Crawls the web, in California

30 Cal.4th 1342 (2003)

• Keep automated or bulk access from interfering with the intended functioning of the target's computer system: the California Supreme Court described the decisions upholding trespass claims as resting on use that actually did, or threatened to, interfere with the intended functioning of the system, as by significantly reducing its available memory and processing power.
• Under California law an electronic communication that neither damages the recipient computer system nor impairs its functioning is not an actionable trespass to chattels; the case concerned e-mail sent through a company's servers, and the tort requires evidence of injury to the plaintiff's personal property or legal interest in it.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code § 1798.140(v) · Read the law's page

• Do not treat personal data scraped from a third-party aggregator, directory, or re-posting site as publicly available under the CCPA merely because it appears on a public page; the exemption reaches only lawfully available government records, information lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting the audience.
• Never treat biometric information a business collected about a consumer without that consumer's knowledge as publicly available, regardless of source.
• If you meet CCPA's revenue or volume thresholds, personal data you collect by scraping still triggers the Act's business obligations, including when it feeds AI training.

Cal. Assemb. B. 2013, 2023-2024 Reg. Sess. (chaptered Sept. 28, 2024) · Read the law's page

• Applies to you only if you develop a generative AI system.
• Publish on your website a summary of the training data used for your generative AI system; compliance was required by 1 January 2026.
• In that summary, disclose the data's copyright status and ownership, and whether it included personal information or third-party copyrighted content (including news).
• You need not check for a publisher's opt-out under this law: it grants publishers no explicit opt-out or compensation right, and its pressure on developers who scraped news for training comes from disclosure.
• Expect enforceability to be uncertain: a December 2025 federal executive order directed review of state AI regulations for conflict with federal policy.

Cal. Civ. Code §§ 3110-3111 (AB 2013, Ch. 817, Statutes of 2024) · Read the law's page

• If you develop a generative AI system made available to Californians, publicly post documentation of your training datasets before each release or substantial modification, starting January 1, 2026.
• State whether those datasets include copyrighted, trademarked, or patented data, and whether they include personal information.

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Bus. & Prof. Code § 17200 · Read the law's page

• Do not engage in an unlawful, unfair or fraudulent business act or practice in connection with scraping or the use of scraped data.
• Causing measurable harm to, or impairing the operation of, a target's computer system through your crawling can expose you to trespass to chattels; merely unwanted access without such harm does not, under Intel Corp. v. Hamidi (Cal. 2003).

Cal. Penal Code § 502 · Read the law's page

• Do not continue accessing a California site, or circumvent a technical block, after the operator has sent a cease-and-desist notice (Facebook v. Power Ventures, 9th Cir. 2016; Craigslist v. 3Taps, N.D. Cal. 2013).
• Note that this statute's without permission standard has no threshold requirement that your initial access be unauthorized, unlike the federal CFAA.

Cal. Civ. Code section 1798.99.86(e) · Read the law's page

• If you are a data broker, beginning January 1, 2028 and every three years after, have an independent third party audit your compliance with the deletion duties of Civil Code section 1798.99.86.
• Submit the audit report and any related materials to the California Privacy Protection Agency within five business days of its written request, and keep them for at least six years.