SB50 - Connected devices: device protection requests.

Senate Bill No. 50 CHAPTER 676 An act to add Chapter 35.5 (commencing with Section 22948.30) to Division 8 of the Business and Professions Code, and to amend Section 6320 of the Family Code, relating to connected devices. [ Approved by Governor October 13, 2025. Filed with Secretary of State October 13, 2025. ] LEGISLATIVE COUNSEL'S DIGEST SB 50, Ashby. Connected devices: device protection requests. Existing law authorizes a court to issue a restraining order to a person to prevent abuse, as specified, based on reasonable proof of a past act or acts of abuse. Existing law authorizes the order to be issued solely on the affidavit or testimony of the person requesting the restraining order. Existing law requires a manufacturer of a connected device to equip the device with a reasonable security feature or features that are appropriate to the nature and function of the device, appropriate to the information it may collect, contain, or transmit, and designed to protect the device and information contained in the device from unauthorized access, destruction, use, modification, or disclosure. This bill would authorize a survivor, as defined, or a designated representative of a survivor, to submit a device protection request to an account manager, as defined, seeking to terminate a perpetrator’s access to a connected device or associated user account. The bill would define “survivor” for these purposes to mean an individual who has had specified criminal acts committed or allegedly committed against them or who cares for another individual against whom those criminal acts have been committed or allegedly committed, as provided. The bill would require an account manager, within 2 business days of receiving a complete device protection request, to terminate or disable the perpetrator’s access to the connected device or user account, or to inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or a similar state that removes all account holders, as provided. The bill would specify the requirements for a device protection request and would impose certain requirements on an account manager in processing a request. By providing that a device protection request may include a copy of a signed affidavit, the bill would expand the crime of perjury, and thus impose a state-mandated local program. This bill would require the account manager to clearly describe the process to submit a device protection request on their internet website or mobile application and would prohibit the account manager from providing specified information to the perpetrator. The bill would require an account manager and any officer, director, employee, vendor, or agent thereof to treat any information submitted by a survivor or a designated representative of a survivor as confidential and securely dispose of the information, as provided. This bill would authorize enforcement of these provisions by injunction or civil penalty in any court action by any person injured by a violation of those provisions, the Attorney General, a district attorney, county counsel, a city attorney, or a city prosecutor, against an account manager or perpetrator, as provided. The bill would prohibit a waiver of these prohibitions and would declare that these provisions are severable. Existing law authorizes a court to issue an ex parte order for, among other things, disturbing the peace of the other party. Existing law provides that disturbing the peace of the other party may be committed directly or indirectly, including through the use of a third party, and by any method or through any means including, but not limited to, telephone, online accounts, text messages, internet-connected devices, or other electronic technologies. This bill would provide that, for purposes of those provisions, an internet-connected device includes a connected device as described in the bill. The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish procedures for making that reimbursement. This bill would provide that no reimbursement is required by this act for a specified reason. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: YES Bill Text The people of the State of California do enact as follows: SECTION 1. The Legislature finds and declares all of the following: (a) According to the National Domestic Violence Hotline, almost one-half of all women and men in the United States have experienced psychological aggression by an intimate partner in their lifetime. (b) According to the National Network to End Domestic Violence, 97 percent of domestic violence programs report that abusers misuse technology to stalk, harass, and control victims. (c) An increase in the use of technology has become a concerning tool in cases of domestic violence and harassment. Perpetrators leverage smartphone applications to remotely control everyday objects to exercise control over, monitor, and abuse their victims. (d) Domestic violence, dating violence, stalking, sexual assault, human trafficking, and related crimes are life-threatening issues and have lasting and harmful effects on individuals, families, and entire communities. (e) Survivors often lack meaningful support and options when establishing independence from an abuser, including barriers such as financial insecurity and limited access to reliable communications tools to maintain essential connections with family, social safety networks, employers, and support services. (f) Laws related to the use of technology can play a public interest role in the promotion of safety, life, and property with respect to these types of violence and abuse. Independent access to devices can assist survivors in establishing security and autonomy. (g) Safeguards within tech-based services can serve a role in preventing abuse and narrowing the digital divide experienced by survivors of abuse. SEC. 2. Chapter 35.5 (commencing with Section 22948.30) is added to Division 8 of the Business and Professions Code, to read: CHAPTER 35.5. Connected Devices 22948.30. For purposes of this chapter, the following definitions apply: (a) “Account manager” means a person or entity that provides an individual an internet-based or app-based user account, or a third party that manages those user accounts on behalf of that person or entity, that has authority to make decisions regarding user access to those user accounts. (b) (1) “Connected device” means any device, or other physical object that is capable of connecting to the internet, directly or indirectly, and that is assigned an internet protocol address or Bluetooth address or enables a person to remotely obtain data from or send commands to a connected device or account, which may be accomplished through a software application that is designed to be operated on a mobile device, computer, or other technology. (2) “Connected device” does not include either of the following: (A) Peripheral or component devices that are solely dependent on a primary connected device for internet connectivity and that cannot be independently accessed, remotely disabled, or disconnected by a user or service provider. (B) A connected device that is more than 10 years old or is no longer supported by the account manager. (c) (1) “Covered act” means conduct that constitutes any of the following: (A) A crime described in Chapter 8 (commencing with Section 236) of Title 8 of Part 1 of the Penal Code. (B) A crime described in Chapter 1 (commencing with Section 261), Chapter 2 (commencing with Section 270), Chapter 2.5 (commencing with Section 273.8), Chapter 4 (commencing with Section 277), Chapter 5 (commencing with Section 281), Chapter 5.5 (commencing with Section 290), Chapter 7.5 (commencing with Section 311), Chapter 7.6 (commencing with Section 313), or Chapter 8 (commencing with Section 314) of Title 9 of Part 1 of the Penal Code. (C) An act under federal law, tribal law, or the Uniform Code of Military Justice that is similar to an offense described in subparagraph (A), (B), (D), or (E). (D) Domestic violence, as defined in Section 6211 of the Family Code. (E) A misdemeanor described in subdivision (e) of Section 243 of the Penal Code. (2) Nothing in paragraph (1) shall be construed to require a criminal conviction or any other determination of a court in order for conduct to constitute a covered act. (d) “Device access” means the ability to remotely control a connected device, remotely change the characteristics of a connected device, or remotely view or manipulate data collected by or through a connected device, by accessing a user account or accounts associated with the connected device. Acts that require device access include, but are not limited to, remotely manipulating an audio system, security system, light fixture, or other home appliance or fixture. (e) “Device protection request” means a request by a survivor to terminate or disable a perpetrator’s access to a connected device or account, including, but not limited to, the ability of a person to obtain data from or send commands to a connected device or account. (f) “Perpetrator” means an individual who has committed or allegedly committed a covered act against a survivor or an individual under the care of a survivor. (g) “Survivor” means an individual who has had a covered act committed, or allegedly committed, against the individual, or who cares for another individual against whom a covered act has been committed or allegedly committed, provided that the individual providing care did not commit or allegedly commit the covered act. (h) “User account or account” means an account or other means by which a person enrolls in or obtains access to a connected device or online service. 22948.31. (a) A survivor, or a designated representative of a survivor, may submit a device protection request to an account manager seeking to terminate a perpetrator’s access to a connected device or associated user account. (b) A device protection request shall include all of the following: (1) A verification that the perpetrator has committed or allegedly committed a covered act against the survivor or an individual in the survivor’s care, by providing either of the following: (A) A copy of a signed affidavit from a licensed medical or mental health care provider, licensed military medical or mental health care provider, licensed social worker, victim services provider, or licensed military victim services provider, a temporary restraining order, an emergency protective order, or a protective order lawfully issued pursuant to Section 527.6 of the Code of Civil Procedure, Part 3 (commencing with Section 6240) or Part 4 (commencing with Section 6300) of Division 10 of the Family Code, or Section 136.2 of the Penal Code. (B) A copy of a police report, statements provided by police, including military police, to magistrates or judges, charging documents, protective or restraining orders, military protective orders, or any other official record that documents the covered act, including a copy of a written report by a peace officer employed by a state or local law enforcement agency acting in the peace officer’s official capacity stating that the individual has filed a report alleging victimization of an act or crime. (2) Verification of the survivor’s exclusive legal possession or control of the connected device, including, but not limited to, a dissolution decree, temporary restraining order, protective order, domestic violence restraining order, or other document indicating the survivor’s exclusive use care, possession, or control of the connected device. (3) Identification of the connected device or devices. (4) Identification of the person that the requester seeks to deny device or account access. (c) An account manager shall offer a survivor or a designated representative of a survivor the ability to submit a device protection request under subdivision (b) through secure remote means that are easily navigable. Except as specified under subdivision (b), an account manager shall not require a specific form of documentation to submit a device protection request. (d) Within two business days of receiving a complete device protection request, the account manager shall do one of the following: (1) Terminate or disable the identified perpetrator’s access to the connected device or user account, and notify the survivor or their representative that access has been successfully denied. (2) Inform the survivor, in a clear and conspicuous manner, of any methods to reset the device to factory settings or to a similar state that removes all account holders. A reset method is one that does not require the survivor to possess a personal identification number (PIN), password, or other access credential, and shall be available solely by virtue of the survivor’s physical proximity to the device. (e) An account manager shall clearly describe the process under this section to submit a device protection request, including required documentation and available remedies, on its internet website and any associated mobile application. (f) An account manager shall not require any of the following as a condition for processing a device protection request: (1) Payment of a fee, penalty, or other charge for the survivor or a designated representative of the survivor to submit a request, or for the account manager to carry out the request. (2) Approval of the device protection request by any person who has device or account access that is not the survivor. (3) An increase in the rate charged for the account if any subscription fee or other recurring charge for account access applies. (4) Any other requirement not listed under subdivision (b). (g) An account manager shall not deny a device protection request due to arrears accrued by the account or associated with the connected device. (h) An account manager shall not notify the perpetrator of the access termination and shall not disclose any data, credentials, or account changes relating to the survivor or any new account created after the perpetrator’s access is removed. (i) A survivor shall not be financially responsible for any amount incurred or charged to the connected device or associated account by the perpetrator after the perpetrator’s access has been terminated under this chapter. (j) (1) An account manager and any officer, director, employee, vendor, or agent thereof shall treat any information submitted by a survivor or a designated representative of a survivor under this section as confidential and securely dispose of the information not later than 90 days after receiving the information. (2) Nothing in paragraph (1) shall be construed to prohibit an account manager from maintaining, for longer than the period specified in that paragraph, a record that verifies that a survivor or a designated r [Text truncated for display. Full text available on Congress.gov.]