Sends automated texts, in California

Cal. Civ. Code sections 1798.85 to 1798.89 · Read the law's page

• Do not publicly post or publicly display an individual's social security number in any manner (section 1798.85(a)(1)).
• Do not print an individual's social security number on any card required to access products or services you provide (section 1798.85(a)(2)).
• Do not require an individual to transmit their social security number over the internet unless the connection is secure or the number is encrypted (section 1798.85(a)(3)).
• Do not require an individual to use their social security number to access an internet website unless a password, unique personal identification number or other authentication device is also required (section 1798.85(a)(4)).
• Do not print an individual's social security number on materials mailed to the individual unless state or federal law requires it. Applications and forms sent by mail may include it, but not on a postcard or other mailer without an envelope, and not visible on the envelope (section 1798.85(a)(5)).
• Do not sell, advertise for sale or offer to sell an individual's social security number. Release incidental to a larger transaction that is necessary to identify the individual for a legitimate business purpose, or that law specifically authorizes, is not a sale, and release for marketing is not permitted (section 1798.85(a)(6)).
• Do not encode or embed a social security number in a card or document, such as in a barcode, chip or magnetic strip, in place of removing it (section 1798.85(g)).
• Do not present for recording or filing with a county recorder a document required to be open to the public that displays more than the last four digits of a social security number (section 1798.89(a)).

Cal. Civ. Code sections 1798.83 and 1798.84 · Read the law's page

• If you are a business with 20 or more full-time or part-time employees, have an established business relationship with a California customer who deals with you primarily for personal, family, or household purposes, and in the preceding calendar year disclosed that customer's personal information to third parties you know or reasonably should know used it for their own direct marketing, answer the customer's request for the disclosures below, free of charge.
• Tell the customer, in writing or by email, which of the listed categories of personal information you disclosed to third parties for their direct marketing during the preceding calendar year. The categories include name and address, email address, age or date of birth, telephone number, occupation, the kind of product or service the customer bought, Social Security number, payment card numbers, payment history and creditworthiness.
• Tell the customer, in writing or by email, the names and addresses of all the third parties that received the information for their direct marketing during the preceding calendar year and, if the nature of a third party's business cannot reasonably be determined from its name, examples of the products or services marketed, if you know them.
• Designate a mailing address, an email address or, if you choose to take requests by telephone or fax, a toll-free number for these requests, and do at least one of three things: tell the managers and supervisors of employees who regularly deal with customers to give the designated contact to anyone who asks about your privacy practices; put a link titled "Your Privacy Rights" on your home page, or add those words to your privacy policy link; or make the designated contact available on request at every place of business in California where you regularly deal with customers.
• Answer a request received at a designated address or number within 30 days, and a request received anywhere else within a reasonable period that does not exceed 150 days from receipt.
• You need not answer the same customer more than once in a calendar year, and you may give the information in a standardized format without associating it with specific individuals.
• As an alternative to answering, if your privacy policy publicly states that you disclose customer information for third parties' direct marketing only after the customer first affirmatively agrees, or not if the customer has opted out, you may tell the customer of the right to prevent disclosure and give a cost-free way to use it, so long as you maintain and disclose that policy.
• A disclosure under a contract for processing, storage or services on your behalf, for your own marketing that discloses nothing to third parties, for servicing accounts, to or from a consumer reporting agency, or to a financial institution to obtain payment is not a disclosure for direct marketing purposes, and a financial institution subject to the California Financial Information Privacy Act is outside this section if it complies with the Financial Code sections the subdivision names.

Cal. Bus. and Prof. Code Sections 17940 to 17943 · Read the law's page

• Clearly and conspicuously disclose that the user is interacting with a bot, which is the statute's safe harbor
• The prohibition reaches using a bot to mislead a Californian about its artificial identity in order to incentivize a commercial transaction or influence a vote

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code sections 56.18 to 56.186 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give California consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices and how to file a complaint alleging a violation of the chapter, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
• Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, before you collect, use or disclose their genetic data, and obtain separate and express consent for each use of the data collected through the product or service (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for marketing, or facilitating marketing, based on the data.
• Give a consumer effective mechanisms, without unnecessary steps and at least one through your primary medium of communication, to revoke consent. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the biological sample within 30 days of receiving a revocation of consent to store it.
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
• Develop procedures and practices that let a consumer easily access their genetic data, delete their account and genetic data (except data you must retain to comply with legal and regulatory requirements) and have their biological sample destroyed.
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises one, unless section 56.181(f)(2) applies: the entity is not primarily engaged in those functions, receives the data in a different capacity, and bars any part of it that administers, advises on or decides those matters from accessing the data or sample.
• Do not discriminate against a consumer for exercising rights under the chapter, whether by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing. This duty binds a person or a public entity.
• Bind a service provider that collects, transports or analyzes a consumer's biological sample or genetic data for you, by contract, not to retain, use or disclose the sample, extracted genetic material, genetic data or any information about the consumer's identity for any purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others.

Cal. Civ. Code section 1798.99.92 · Read the law's page

• Do not geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services, to collect personal information from such a person, or to send such a person notifications or advertisements related to their personal information or health care services (section 1798.99.92(a)).
• Do not sell personal information to, or share it with, a third party for use in violating that prohibition. A statement signed under penalty of perjury by a person authorized to bind the third party that the information will not be used for these purposes is prima facie evidence that it was not sold or shared in violation (section 1798.99.92(b)).
• Do not use personal information obtained in violation of the section (section 1798.99.92(c)).

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Bus. & Prof. Code § 17538.41 · Read the law's page

• If you are a person, business, candidate, or political committee in California, do not transmit a text message advertisement, one whose principal purpose is to promote the sale of goods or services or a political purpose, to a mobile telephone, pager, or two-way messaging device, unless an exception applies.
• You may send the message if it is at the direction of the subscriber's carrier and the subscriber may opt out, if you have an existing relationship with the subscriber and offer an opt-out, or if you are an affiliate of a business the subscriber has consented to receive affiliate messages from; an email forwarded to a mobile device without the sender's knowledge is not covered.

Cal. Bus. & Prof. Code §§ 17590-17594 · Read the law's page

• Before placing a telephone solicitation (a call seeking to sell, rent, lease, or promote goods, services, credit, investments, or insurance, or to gather marketing information for a future sale) to a California residential or wireless number, check it against the current national Do Not Call Registry and do not call a number on it.
• You may still call a listed number if the subscriber gave you express written permission naming your business and signed by the subscriber, if the call is at the subscriber's own request, if it concerns collecting a debt or offering credit on a delinquent obligation, or if you have an established business relationship with the subscriber formed by a purchase, rental, lease, or financial transaction within the preceding 18 months.
• Do not use the Do Not Call list for any purpose other than compliance, deny a subscriber's right to be placed on it, add a subscriber to it without their knowledge or consent, sell or lease it to anyone other than a telephone solicitor, or charge a fee to place a number on it.