that handle consumer data, meeting certain criteria. 'Personal information' covers data that identifies or is linked to individuals, such as names, addresses, and more. The law also elaborates on 'business purposes' for data use, including service fulfillment and security. 'Consent' requires a clear agreement from consumers for data use, and 'contractor' and 'service provider' roles have specific responsibilities in handling data. Other definitions include concepts like 'cross-context behavioral advertising' and 'dark patterns', which impact consumer interactions and privacy.

This section outlines various exemptions to the obligations imposed on businesses under specific California privacy laws. It allows businesses to comply with legal obligations like subpoenas or investigations, cooperate in emergencies, or perform certain commercial activities outside California without facing restrictions. It also does not apply to sensitive sectors like medical, financial, and educational information regulated by other laws. Additional exemptions cover activities related to employee information, non-commercial activities, and certain types of data associated with vehicle repairs, research studies, and credit reporting. Consumer rights like deletion and information requests have limits in specific contexts, such as job roles or official investigations. Finally, businesses are not liable if a service provider or third party misuses personal information, provided they didn't know of any potential violations at the time of sharing.

This law section states that certain medical and healthcare-related information is not covered by the privacy rules outlined in this title. It specifically exempts medical information that is already governed by existing California and federal laws like HIPAA. This includes medical data managed by healthcare providers, covered entities, and their business associates if they follow HIPAA rules. It also covers deidentified information and research data under specific conditions. If any data is reidentified, it must comply with relevant privacy laws. The section also defines key terms like 'business associate,' 'covered entity,' and 'protected health information' based on federal regulations.

This section prohibits anyone from taking data that has been anonymized and trying to figure out who it originally belonged to, except in certain situations. These situations include doing so for medical treatments, public health purposes, research in line with federal standards, testing deidentification methods under a strict contract, or when legally required. If anonymized data is reidentified, it needs to comply with privacy laws like HIPAA. Also, any contracts in California involving anonymized health data must state that this data can't be reidentified and can only be shared under these same rules.

This law allows Californians to sue businesses if their personal information is accessed or stolen due to the business's failure to secure that data properly. If a company's negligence leads to a breach, affected consumers can seek damages ranging from $100 to $750 per incident or more, depending on circumstances. The court assesses damages based on how serious and persistent the business's misconduct was, among other factors. Before suing for statutory damages, consumers must give the business a chance to fix the problem within 30 days. However, simply fixing security after a breach isn't enough to avoid lawsuits. Consumers can also sue for actual financial losses without prior notice. This right to sue only applies to this specific type of violation and doesn't cover breaches of other laws.

If a business violates the privacy laws in this title, it can be fined up to $2,500 for each violation. If they knowingly mishandle data for minors under 16 or do so intentionally, the fine goes up to $7,500 per case. Most of the penalty money collected will support the California Privacy Protection Agency's work in enforcing these laws, while a small portion goes to a fund for privacy-related grants.

This section creates the Consumer Privacy Fund within California's State Treasury. The fund is divided into three subfunds, each with specific purposes and requirements: the Consumer Privacy Subfund, the Attorney General Consumer Privacy Enforcement Subfund, and the Consumer Privacy Grant Subfund. A significant portion of fines and civil penalties from privacy violations are deposited into these subfunds. The first two subfunds focus on supporting activities by the California Privacy Protection Agency and the Attorney General, respectively, while the third subfund issues grants to promote consumer privacy and education on online privacy issues. Subfunds must use their funds exclusively for their intended purpose and cannot be reallocated elsewhere by the Legislature. Unused funds not appropriated by the 2025 Budget Act will be redistributed among these subfunds in specific proportions.

This law is designed to enhance privacy rights for individuals and adds to existing rules about how businesses handle personal information. Although primarily about electronic or online data, it applies to any personal info collected from consumers. If there's a conflict between laws, the one offering the most privacy protection should be followed.

This law makes it clear that the rules about how businesses collect and sell personal information in California are controlled by the state, not by local governments. Local rules can't contradict or replace these state rules.

This section outlines the responsibilities of the Attorney General and, starting July 2022, the California Privacy Protection Agency, to create and update regulations that protect consumer privacy. Key areas include updating definitions of personal and sensitive information, setting rules for consumers’ rights like opting out of data sale, and ensuring businesses respect those rights without tricking consumers. Regulations will also guide how businesses can use automated decision-making and how they handle privacy risks through audits. Additionally, there's a focus on harmonizing different privacy regulations and ensuring all consumer communications are clear and accessible. The law also sets distinct timelines for when these rules should be established and enforced.

This law says that if someone sets up a series of transactions or steps with the intention of getting around privacy rules, those steps will be ignored by the court or agency. This can happen, for instance, if a business gives information to a third party to dodge rules about selling or sharing data. It can also happen if something valuable is exchanged without clear monetary payment to sneak around the rules.

This law states that any part of a contract that tries to waive or limit rights under this title, specifically rights to remedies or ways to enforce them, is automatically void and can't be enforced. However, this doesn't stop consumers from choosing not to request information, opting out of data sales, or letting a business sell or share their personal data after opting out earlier.

This section is saying that the law is meant to add to existing federal and state laws, as long as it's allowed. However, it won't apply if it clashes with federal laws or the U.S. or California Constitutions.

This section clarifies when a particular set of privacy laws will start being enforced. Specifically, these laws only take effect starting January 1, 2020, if another specific privacy initiative, The Consumer Right to Privacy Act of 2018, is removed from the voting ballot.

This section states that despite what is said in Section 1798.198, the rules in Section 1798.180 will begin to apply as soon as the law that includes this section goes into effect.

This law sets up the California Privacy Protection Agency, which is responsible for overseeing the enforcement of privacy laws in California. The agency is run by a five-member board, with appointments made by the Governor, Attorney General, Senate Rules Committee, and Speaker of the Assembly. Members should have expertise in privacy, technology, or consumer rights. Initial appointments to the board must be completed within 90 days of the law's start date.

This law section outlines the rules for members of an agency board. They must be skilled in privacy and technology, keep information confidential, and avoid external influence. While serving, they can't engage in conflicting activities or jobs and have the right to agency information. After leaving, they can't work for certain companies for a year or represent others before the agency for money for two years, especially if they aim to sway the agency's actions.

This law states that members of the agency board, including the chairperson, can be removed or retained at any time by the person or entity that appointed them, but they cannot serve more than eight years in a row.

Board members of the agency earn $100 for each day they work on board activities, with this amount subject to change based on another rule. They also get reimbursed for any work-related expenses.

This law section explains that the agency board is responsible for hiring an executive director who will operate under the agency’s guidelines and legal requirements. The agency also has the power to hire and fire other staff, such as officers and counselors, and decide what they get paid, as long as they follow civil service rules. Additionally, the agency can hire outside help if needed for tasks their own employees can't do.

This law says that the board of an agency can allow the chairperson or the executive director to make decisions for the agency when the board isn't meeting. However, they can't handle enforcement actions or make new rules without the full board.

This section describes the responsibilities of an agency concerning the California Consumer Privacy Act (CCPA). The agency is tasked with implementing and enforcing the law, adopting regulations to support the CCPA, and protecting privacy rights related to personal information. It also aims to raise public awareness about privacy risks, provide guidance to consumers and businesses, and appoint a Chief Privacy Auditor for compliance checks. Additionally, the agency will advise on privacy legislation, monitor technological developments, cooperate with other privacy authorities, offer voluntary compliance certification for businesses, approve grant applications, and balance consumer privacy with business impact.

This section allows an agency to investigate potential breaches by businesses or service providers either based on citizen complaints or on its own. The agency can choose not to investigate if it believes there was no intent to violate or if the business took steps to fix the issue before being notified. They are required to notify the complainant of their decision and reasoning, although any confidential or privileged information linked to the investigation is not disclosed in the response.

Before an agency can decide if there's enough reason to believe a business, service provider, contractor, or person has broken the rules, it must inform them at least 30 days in advance of their supposed violation. This notification must be sent through registered mail or service of process and come with a summary of the evidence. The notified party has the right to attend and have a lawyer with them at any agency meeting discussing the potential violation. If they want the meeting to be public, they can request this in writing; otherwise, it will be private.

If a government agency thinks someone has broken this privacy law, they will hold a hearing to figure it out. The agency will follow specific rules for the hearing. If they find a violation, they can tell the person to stop the violation and pay a fine. The fine can be up to $2,500 for regular violations, or up to $7,500 if it was done on purpose or involves kids' personal information. Most of the fine goes into a special consumer privacy fund. If more than one person is responsible, each one is fully responsible for the fine.

If a governmental agency disagrees with a decision made by an administrative law judge, it must clearly explain in writing why it is rejecting that decision.

If a governmental agency imposes an administrative fine and it remains unpaid, the agency can take the matter to court to collect it. They have the option to file the case in small claims or higher courts based on the fine's amount, but only in the county where the fine was originally given. To win the case, the agency must prove the fine was lawfully imposed, the person was notified, and a payment request was made but not fulfilled. The agency has up to four years to start this court process after imposing the fine.

This law lets a government agency turn an administrative fine into a court judgment if no one contests the fine, or if all attempts to challenge it in court are over. To do this, the agency must apply to the court where the fine was issued, showing proof of the final order. The court clerk then immediately records it as a judgment, making it enforceable just like any other court ruling. However, the agency has up to four years to take this action after all legal reviews are resolved, and this process is an extra option on top of any other legal actions they might take.

If the agency makes a decision about a complaint or a fine, you can take it to court if you're affected by that decision. The court will check if the agency misused its authority when making its decision.

This law states that if a business, service provider, contractor, or person breaks privacy rules, they can face fines up to $2,500 for each violation or $7,500 if intentional or involving minors' data. Most of these fines fund the Attorney General’s efforts in enforcing privacy laws. Some money may go to other funds based on investigations. If the Attorney General takes a case, other agencies must pause their actions unless the Attorney General steps back. They can't take action if a decision or order has already been made on the same violation. Finally, this law doesn't affect individuals suing under another section (1798.150).

This law section explains the funding and operational guidelines for a specific California agency, including a $5 million initial budget from the state and $10 million annually (adjusted for cost-of-living) after that. The Department of Finance is responsible for including these amounts in budget reports. The Attorney General will support the agency until it hires its own staff, with the agency covering the costs. From 2025, the agency will adjust financial thresholds based on the Consumer Price Index every two years. These adjustments aim to stay in line with inflation and are not subject to standard rulemaking processes.

If a business violates certain rules, any fines or penalties they face could be lower if they genuinely tried to cooperate. They won't have to pay both an administrative fine and a civil penalty for the same mistake.