Tracks devices, in California

Cal. Bus. and Prof. Code sections 22575 to 22579 · Read the law's page

• Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
• List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
• Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
• Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
• Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
• Post a missing privacy policy within 30 days of being notified that it is missing.

Cal. Civ. Code sections 1798.83 and 1798.84 · Read the law's page

• If you are a business with 20 or more full-time or part-time employees, have an established business relationship with a California customer who deals with you primarily for personal, family, or household purposes, and in the preceding calendar year disclosed that customer's personal information to third parties you know or reasonably should know used it for their own direct marketing, answer the customer's request for the disclosures below, free of charge.
• Tell the customer, in writing or by email, which of the listed categories of personal information you disclosed to third parties for their direct marketing during the preceding calendar year. The categories include name and address, email address, age or date of birth, telephone number, occupation, the kind of product or service the customer bought, Social Security number, payment card numbers, payment history and creditworthiness.
• Tell the customer, in writing or by email, the names and addresses of all the third parties that received the information for their direct marketing during the preceding calendar year and, if the nature of a third party's business cannot reasonably be determined from its name, examples of the products or services marketed, if you know them.
• Designate a mailing address, an email address or, if you choose to take requests by telephone or fax, a toll-free number for these requests, and do at least one of three things: tell the managers and supervisors of employees who regularly deal with customers to give the designated contact to anyone who asks about your privacy practices; put a link titled "Your Privacy Rights" on your home page, or add those words to your privacy policy link; or make the designated contact available on request at every place of business in California where you regularly deal with customers.
• Answer a request received at a designated address or number within 30 days, and a request received anywhere else within a reasonable period that does not exceed 150 days from receipt.
• You need not answer the same customer more than once in a calendar year, and you may give the information in a standardized format without associating it with specific individuals.
• As an alternative to answering, if your privacy policy publicly states that you disclose customer information for third parties' direct marketing only after the customer first affirmatively agrees, or not if the customer has opted out, you may tell the customer of the right to prevent disclosure and give a cost-free way to use it, so long as you maintain and disclose that policy.
• A disclosure under a contract for processing, storage or services on your behalf, for your own marketing that discloses nothing to third parties, for servicing accounts, to or from a consumer reporting agency, or to a financial institution to obtain payment is not a disclosure for direct marketing purposes, and a financial institution subject to the California Financial Information Privacy Act is outside this section if it complies with the Financial Code sections the subdivision names.

Consumer Protection Against Computer Spyware Act, Cal. Bus. & Prof. Code §§ 22947-22947.6 · Read the law's page

• If you are not an authorized user of a computer (its owner, or a person its owner or lessee has authorized to use it, and a person authorized solely through an end user license agreement is not an authorized user), do not cause software to be copied onto the computer of a consumer in California (an individual who lives in California and uses the computer mainly for personal, family or household purposes) and use it to do any of the acts below; sections 22947.2 and 22947.3 apply where you act with actual knowledge, with conscious avoidance of actual knowledge or willfully.
• Do not use that software to modify, through intentionally deceptive means, the page that appears when the user launches an Internet browser, the default provider or Web proxy the user relies on to access or search the Internet, or the user's list of bookmarks.
• Do not use that software to collect, through intentionally deceptive means, personally identifiable information through a keystroke-logging function that records all of the user's keystrokes and transfers them to another person, or information covering all or substantially all of the Web sites the user visits (other than your own) where the software was installed in a manner designed to conceal the installation from every authorized user, or a financial account number, a password or PIN for a financial account, a Social Security number, or account balances or overdraft history in a form that identifies the user, extracted from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the user.
• Without the user's authorization and through intentionally deceptive means, do not prevent the user's reasonable efforts to block or disable software by causing software the user has properly removed or disabled to reinstall or reactivate itself; do not misrepresent, knowing it to be untrue, that software will be uninstalled or disabled by the user's action; and do not use intentionally deceptive means to remove, disable or render inoperative security, antispyware or antivirus software on the computer.
• Do not use that software to take control of the computer by sending or relaying commercial electronic mail or a computer virus that someone other than the user initiated without the user's authorization, by using the user's modem or Internet service to damage the computer or to make the user incur charges the user did not authorize, by using the computer as part of a group of computers to damage another computer (including a denial of service attack), or by opening multiple, sequential, stand-alone advertisements in the user's browser when you know a reasonable user cannot close them without turning off the computer or closing the browser.
• Do not use that software to modify the user's security or other settings that protect information about the user for the purpose of stealing the user's personal information, or the computer's security settings for the purpose of damaging one or more computers.
• Without the user's authorization, do not prevent the user's reasonable efforts to block the installation of software or to disable it by presenting an option to decline installation when you know the installation will proceed anyway when the user selects it, or by falsely representing that software has been disabled.
• Do not induce a user to install a software component by intentionally misrepresenting that installing software is necessary for security or privacy reasons or in order to open, view or play a particular type of content, and do not deceptively cause a software component to be copied onto and executed on the computer with the intent that the user use it in a way that violates section 22947.4.
• Sections 22947.3 and 22947.4 leave out monitoring of or interaction with a subscriber's Internet or other network connection or service, or a protected computer, by a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service for network or computer security, diagnostics, technical support, repair, authorized updates of software or system firmware, authorized remote system management, or detection or prevention of the unauthorized use of or fraudulent or other illegal activities in connection with a network, service, or computer software, including scanning for and removing software the chapter proscribes.

Cal. Civ. Code sections 1798.90 and 1798.90.05 · Read the law's page

• If you are a commercial entity offering a book service to the public, meaning a service whose primary purpose is the rental, purchase, borrowing, browsing or viewing of books in print, audio, electronic or other format, do not knowingly disclose a user's personal information to a government entity, and do not disclose it to anyone under compulsion, except as the section allows. A store that sells a variety of consumer products is outside the section when its book sales are no more than 2 percent of its total annual gross sales of consumer products sold in the United States.
• Disclose a user's personal information to a law enforcement entity only under a court order from a court with jurisdiction over the offense under investigation, issued on findings of probable cause, a compelling interest and no less intrusive means, after reasonable notice to you of the proceeding and with the law enforcement entity's statement that it has notified the user, unless a judge has found a strong showing of necessity to delay that notice for up to 90 days.
• Disclose a user's personal information to another government entity, or to a person or private entity in a pending action, only under a court order issued on findings of a compelling interest and no less intrusive means, after reasonable notice to you, and refrain from disclosing until you have given the user notice of the order and the user has had at least 35 days to appear and quash it.
• You may disclose a user's personal information where the user has given informed, affirmative consent to the specific disclosure for a particular purpose; to a government entity on a good-faith belief in imminent danger of death or serious physical injury that needs immediate disclosure; and to a government entity where you believe in good faith the information is evidence directly related and relevant to a crime against you or that user.
• On a law enforcement entity's request, preserve the records of a user's personal information related to the use of a book or part of a book for 90 days, and for a further 90 days on a renewed request.
• If you have disclosed personal information of more than 30 total users located in California or of unknown location, prepare an annual report, covering the previous calendar year, of the warrants, subpoenas, court orders and consent requests you received, the emergency and crime-against-you disclosures you made, and for each category the notices given, disclosures made and not made, contests, users affected and types of information disclosed.
• Make the report publicly available in an online, searchable format on or before March 1 each year, or post it prominently on your premises or send it to the Office of Privacy Protection by that date if you have no website. If you are subject to Business and Professions Code section 22575, also link to or post the report in your privacy policy or site by March 1, or state there that no report is available because you are exempt.

Cal. Penal Code §§ 638.50-638.52 · Read the law's page

• Do not install or use a pen register or a trap and trace device without first obtaining a court order, unless you are a provider of electronic or wire communication service using the device to operate, maintain, or test your own service, to protect your rights or property, to protect users from unlawful or abusive use of the service, to record that a communication was initiated or completed in order to guard against fraudulent, unlawful, or abusive use, or unless the user of the service has consented.

Cal. Civ. Code sections 1798.99.80 to 1798.99.85 · Read the law's page

• Register with the California Privacy Protection Agency on or before January 31 following each year in which you are a data broker (you knowingly collect and sell to third parties the personal information of consumers you have no direct relationship with), and pay the registration fee the Agency sets.
• You are not a data broker to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers you, or your processing is exempt under Civil Code section 1798.146.
• In the registration, give your name and primary physical, email and website addresses and your request metrics, and say whether you collect minors' personal information; names, dates of birth, ZIP Codes, email addresses or phone numbers; account logins or account numbers with the codes that unlock them; government identification numbers; mobile advertising, connected television or vehicle identification numbers; citizenship or immigration data; union membership; sexual orientation; gender identity or expression; biometric data; precise geolocation; or reproductive health care data. If you collect none of the names, dates of birth, ZIP Codes, email addresses or phone numbers, and none of the mobile advertising, connected television or vehicle identification numbers, name one to three of the most common types of personal information you collect.
• Also state in the registration whether in the past year you shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (except under a subpoena or court order) or a developer of a generative artificial intelligence system or model; whether and to what extent you or a subsidiary is regulated by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, the Confidentiality of Medical Information Act or the federal HIPAA privacy, security and breach notification rules; and, beginning January 1, 2029, whether you have undergone the independent audit of your deletion compliance and the most recent year you submitted its report to the Agency.
• Link in the registration to a page on your website, free of dark patterns, that explains how consumers can delete and correct their personal information, learn what you collect and how to access it, learn what you sell or share and to whom, opt out of its sale or sharing, and limit the use and disclosure of their sensitive personal information.
• By July 1 each year, disclose in the privacy policy posted on your website, and through a link included in that policy, how many deletion, access, opt-out and limit requests you received, complied with in whole or in part, and denied in the previous calendar year, and the median and mean number of days you took to respond substantively. For deletion requests made through the Agency's accessible deletion mechanism, give how many you denied because the request was not verifiable, was not made by a consumer, called for exempt information or for other reasons. For every deletion request, give how many each provision of section 1798.145 or 1798.146 excused, in whole or in part.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063 · Read the law's page

• If you operate exclusively online and have a direct relationship with the consumers you collect personal information from, give consumers an email address for requests to delete, correct and know. Every other business must give two or more designated methods, one of them a toll-free telephone number, and a website method such as a webform if you maintain a website (section 7020(a) and (b)).
• Confirm receipt of a request to delete, correct or know within 10 business days, and respond within 45 calendar days of receipt. You may extend once by up to 45 more days if you give the consumer notice and an explanation (section 7021).
• To comply with a request to delete, erase the personal information from your existing systems (archived and backup systems excepted), deidentify it or aggregate it, tell your service providers and contractors to delete it, and notify the third parties you sold or shared it with unless that proves impossible or involves disproportionate effort, in which case give the consumer a detailed explanation (section 7022(b)).
• Do not disclose specific pieces of personal information to a requestor you cannot verify, and tell the requestor that you cannot verify their identity (section 7024(a)).
• Establish, document and comply with a reasonable method for verifying that a person making a request to delete, correct or know is the consumer about whom you hold information (section 7060(a)).
• Do not require a consumer to verify their identity to opt out of sale or sharing or to limit use of sensitive personal information (section 7060(b)).
• If you sell or share personal information, process an opt-out preference signal that is in a commonly used format, and that the sending platform makes clear is meant to opt the consumer out of sale and sharing, as a valid opt-out request (section 7025(b)).
• If you collect personal information online and receive such a signal, treat it as a valid request to opt out for that browser or device and any profile associated with it, including pseudonymous profiles, and do not require the consumer to supply more than is necessary to send the signal (section 7025(c)(1) and (2)).
• Display on your website whether you have processed the consumer's opt-out preference signal as a valid request to opt out of sale or sharing (section 7025(c)(6)).
• If you sell or share personal information, provide two or more designated methods for requests to opt out, which for an online business must include an opt-out preference signal and one other listed method. A cookie banner or cookie controls alone do not count (section 7026(a)).
• If you use or disclose sensitive personal information for purposes beyond those in section 7027(m), provide two or more designated methods for requests to limit (section 7027(b)).
• Take a request to opt in after opting out through a two-step process, a clear request followed by a separate confirmation (section 7028(a)).

Cal. Code Regs. tit. 11, sections 7600 to 7604 · Read the law's page

• If you are a data broker, register with the Agency during January 1 to 31 of each year through the Agency's website and pay the annual registration fee of $6,000 plus the payment-processing fee, which is not prorated or refunded (sections 7600 and 7602(a)).
• Have an employee or agent with sufficient knowledge of your practices register you and certify under penalty of perjury that the information submitted is true and correct, with accurate and functioning website links and email addresses (sections 7602(b) and 7603(a) and (b)).
• When you report the extent to which other laws regulate you, describe the types of personal information, the specific products or services and the approximate proportions of your data covered by those laws (section 7603(d)).

Cal. Civ. Code section 1798.99.92 · Read the law's page

• Do not geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services, to collect personal information from such a person, or to send such a person notifications or advertisements related to their personal information or health care services (section 1798.99.92(a)).
• Do not sell personal information to, or share it with, a third party for use in violating that prohibition. A statement signed under penalty of perjury by a person authorized to bind the third party that the information will not be used for these purposes is prima facie evidence that it was not sold or shared in violation (section 1798.99.92(b)).
• Do not use personal information obtained in violation of the section (section 1798.99.92(c)).

Cal. Civ. Code sections 1798.99.90 and 1798.99.91 · Read the law's page

• Do not collect, use, disclose, sell, share or retain the personal information of a person who is physically located at, or within a precise geolocation (a circle of 1,850 feet radius or less) of, a family planning center (section 1798.99.91(a)).
• You may collect or use that information only as necessary to perform the services or provide the goods the person requested, and every other prohibition still applies (section 1798.99.91(b)).

Cal. Civ. Code sections 1798.99.86 and 1798.99.82(d) · Read the law's page

• If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism (the Delete Request and Opt-Out Platform) at least once every 45 days, and within 45 days of receiving a deletion request through it, delete all personal information related to the consumer who made it.
• You need not delete personal information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require. Use what you keep only for that purpose, never for marketing or any other purpose.
• Direct all your service providers and contractors to delete all personal information in their possession related to each consumer whose deletion request you process.
• If you deny a deletion request because it cannot be verified, process it within 45 days as an opt-out of the sale or sharing of the consumer's personal information, and direct your service providers and contractors to do the same.
• After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 45 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion.
• After deleting a consumer's data under a request, do not sell or share new personal information about that consumer unless the consumer requests otherwise or section 1798.145 or 1798.146 permits it.
• Pay any access fee the Agency charges when you access the mechanism; it may not exceed the reasonable cost of providing that access.

Cal. Code Regs. tit. 11, sections 7610 to 7616 · Read the law's page

• If you are a data broker, create a DROP account before you first access the DROP, keep its credentials confidential and restricted to authorized persons, and tell the Agency immediately in writing of any unauthorized use of the account or breach of security related to the DROP (section 7610(a)(1)).
• If you begin operating as a data broker after the registration period, create a DROP account before operating, begin accessing the DROP within 45 calendar days of commencing operation, and pay the first-time access fee unless you have already paid a registration fee that year (section 7611(a)).
• Select every consumer deletion list whose identifiers match personal information in your records, and keep the selection current (section 7610(a)(3)).
• Access the DROP and download your selected consumer deletion lists at least once every 45 calendar days, manually if automated access fails (section 7612).
• Standardize your records as section 7613(a)(1) prescribes, hash them with the algorithm the deletion list uses, compare, and delete all personal information associated with each matched identifier, including inferences drawn from information collected from third parties, except what the statute exempts or you collected directly from the consumer as a first party (section 7613(a) and (b)).
• Keep a deletion request that matches nothing and compare newly collected records against it before you sell or share new personal information, and direct your service providers and contractors to delete matched information (section 7613(c) and (d)).
• At each access session report the status of every deletion request received in the previous session, with one of the response codes section 7614(b) lists (section 7614).
• Use the personal information the Agency provides only to comply with the Delete Act, never sell or share it, protect it with reasonable security procedures and practices, and do not contact a consumer to verify a DROP request (section 7616).

AB 883 (Ch. 507, Stats. 2026), Cal. Civ. Code Sections 1798.99.86 and 1798.99.86.5 · Read the law's page

• If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism at least once every 30 days, and within 30 days after receiving a deletion request through it, process the request and delete all personal information related to the consumer who made it (Civil Code Section 1798.99.86(c)(1)(A)).
• If you deny a deletion request because it cannot be verified, process it within 30 days of receiving it as an opt-out of the sale or sharing of the consumer's personal information (Section 1798.99.86(c)(1)(B)).
• After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 30 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion (Section 1798.99.86(d)(1)).
• From July 1, 2027, process a deletion request you receive from a state or local elected official or a judge by complying with Section 1798.99.86 and its implementing regulations (Section 1798.99.86.5(f), (i)).

Cal. Penal Code § 637.2 (SB 690, 2025-2026 Reg. Sess.) · Read the law's page

• From January 1, 2027, a website, online application, or mobile application is still bound by section 638.51: do not install or use a pen register or trap and trace device without first obtaining a court order unless one of that section's exceptions applies; this amendment leaves a claim against a private business over a violation arising there to the Attorney General alone, and does not lift that bar.

Cal. Civ. Code section 1798.99.86(e) · Read the law's page

• If you are a data broker, beginning January 1, 2028 and every three years after, have an independent third party audit your compliance with the deletion duties of Civil Code section 1798.99.86.
• Submit the audit report and any related materials to the California Privacy Protection Agency within five business days of its written request, and keep them for at least six years.