AB1355 - Location privacy.

Amended IN Assembly May 01, 2025 Amended IN Assembly April 10, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1355 Introduced by Assembly Member Ward (Principal coauthor: Assembly Member Aguiar-Curry) (Coauthor: Senator Wiener) February 21, 2025 An act to amend Sections 1798.100 and 1798.121 of, to add Section 1798.14.5 to, and to add Title 1.81.24 (commencing with Section 1798.90.75) to Part 4 of Division 3 of, the Civil Code, relating to privacy. LEGISLATIVE COUNSEL'S DIGEST AB 1355, as amended, Ward. Location privacy. (1) Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that collects sensitive personal information about the consumer to limit its use, as prescribed. Existing law defines “sensitive personal information” to mean, among other things, personal information that reveals a consumer’s precise geolocation. Existing law, the California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. This bill would prohibit a covered entity from collecting or processing the location information of an individual unless doing so is necessary to provide goods or services requested by that individual. The bill would impose various other restrictions on covered entities with regard to location information. The bill would define various terms for purposes of these provisions, including “location information” to mean information that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device, as specified. This bill would require a covered entity to prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information. The bill would require a covered entity to maintain and make available to the data subject a location privacy policy that includes specified information on data usage and management and is subject to a specified notice procedure. This bill would make a covered entity that violates these provisions liable for actual or statutory damages suffered by a person denied a right under these provisions and other specified relief. The bill would authorize the Attorney General or other public prosecutors to bring an action to recover a civil penalty against a covered entity that violates these provisions. This bill would require a business, as defined by the CCPA, to comply with the above-described provisions. (2) Existing law, the Information Practices Act of 1977, prescribes a set of requirements, prohibitions, and remedies applicable to agencies, as defined, with regard to their collection, storage, and disclosure of personal information, as defined. This bill would prohibit a state or local agency, including an agency as defined under the Information Practices Act, from monetizing, as defined, location information. By imposing new requirements on local agencies, this bill would impose a state-mandated local program. (3) The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that, if the Commission on State Mandates determines that the bill contains costs mandated by the state, reimbursement for those costs shall be made pursuant to the statutory provisions noted above. (4) The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. Section 1798.14.5 is added to the Civil Code, to read: 1798.14.5. Each agency shall not monetize location information, consistent with Title 1.81.24 (commencing with Section 1798.90.75). SEC. 2. Title 1.81.24 (commencing with Section 1798.90.75) is added to Part 4 of Division 3 of the Civil Code, to read: TITLE 1.81.24. California Location Privacy Act 1798.90.75. (a) This title shall be known, and may be cited, as the California Location Privacy Act. (b) For purposes of this title, the following terms shall, unless the context clearly requires otherwise, have the following meanings: (1) “Automated license plate recognition information,” or “ALPR information” means information or data collected through the use of an ALPR system. (2) “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data. (3) “Collect” means to obtain, infer, generate, create, receive, or access an individual’s location information. (4) “Covered entity” means any individual, partnership, corporation, limited liability company, association, or other group, however organized. A covered entity includes all agents of the entity. A covered entity does not include a state or local agency, or any court of California, a clerk of the court, or a judge or justice thereof. (5) “Disclose” means to make location information available to a third party, including, but not limited to, by sharing, publishing, releasing, transferring, disseminating, providing access to, or otherwise communicating that location information orally, in writing, electronically, or by any other means. (6) “Facial recognition technology” or “FRT” means a system that compares a probe image of an unidentified human face against a reference photograph database, and, based on biometric data, generates possible matches to aid in identifying the person in the probe image. (7) “Individual” means a natural person located within the State of California. (8) “Location information” means information derived from a device or from interactions between devices, with or without the knowledge of the user and regardless of the technological method used, that pertains to or directly or indirectly reveals the present or past geographical location of an individual or device within the State of California with sufficient precision to identify street-level location information within a range of five miles or less. Location information includes, but is not limited to, the following: (A) An internet protocol address capable of revealing the physical or geographical location of an individual. (B) Global Positioning System (GPS) coordinates. (C) Cell-site location information. (D) Information captured by an automated license plate recognition system that could be used to identify the specific location of an automobile at a point in time. (E) Information or image captured by a speed safety system or other traffic monitoring system that could be used to identify the specific location of an automobile at a point in time. (F) A video or photographic image that is used as a probe image in a facial recognition technology system that could be used to identify the specific location of an individual at a point in time. (9) “Monetize” means to collect, process, or disclose an individual’s location information for profit or in exchange for monetary or other consideration. This term includes, but is not limited to, selling, renting, trading, or leasing location information. “Monetize” shall not include the disclosure of public records for purposes of the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code). (10) “Probe image” means an image of a person that is searched against a database of known, identified persons or an unsolved photograph file. (11) “Process” means any operation or set of operations that are performed on location information whether or not by automated means. (12) “Sale” means selling, auctioning, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, an individual’s location information by the covered entity to a third party for monetary or other valuable consideration. (13) “Service provider” means an individual, partnership, corporation, limited liability company, association, or other group, however organized, that collects, processes, or transfers location information for the sole purpose of, and only to the extent that the service provider is, conducting business activities on behalf of, for the benefit of, at the direction of, and under contractual agreement with a covered entity. (14) “Speed safety system” means a fixed or mobile radar or laser system or any other electronic device that utilizes automated equipment to detect a violation of speed laws and obtains a clear photograph of a speeding vehicle’s license plate. 1798.90.76. (a) A covered entity shall not collect or process the location information of an individual unless doing so is necessary to provide goods or services requested by that individual. (b) It is unlawful for a covered entity or service provider that collects or processes location information to do any of the following: (1) (A) Subject to subparagraph (B), collect or process more location information than necessary to provide the goods or services requested by the individual. (B) Subparagraph (A) does not prohibit a covered entity from collecting or processing location information to respond to security incidents, fraud, harassment, malicious or deceptive activities or any illegal activity targeted at or involving the controller or processor or its services, or investigate, report or prosecute those responsible for any of those actions. Location information collected and processed under this subparagraph shall be limited to what is necessary to carry out one or more of the purposes listed in this subparagraph, and shall not be retained for longer than 24 hours. (2) Retain location information longer than necessary to provide the goods or services requested by the individual. (3) Sell, rent, trade, or lease location information to third parties. (4) Derive or infer from location information any data that is not necessary to provide the goods or services requested by the individual. (5) Disclose, cause to disclose, or assist with or facilitate the disclosure of an individual’s location information to third parties, unless the disclosure is necessary to provide the goods or services requested by the individual for which the information was collected, or requested by the individual to whom the location data pertains. (c) It is unlawful for a covered entity or service provider to disclose location information to any federal, state, or local government agency or official unless the agency or official serves the covered entity or service provider with a valid court order issued by a California court or a court order from another jurisdiction that is in keeping with California’s laws, including, but not limited to: (1) The Reproductive Privacy Act (Article 2.5 (commencing with Section 123460) of Chapter 2 of Part 2 of Division 106 of the Health and Safety Code). (2) A foreign penal civil action, as defined in Section 2029.200 of the Code of Civil Procedure. (d) It is unlawful for a state or local agency to monetize location information. 1798.90.77. (a) A covered entity shall prominently display, at the point where location information is being captured, a notice to individuals stating that their location information is being collected, the name of the covered entity and service provider collecting the information, and a phone number and an internet website where the individual can obtain more information. (b) A covered entity shall maintain and make available to the data subject a location privacy policy, which shall include, at a minimum, all of the following: (1) The goods or services requested by the individual for which the covered entity is collecting, processing, or disclosing any location information. (2) The type of location information collected, including the precision of the data. (3) The identities of service providers with which the covered entity contracts with respect to location data. (4) Any disclosures of location data necessary to provide the goods or services requested by the individual and the identities of the third parties to whom the location information could be disclosed. (5) The data management and data security policies governing location information. (6) The retention schedule and guidelines for permanently deleting location information. (c) A covered entity in lawful possession of location information shall provide notice to individuals to whom that information pertains of any change to its location privacy policy at least 20 business days before the change goes into effect, and shall request and obtain consent before collecting or processing location information in accordance with the new location privacy policy. 1798.90.78. (a) The California Privacy Protection Agency shall have authority to enforce this title and its implementing regulations. When the agency determines that any person is violating or has violated this title, the agency may issue an order to that person to pay an administrative fine, to cease and desist from violating the title, or both. Enforcement actions shall be conducted in accordance with the provisions of Chapter 5 (commencing with Section 11500) of Part 1 of Division 3 of Title 2 of the Government Code in the Administrative Procedure Act, and the Agency shall have all the powers granted therein. (b) Whoever denies a right protected by A person who violates this title, or aids, incites, or conspires in that denial, a violation, is liable for each and every offense for the violation in a claim brought by an injured party for actual damages suffered by any person denied that right and, in addition, all of the following: or statutory damages of twenty-five thousand dollars ($25,000), whichever is greater. The court may additionally award any of the following to a prevailing plaintiff: (1) An amount to be determined by a jury, or a court sitting without a jury, for exemplary damages. (2) A civil penalty of twenty-five thousand dollars ($25,000), to be awarded to the person denied the right protected by this title. (3) Preventive relief, including permane [Text truncated for display. Full text available on Congress.gov.]