Duty LXD-6418
Operates an app store, in California
Each law's tag says when it binds: since in force from , in 7 weeks not yet in force
California Online Privacy Protection Act (CalOPPA): privacy policy posting and contentssince 6 lines
Cal. Bus. and Prof. Code sections 22575 to 22579 · Read the law's page
- Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
- List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
- Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
- Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
- Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
- Post a missing privacy policy within 30 days of being notified that it is missing.
Customer Records Act, Reasonable Security Proceduressince 4 lines
Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page
- This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
- Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
- A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.
AB 1856 (2026), Digital Age Assurance Act amendments (operating systems and application stores)from , in 7 weeks6 lines
2026 Cal. Stats. ch. 184 (AB 1856), amending Cal. Civ. Code §§ 1798.500-1798.504 · Read the law's page
- Applies to any operating system that operates on a device and has an account setup feature, and to the application developers and covered application stores already reached by the Digital Age Assurance Act; browsers and website operators are not covered.
- As an operating system provider, send the age signal to a covered application store or to an application developer.
- As a developer, request a signal when an application is downloaded and launched, treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and do not request more information than the minimum needed.
- Do not request a signal unless this title or other applicable law requires it.
- For a device or application already set up or downloaded before , request or provide the signal by .
- As an operating system provider or application store, do not use compliance data anticompetitively (a nondiscrimination duty).
AB 1043 (2025), Digital Age Assurance Actfrom , in 7 weeks2 lines
Cal. Civ. Code §§ 1798.500-1798.505 · Read the law's page
- As an operating system provider, ask the account holder for a birth date or age at device setup, and send a real time age bracket signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) to app developers. The stated duties fall on operating system providers; app developers receive the signal.
- Do not require government ID or biometric data to do so.