Operates a social platform, in California

Cal. Bus. and Prof. Code sections 22575 to 22579 · Read the law's page

• Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
• List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
• Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
• Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
• Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
• Post a missing privacy policy within 30 days of being notified that it is missing.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Bus. & Prof. Code §§ 22589-22589.4 · Read the law's page

• Applies to a social media platform as defined in Business and Professions Code section 22675 (section 22589(d)), other than a platform controlled by a business entity that generated less than $100,000,000 in gross revenue during the preceding calendar year or a platform whose primary function is to allow users to play video games (section 22589.4).
• Disclose all cyberbullying reporting procedures in the platform's terms of service (section 22589.1(a)).
• Establish a prominent mechanism within the service that lets any individual, whether or not the individual has a profile on the service, report cyberbullying or any content that violates the terms of service related to cyberbullying; the mechanism must allow, but not require, a screenshot upload and collect basic identifying information, such as an account identifier, sufficient to locate the reported material (section 22589.1(b)(1) and (b)(2)(A)).
• Contact the reporting individual in writing by a method that includes a telephone number for text messages, an email address or another reasonable electronic method, inform the individual of all the options, and let the individual choose the method (section 22589.1(b)(2)(B) and (C)).
• Provide written confirmation to the reporting individual within 36 hours of receiving a report (section 22589.1(b)(2)(D)).
• Provide periodic written updates on the handling of the reported material, the first no later than 14 days after the confirmation and later ones no later than every 14 days until the final written determination (section 22589.1(b)(2)(E)).
• Issue a final written determination to the reporting user within 30 days of receiving the report, stating which of the five outcomes listed in the section applies; where circumstances beyond the platform's reasonable control prevent that, comply no later than 60 days after the material was first reported and give the reporting individual written notice of the delay no later than 48 hours after the platform knew the delay was likely (section 22589.1(b)(2)(F)).

Cal. Health & Safety Code §§ 27000-27007 · Read the law's page

• Applies to social media platforms as defined in Business and Professions Code Section 22675, in relation to users the platform knows are minors.
• Do not give a user you know is a minor an addictive feed or non default privacy settings without verifiable parental consent.
• A separate age verification requirement is not effective until January 1, 2027.
• The Ninth Circuit found on September 9, 2025 that the default setting limiting a minor's ability to view like counts and other feedback likely violates the First Amendment and ordered the district court to enjoin it; it affirmed denial of an injunction for most other provisions.
• A federal district court enjoined California on December 31, 2024 from enforcing the limits on notifications to minors and the annual disclosure of minor user numbers (sections 27002(a), 27002(b)(1) and 27005), and California did not appeal that part of the ruling.

SB 981 (Ch. 292, Stats. 2024), Cal. Bus. and Prof. Code Sections 22670 and 22671 · Read the law's page

• If you operate a social media platform, provide a mechanism that is reasonably accessible to a reporting user who is a California resident with an account on your platform to report sexually explicit digital identity theft, meaning an image or video created or altered through digitization that appears to show the reporting person's intimate body part or sexual act without their consent and is displayed, stored or hosted on your platform (Business and Professions Code Sections 22670 and 22671(a)).
• Collect information reasonably sufficient to locate each reported instance and to contact the reporting user, confirm receipt within 48 hours of the report, and send a written status update within seven days of that confirmation (Section 22671(b)).
• Within 30 days of the confirmation, or no later than 60 days after the material was first reported where circumstances beyond your reasonable control prevent that, determine whether there is a reasonable basis to believe the report is correct, and give the reporting user written notice of the delay within 48 hours of knowing it was likely (Section 22671(c)).
• Temporarily block the reported instance from being publicly viewable pending your determination, and immediately remove it from being publicly viewable if you determine there is a reasonable basis to believe it is sexually explicit digital identity theft (Section 22671(d)).
• A stand-alone direct messaging service with end-to-end encrypted communication, the end-to-end encrypted portion of a multiservice platform, and a service owned or operated by a nonprofit organization exempt from federal income tax under section 501(c)(3) of the Internal Revenue Code are not covered (Section 22670(d)(2)).

Cal. Bus. & Prof. Code §§ 22588.2-22588.4 · Read the law's page

• Applies to a social media platform as defined in Business and Professions Code section 22675; the verified reporter process and the duties that follow bind only a large social media platform, defined in section 22588.2(c).
• Disclose all social media-related threat reporting procedures for verified reporters in the platform's terms of service (section 22588.3(a)).
• A large social media platform must create a process to verify as verified reporters a principal, or a position of similar responsibility, of any school lawfully operating any programs from kindergarten and grades 1 to 12 in the state, and a mental health professional licensed under California law who provides mental health services to minors in the state (section 22588.3(b)).
• A large social media platform must create a process by which a verified reporter can report a social media-related threat, or a violation of the platform's terms of service, that in the reporter's opinion poses a risk or a severe risk to the health and safety of a minor; the process must allow, but not require, a screenshot upload, give every verified reporter an electronic point of contact for matters involving harms to a minor, and confirm receipt of a report and give a means to track it (section 22588.3(c)).
• A large social media platform must establish an internal process to receive and substantively respond within 72 hours, or within 24 hours if the report is of a severe risk, to a verified reporter's report, and must have a natural person review a report the verified reporter deems to be of a severe risk (section 22588.3(d)).
• A large social media platform that receives a report from a verified reporter must report annually on a publicly accessible internet website the total number of reports from verified reporters, the percentage of each social media-related threat that formed the basis of those reports, and the percentage of those reports for which the platform took further action (section 22588.3(e)).
• A large social media platform must not require a verified reporter to reverify the reporter's qualifications more often than once every two years (section 22588.3(f)).
• The chapter does not reach a service that primarily facilitates the sale or provision of professional services or the sale of commercial products, a service that primarily provides news or information and does not let a user send content directly to a child, or a messaging service of the kind described in section 22588.2(c)(2)(C).

Cal. Civ. Code sections 3273.90 and 3273.91 · Read the law's page

• If you operate a social media platform that generates more than $100,000,000 per year in gross revenues, provide a clear and conspicuous button labeled "Delete Account" as an immediately visible option in the platform's settings menu, in the application, on a browser or in any other format users use to access the platform (section 3273.91(a)).
• When a user clicks the button, give the user the steps to complete an account deletion request, which must include deletion of the user's personal information. If you seek verification, do it in a cost-effective and easy-to-use manner through preestablished two-factor authentication, email, text message, telephone call or message (section 3273.91(b)).
• Do not obstruct or interfere with a user's ability to delete their account, including by using dark patterns (section 3273.91(c)).
• Process the request as a request to delete personal information under section 1798.105 and the California Consumer Privacy Act, and do not treat a later login to the account as revoking the request (section 3273.91(d) and (e)).

Cal. Bus. and Prof. Code Sections 22757 to 22757.6 · Read the law's page

• Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the content
• To the extent it is technically feasible, embed in image, video, and audio content your system creates or alters a latent disclosure carrying your name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content, and make it permanent or extraordinarily difficult to remove
• Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that
• If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney General
• Do not falsely represent that your generative AI system is designed to primarily function as assistive technology
• If you run a large online platform, from 1 January 2027 detect provenance data in content distributed on it, show users a clear indication of whether any system provenance data or digital signature identifies the content as generated, substantially altered, or captured by a device, let users inspect that data, and, to the extent technically feasible, do not knowingly strip it
• If you manufacture a capture device that you first produce for sale in California on or after 1 January 2028, provide users the option to include in captured content a latent disclosure naming you as manufacturer, the device's name and version, and the time and date of the content's creation or alteration, and embed latent disclosures in captured content by default, to the extent technically feasible and compliant with widely adopted specifications
• Later phases add duties for GenAI hosting platforms from 1 January 2027

2026 Cal. Stats. ch. 183 (AB 1709), adding Bus. & Prof. Code ch. 22.9 (§ 22682 et seq.) and Gov. Code ch. 5.4 (§ 11530 et seq.) · Read the law's page

• Applies to internet websites, online services or applications that offer an addictive feed as a significant part of the service, excluding commercial transaction sites and cloud storage services.
• Do not let users under 16 access addictive feeds, autoplay and similar engagement features, using age determinations from the Digital Age Assurance Act or Health and Safety Code Section 27001.

AB 1705 (Ch. 890, Stats. 2026), Cal. Bus. and Prof. Code Sections 22610 to 22618 · Read the law's page

• If you operate a website that permits users to upload, or solicits from users, sexually explicit content for display, exercise ordinary care and reasonable diligence so that no instance of sexually explicit content you display includes a depicted individual, meaning a person shown who did not consent to being depicted, was a minor when it was created, or did not consent to its being uploaded (Business and Professions Code Sections 22610(a), 22612).
• Exercise ordinary care and take reasonable steps so that no sexually explicit content uploaded to your website includes a depicted individual (Section 22614(a)(1)).
• Before a user uploads sexually explicit content, obtain the user's statement, certified under penalty of perjury, that each individual depicted was not a minor when the content was created, consents to the upload and consented to being depicted, together with information sufficient to contact the user, including at least an email address (Section 22614(a)(2)).
• Verify the user's email address before permitting the user to upload sexually explicit content (Section 22614(c)).
• Keep each statement and the user's information in a readily available format for at least seven years after they are submitted (Section 22614(b)).

AB 1946 (Ch. 185, Stats. 2026), Cal. Civ. Code Sections 3273.65 to 3273.67 and 3345.1 · Read the law's page

• If you operate a social media platform, provide a clear and conspicuous reporting mechanism, reasonably accessible to users and free of dark patterns, that lets a California resident report material they reasonably believe is child sexual abuse material displayed, stored or hosted on your platform, including material sent through direct messaging that is not end-to-end encrypted (Civil Code Section 3273.66(a)).
• Collect information sufficient to contact each reporting user, and contact them in writing by the method they choose (Section 3273.66(b)(1), (c)).
• Have a natural person review a report when there is no established or known hash match to child sexual abuse material and the reported material is not otherwise blocked (Section 3273.66(b)(2)).
• Within 48 hours of a report, permanently block the reported instance from view if there is a reasonable basis to believe it is child sexual abuse material hosted on your platform and the report has basic identifying information sufficient to locate it, and make reasonable efforts to remove and block other instances of the same material (Section 3273.66(d)).
• Within 72 hours of the first report, send the reporting user written confirmation of the actions taken, and within seven days send a final written determination that the material was blocked, was not child sexual abuse material, or was not hosted on your platform (Section 3273.66(e) to (g)).
• If circumstances beyond your reasonable control prevent compliance within 48 hours, give the reporting user written notice of the delay within 48 hours of knowing it was likely, and comply no later than 10 days after the first report (Section 3273.66(h)).
• Restore the reporting mechanism if it becomes unavailable or nonfunctional (Section 3273.66(i)).
• To keep the defense in Section 3345.1(g)(3) against a claim of knowingly facilitating commercial sexual exploitation, maintain a program of at least biannual audits of your designs, algorithms, practices, affordances and features, act on each audit within 30 days, give each audit to your board of directors within 90 days, and submit the audits to the Attorney General.

AB 2 (Ch. 180, Stats. 2026), Cal. Civ. Code Section 1714.02 · Read the law's page

• If you operate a social media platform that generates more than $100,000,000 a year in gross revenues, exercise ordinary care and skill in the management of your platform and its features; an injury to a child caused by a want of ordinary care or skill makes you liable for statutory damages of the larger of $5,000 per violation, up to $1,000,000 per child, or three times the child's actual damages (Civil Code Sections 1714(a), 1714.02(a)).
• A term of service or contract clause that waives the section is void and unenforceable, so it does not limit your liability for an injury to a child (Section 1714.02(b)).

Cal. Health & Safety Code §§ 28000-28002 · Read the law's page

• Applies to covered platforms: addictive internet based services or applications consistent with Health and Safety Code Section 27000.5, excluding services whose primary function is commerce, cloud storage, email or direct messaging.
• Display a prescribed black box warning, attributed to the Surgeon General, to users under 18: for at least 10 seconds covering at least 25 percent of the screen on first daily access.
• Display the warning again for at least 30 seconds covering at least 75 percent of the screen after 3 hours of cumulative daily use and each hour thereafter.