Publishes adult content, in California

Cal. Civ. Code § 1798.99.1, as amended by AB 2076 (Ch. 920, Stats. 2026) · Read the law's page

• Take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including verifying the age of the purchaser, if you conduct business in California and seek to sell any product or service in or into California that is illegal under state law to sell to a minor (Civil Code Section 1798.99.1(a)(1)).
• For firearms, ammunition, tobacco, electronic cigarettes and the other products in subdivision (c), reasonable steps include requiring the purchaser or recipient to input, scan, provide, or display a government-issued identification or shipping the product or service to an individual who is of legal age (Section 1798.99.1(a)(3)).
• Do not treat consent obtained through the minor as a reasonable step (Section 1798.99.1(a)(4)).
• Do not retain, use, or disclose information you receive from a purchaser or recipient to verify age for any purpose other than complying with, or demonstrating compliance with, the section, California law, or a state or federal court order (Section 1798.99.1(a)(6)).
• From January 1, 2027, do not allow a purchaser to use a gift card or store credit for the products or services in subdivision (c), which then include nitrous oxide (Section 1798.99.1(a)(3)(B) and (c)(7), as amended by AB 2076).

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Penal Code Sections 311.1, 311.2 and 311.11 (AB 1831, Ch. 926, and SB 1381, Ch. 929, Stats. 2024) · Read the law's page

• Do not knowingly possess or control matter that incorporates digitally altered or artificial-intelligence-generated matter, knowing that the matter is obscene and depicts what appears to be a person under 18 years of age engaging in or simulating sexual conduct (Penal Code Section 311.11(a)(2)).
• Do not knowingly possess or control matter that incorporates digitally altered or artificial-intelligence-generated matter, the production of which involves the use of a person under 18 years of age, knowing that it depicts a person under 18 years of age engaging in or simulating sexual conduct; the matter need not be obscene, and the paragraph does not apply to drawings, figurines or statues (Section 311.11(a)(1) and (d)).
• Do not, in California, possess, prepare, publish, produce, develop, duplicate or print digitally altered or artificial-intelligence-generated matter with intent to distribute or exhibit it, and do not distribute or exhibit obscene matter, knowing that it depicts a person under 18 years of age or contains digitally altered or artificial-intelligence-generated data depicting what appears to be a person under 18 years of age engaging in or simulating sexual conduct (Section 311.1(a)).
• Do not distribute or exhibit obscene matter depicting a person under 18 years of age, or an AI-generated or digitally altered depiction of what appears to be one, for commercial consideration, and do not possess such matter with intent to distribute it for commercial consideration (Section 311.2(b)); do not distribute or exhibit it to, or exchange it with, a person under 18 years of age (Section 311.2(d)).
• The prohibitions in Sections 311.1 and 311.2 do not apply to the activities of law enforcement and prosecuting agencies in investigating and prosecuting criminal offenses, to legitimate medical, scientific or educational activities, or to lawful conduct between spouses (Sections 311.1(b) and 311.2(e)).

SB 981 (Ch. 292, Stats. 2024), Cal. Bus. and Prof. Code Sections 22670 and 22671 · Read the law's page

• If you operate a social media platform, provide a mechanism that is reasonably accessible to a reporting user who is a California resident with an account on your platform to report sexually explicit digital identity theft, meaning an image or video created or altered through digitization that appears to show the reporting person's intimate body part or sexual act without their consent and is displayed, stored or hosted on your platform (Business and Professions Code Sections 22670 and 22671(a)).
• Collect information reasonably sufficient to locate each reported instance and to contact the reporting user, confirm receipt within 48 hours of the report, and send a written status update within seven days of that confirmation (Section 22671(b)).
• Within 30 days of the confirmation, or no later than 60 days after the material was first reported where circumstances beyond your reasonable control prevent that, determine whether there is a reasonable basis to believe the report is correct, and give the reporting user written notice of the delay within 48 hours of knowing it was likely (Section 22671(c)).
• Temporarily block the reported instance from being publicly viewable pending your determination, and immediately remove it from being publicly viewable if you determine there is a reasonable basis to believe it is sexually explicit digital identity theft (Section 22671(d)).
• A stand-alone direct messaging service with end-to-end encrypted communication, the end-to-end encrypted portion of a multiservice platform, and a service owned or operated by a nonprofit organization exempt from federal income tax under section 501(c)(3) of the Internal Revenue Code are not covered (Section 22670(d)(2)).

Cal. Civ. Code Section 1708.86 (AB 621, Ch. 673, Stats. 2025) · Read the law's page

• Do not create and intentionally disclose, or intentionally disclose, digitized sexually explicit material (an image, video or other visual or audiovisual work created or substantially altered through digitization that shows a depicted individual in the nude or appearing to engage in, or being subjected to, sexual conduct) if you know, or reasonably should know, that the person depicted did not consent or was a minor when the material was created
• Do not knowingly facilitate, or recklessly aid or abet, another person's creation and intentional disclosure of digitized sexually explicit material
• If you own, operate or control a deepfake pornography service, an internet website, mobile application or other service whose primary purpose is to create digitized sexually explicit material, hold the express written consent of each person depicted: you are treated as creating and intentionally disclosing the material and are presumed to have known the person did not consent unless you produce that consent
• If you provide a service that enables the ongoing operation of a deepfake pornography service, take all necessary steps to stop providing it within 30 days of receiving evidence from a depicted individual or a public prosecutor that you are providing it, or you are presumed to be knowingly facilitating or recklessly aiding or abetting the conduct (a court may extend the 30 days for an ongoing law enforcement investigation or operation)
• Do not rely on a disclaimer in the material, or on a statement that users are prohibited from generating such material without the individual's consent, as a defense
• An internet service provider is not liable under the section for the mere transmission, routing, or provision of access to third-party content over its network, and the section does not apply to conduct protected by federal law, including Section 230 of Title 47 of the United States Code

AB 1705 (Ch. 890, Stats. 2026), Cal. Bus. and Prof. Code Sections 22610 to 22618 · Read the law's page

• If you operate a website that permits users to upload, or solicits from users, sexually explicit content for display, exercise ordinary care and reasonable diligence so that no instance of sexually explicit content you display includes a depicted individual, meaning a person shown who did not consent to being depicted, was a minor when it was created, or did not consent to its being uploaded (Business and Professions Code Sections 22610(a), 22612).
• Exercise ordinary care and take reasonable steps so that no sexually explicit content uploaded to your website includes a depicted individual (Section 22614(a)(1)).
• Before a user uploads sexually explicit content, obtain the user's statement, certified under penalty of perjury, that each individual depicted was not a minor when the content was created, consents to the upload and consented to being depicted, together with information sufficient to contact the user, including at least an email address (Section 22614(a)(2)).
• Verify the user's email address before permitting the user to upload sexually explicit content (Section 22614(c)).
• Keep each statement and the user's information in a readily available format for at least seven years after they are submitted (Section 22614(b)).

Cal. Penal Code Sections 311.3 and 11165.1 (SB 1276, Ch. 192, Stats. 2026) · Read the law's page

• Enacted and not yet in force: from January 1, 2027, do not knowingly develop, duplicate, print, download, stream, access through electronic or digital media, or exchange any representation of information, data or image that contains or incorporates any film, filmstrip, or any digitally altered or artificial-intelligence-generated matter depicting a person under 18 years of age engaged in an act of sexual conduct, knowing that it does (Penal Code Section 311.3(a)).
• It is not necessary to prove that the matter is obscene to establish a violation (Section 311.3(b)).
• The prohibition does not apply to law enforcement and prosecution activities in investigating and prosecuting offenses, legitimate medical, scientific or educational activities, lawful conduct between spouses, an employee of a commercial film developer acting within the scope of employment, or matter that is unsolicited and received without knowledge or consent through a system you do not control (Section 311.3(d), (f) and (g)).